Alarm management

Abstract

According to one example aspect of the present disclosure, there is provided an apparatus configured to: store a set of parameters of a machine-learned classifier configured to predict a networking alarm, the set of parameters including at least one maximum time interval; processing a first sequence of alarm signals originating from a networked environment, continuous alarms being contained in said first sequence of alarm signals occurring at a maximum time interval, said maximum time interval being contained in said at least one maximum time interval between each other; and predicting at least one second alarm signal to occur during the first time interval based on the first alarm signal sequence using the set of parameters of the machine learning classifier and the machine learning classifier.

Description

Technical Field

[0001] The present disclosure relates to management of alarms in a networked system, such as, for example, a communication network. Background Art

[0002] Fault management systems in communication networks are used to detect, identify, manage and / or repair network faults, i.e. events in which network functionality is impaired due to hardware or software problems in network elements, which render the network elements unavailable and / or degraded in providing network services.

[0003] To communicate fault information, a network element or network management system issues an alarm that represents observable potential fault symptoms to notify of a possible fault. Several alarms may appear in cascades, as a single original fault may cause one or more additional events, generating alarms in the system.

[0004] Due to a fault event, a large number of alarms may be generated as a sequence to affect different parts of the same device in the case of an intra-node fault, or to affect different devices in the case of an inter-node fault or a cross-domain fault. Summary of the invention

[0005] According to some aspects, the subject matter of independent claims is provided. Some embodiments are defined in the dependent claims. The independent claims define the scope of protection of various embodiments of the invention. The embodiments and features described in this specification that do not belong to the scope of the independent claims (if any) are to be interpreted as examples that help to understand the various embodiments of the invention.

[0006] According to a first aspect of the present disclosure, a device is provided, which includes at least one processing core and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to work together with the at least one processing core so that the device at least: stores a parameter set of a machine learning classifier configured to: predict networked alarms, the parameter set including at least one maximum time interval; processes a first alarm signal sequence originating from a networked environment, wherein consecutive alarms are included in the first alarm signal sequence occurring at the most time intervals, and the most time intervals are included in the at least one maximum time interval between each other; and uses the parameter set of the machine learning classifier and the machine learning classifier to predict at least one second alarm signal to occur during the first time interval based on the first alarm signal sequence.

[0007] According to a second aspect of the present disclosure, a method is provided, the method comprising: storing in a device a parameter set of a machine learning classifier configured to: predict networked alarms, the parameter set comprising at least one maximum time interval; processing a first alarm signal sequence originating from a networked environment, wherein consecutive alarms are included in the first alarm signal sequence occurring at the most time intervals, and the most time intervals are included in the at least one maximum time interval between each other; and using the parameter set of the machine learning classifier and the machine learning classifier to predict at least one second alarm signal to occur during the first time interval based on the first alarm signal sequence.

[0008] According to a third aspect of the present disclosure, a non-transitory computer-readable medium is provided, on which a computer-readable instruction set is stored, and when the computer-readable instruction set is executed by at least one processor, the device at least: optimizes a parameter set of a machine learning classifier configured to predict network alarms, the parameter set including: at least one maximum time interval; provides multiple network alarm sequences as training data for the optimization of the parameter set of the machine learning classifier, the lengths of the multiple network alarm sequences are not all equal, and continuous alarms are included in the first alarm signal sequence occurring in the most time intervals, and the most time intervals are included in at least one maximum time interval between each other.

[0009] According to a fourth aspect of the present disclosure, a device is provided, which includes components for: storing a parameter set of a machine learning classifier configured to predict networked alarms, the parameter set including at least one maximum time interval; processing a first alarm signal sequence originating from a networked environment, wherein consecutive alarms included in the first alarm signal sequence are at most separated by a time interval included in at least one maximum time interval; and using the parameter set of the machine learning classifier and the machine learning classifier to predict at least one second alarm signal to occur during the first time interval based on the first alarm signal sequence.

[0010] According to a fifth aspect of the present disclosure, a non-transitory computer-readable medium is provided, on which a computer-readable instruction set is stored, and when the computer-readable instruction set is executed by at least one processor, the device at least: stores a parameter set of a machine learning classifier configured to predict networked alarms, the parameter set including at least one maximum time interval; processes a first alarm signal sequence originating from a networked environment, continuous alarms are included in the first alarm signal sequence occurring at the most time intervals, and the most time intervals are included in the at least one maximum time interval between each other; and uses the parameter set of the machine learning classifier and the machine learning classifier to predict at least one second alarm signal to occur during the first time interval based on the first alarm signal sequence.

[0011] According to a seventh aspect of the present disclosure, a computer program is provided, which is configured to cause a device to perform at least the following operations when executed: store a parameter set of a machine learning classifier configured to predict a networked alarm, the parameter set including at least one maximum time interval; process a first alarm signal sequence originating from a networked environment, continuous alarms are included in the first alarm signal sequence occurring at the most time intervals, and the most time intervals are included in the at least one maximum time interval between each other; and use the parameter set of the machine learning classifier and the machine learning classifier to predict at least one second alarm signal to occur during the first time interval based on the first alarm signal sequence. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 illustrates example systems in accordance with at least some embodiments of the present invention;

[0013] Figure 2A illustrates an alarm prediction according to at least some embodiments of the present invention;

[0014] Figure 2B illustrates an alarm prediction according to at least some embodiments of the present invention;

[0015] Figure 2C The training of individual predictors is illustrated;

[0016] Figure 3 illustrates example devices capable of supporting at least some embodiments of the present invention;

[0017] Figure 4 is a flow chart according to at least some embodiments of the present invention, and

[0018] Figure 5 is a flow chart of a method according to at least some embodiments of the present invention. DETAILED DESCRIPTION

[0019] Due to the number of alarms, there are challenges in managing the alarm business, and it is difficult to interpret the alarms in a timely manner to minimize the impact on the functionality of the communication network. Based on the alarms that have been generated in the networked environment, a machine learning solution is used to predict the occurrence of alarms in the networked environment. Based on the predicted alarms, actions can be taken before the predicted alarms occur, such as reconfiguring the networked environment to reduce the likelihood of the predicted alarm actually occurring, and / or work instructions for maintenance personnel can be sent to start recovering from the predicted alarm before it occurs. Although the communication network is mainly discussed in this article, the technical principles disclosed in this article are also applicable to other networked environments where alarms are generated and alarm management is required. Examples of such other networked environments include equipment networks installed in aircraft (such as commercial aircraft) and industrial automation system networks.

[0020] Figure 1 An example system according to at least some embodiments of the present invention is illustrated. The system shown is a wireless communication network, which includes a radio access network and a core network 120, wherein the radio access network includes a base station 102 and the core network includes core network nodes 104, 106 and 108. Depending on the technology used, the base station 102 can be called an access point, an access node or a node b, an eNb or a gNb node. A network can have dozens, hundreds or even thousands of base stations. Examples of wireless communication networks include cellular communication networks and non-cellular communication networks. Cellular communication networks include wideband code division multiple access WCDMA, long term evolution LTE and fifth generation 5G networks. Examples of non-cellular wireless communication networks include global microwave access interoperability WiMAX and wireless local area network WLAN networks.

[0021] The core network nodes 104, 106, 108 may include, for example, a mobility management entity MME, a gateway, a subscriber registry, an access and mobility management function AMF, and a serving general packet radio service support node SGSN. The core network nodes are logical entities, which means that they can be physically distinct independent devices or virtualized network functions VNF running on a computing substrate. In some network technologies, in addition to base stations, the radio access network also includes a base station controller.

[0022] The fault management system FMS110 is configured to receive alarms from the network, whether only from the core network or from both the core network and the radio access network. Alarms from the radio access network can be received in the FMS110 via the core network 120. Alarms can be issued by logical or physical nodes, for example, the MME can send an alarm when the criteria for sending an alarm are met, such as when its delay exceeds a limit. Similarly, if the MME operates as a VNF on a computing substrate, the computing substrate can send an alarm to the FMS110 when it detects its performance problems, such as hard drive failure, memory checksum failure, power outage, and the resulting battery power failure or overload. In particular, when the computing substrate is overloaded due to receiving the computing load of another faulty computing substrate in the same network, an overload alarm cascade may be generated. Similarly, a fire in a server space may affect multiple computing substrates and their running VNFs, which will fail in sequence due to the heat generated by the fire.

[0023] FMS110 is configured to open work orders in response to alarms. For example, a work order may instruct maintenance personnel to pay attention to replacing a faulty component in a device included in the network environment. In the decision to send a work order, one challenge is that the work order must be generated in a timely manner to avoid premature generation, such as in response to a self-recovering temporary fault. On the other hand, if a work order is required, it should be sent as soon as possible to limit the impact of the fault on network services. Therefore, it is of great significance to have a comprehensive and timely understanding of the alarm sequence. As the scale of the network environment increases, the number of alarms generated tends to increase, which also increases the technical challenge of responding to alarms in a timely and effective manner.

[0024] As disclosed herein, a machine learning solution is used to predict the occurrence of future alarms in a network environment. This provides an advantage in time, because the response to the predicted alarm can be initiated before the predicted alarm occurs, thereby providing a technical effect of reducing or even eliminating the time when the fault behind the predicted alarm affects the performance of the networked environment. In some embodiments, the machine learning solution is trained to not only predict the occurrence of alarms but also predict the necessary response to the alarm, so that work instructions can be automatically sent to the alarms that really need intervention as a response to the prediction before the relevant alarm occurs. Therefore, for example, for self-healing alarms, work instructions will not be sent. This training can be performed by accumulating training data from the historical maintenance records of the networked environment in question. The machine learning algorithm can learn to predict when the alarm may be self-healing or have limited impact on performance based on the pattern of the arrival alarm, so that no work instructions are needed. In other words, the FMS110 can be configured to: predict future alarms that require the generation of work instructions, and predictively send work instructions before the predicted alarm occurs. Therefore, the FMS110 provides predictive information about the technical status of the networked environment, which enables timely action to keep the networked environment in a working state.

[0025] The machine learning solution used may be a classifier CAR based on association rules. Examples of machine learning algorithms based on association rules include apriori algorithm, eclat algorithm, frequent patterns, FP, growth algorithm, and ASSOC and OPUS search algorithms. Alternatively or additionally, the machine learning solution used may include an artificial neural network, such as a convolutional artificial neural network, a recursive artificial neural network.

[0026] When using an association rule-based machine learning classifier or neural network, the training set can include multiple alarms, each alarm having at least one, at least two, at least three, or all of the following attributes: alarm device type / vendor, which is the main information item of the alarm aggregation; alarm issuance and / or alarm clearing timestamp; alarm type; alarm severity (e.g., critical, major, minor, warning, or notification); affected equipment component category; affected sub-items within the spatial scope (e.g., if the alarm is at a device, slot, or port, it has an associated ID); ticket (alarm marked with a trouble ticket and ID, or empty if not marked); and work order (alarm marked with a work order and ID, or empty if not marked).

[0027] After the system is trained and used in inference mode in a live networked environment, incoming alerts will have the same attributes as in training, except that ticket and work order fields are not initially provided, but added as needed by the FMS 110. In addition, as described above, work order information can be automatically and predictively provided to forecast alerts that have not yet occurred without human intervention.

[0028] The FMS 110 may store the trained and / or selected parameters of the machine learning classifier and apply these parameters to the incoming alarm sequence to form a first alarm sequence. In the first alarm sequence, consecutive alarms among the individual alarms included in the first alarm sequence are separated in time by at most a maximum time interval, which corresponds to a maximum causal distance in a networked environment. The FMS will then predict at least one second alarm signal based on the first alarm sequence and the trained classifier parameters. In particular, the predicted at least one second alarm is predicted to occur during the time interval, that is, the prediction not only predicts the occurrence of the alarm, but also predicts an estimate of the time when the alarm occurs. As described above, the FMS may also predict whether a predicted alarm that has not yet occurred requires a work instruction.

[0029] Although the entire first warning signal sequence predicts at least one second warning, the initial part of the first warning signal sequence itself can also predict at least one second warning. Figure 2A More generally, a subset (such as an appropriate subset) of a first alert sequence may be used to predict at least one second alert.

[0030] For use in a machine learning classifier, the incoming alarm can be transformed into an invariant part and a varying part, so that the invariant part cannot predict the moment when at least one second alarm signal occurs, while the varying part can predict the moment when at least one second alarm signal occurs. The invariant part will be referred to herein as the core profile, which is described by the core feature set, and the varying part will be referred to as the complete profile, which is described by the complete feature set. The core feature set is a proper subset of the complete feature set. The core and complete profiles will be discussed in more detail below.

[0031] In some embodiments, the FMS 110 is configured to perform prediction of the at least one second alarm signal such that it generates a separate prediction for each future time interval of a plurality of future time intervals related to the occurrence of the at least one second alarm signal. Each prediction may be assigned a likelihood that describes the probability of the predicted alarm occurring during the corresponding time interval. For example, a first prediction may be generated for a time interval starting at a current time t0 and extending to t0+delta_t, a second prediction may be generated for a time interval starting at time t0 and extending to t0+2×delta_t, and a third prediction may be generated for a time interval starting at time t0 and extending to t0+3×delta_t. For example, the time t0 may correspond to the current calendar day and delta_t may correspond to 24 hours.

[0032] Figure 2A Alarm prediction according to at least some embodiments of the present invention is illustrated. The figure includes three time axes 201, 202 and 203. On each time axis, time advances from left to right. Time axis 201 represents training data for training parameters of a machine learning classifier to predict alarms. The training data can be constructed at the initial stage of the process. In detail, an alarm sequence including alarms X1, X2, X3, X4 and A is shown. Of course, the number of alarms in a sequence does not need to be five, but can be less than or greater than five. When the sequence {X1, X2, X3, X4} is observed during the inference mode, the training process enables the classifier to predict alarm A. The consecutive alarms in the sequence {X1, X2, X3, X4} are within a maximum time interval 210 of each other. The maximum time interval 210 represents the maximum causal distance in time in the networked environment in question, and can be experimentally determined during the training process of the machine learning parameters, or initially determined experimentally and subsequently updated during the training process or retraining process of the machine learning parameters. In other words, for example, alarm X2 is caused by alarm X1, which in turn is caused by alarm X2, which in turn is caused by alarm X4. Alternatively, for example, X1 may cause both X2 and X3, which in turn may cause X4. In general, there are causal relationships between alarms in a sequence. This forms an alarm cascade. Alarm A is most directly caused by alarm X4, although as a whole it is included in the entire alarm cascade.

[0033] The sequence of alarms is observed by recording incoming alarms within a maximum time interval 210 of each other, thereby forming a sequence. Once the most recently received alarm in the sequence is followed by no alarm within a maximum time interval 210, the entire sequence of alarms has been received. Subsequent alarms are either single alarms that are not included in the sequence or alarms that are included in another alarm sequence. After the complete alarm sequence is defined, the pattern causal length of the sequence can be determined as the time elapsed between the first and last alarms in the observed sequence.

[0034] In some embodiments, multiple maximum time intervals may be employed such that a first time interval of the multiple maximum time intervals may be applied to the maximum allowed time interval between the first two alarms in the alarm sequence, and thereafter, a second time interval of the multiple maximum time intervals may be applied to the maximum allowed time interval between the second and third alarms in the alarm sequence, and so on. Furthermore, additionally or alternatively, the maximum time interval after a certain alarm may depend on the type of alarm, e.g., after a critical alarm, the alarm immediately following in the sequence must arrive sooner after the non-critical alarm assumed to be causally linked. This is useful because certain types of alarms may lead to additional alarms in a cascade of alarms more quickly than other types of alarms. Which type of alarm is expected to lead to subsequent alarms more quickly depends on the specific characteristics of the networking environment in question. This enhances the predictive capabilities of the alarm prediction system.

[0035] The maximum time interval 210 can be, for example, one day, one hour, or two days. The time interval 220 is the time at which alarm A is expected to occur after alarm X4. This can exceed the maximum time interval 210 because alarms that are not included in the training data can occur between alarm X4 and alarm A. Due to variations in components and workloads, failure cascades do not always unfold at exactly the same time, and there may also be some variation in the time intervals between alarms in the sequence. The sequence {X1, X2, X3, X4} is a sequence of alarms used to predict additional alarms and does not necessarily include all alarms generated by the networked environment during that time. In fact, the system can be configured to delete certain types of alarms, such as notifications, before feeding the alarms to the machine learning classifier.

[0036] The sequence of alarms on the timeline 201 may also indicate that alarm A is associated with a work order, so that not only the occurrence of alarm A but also the occurrence of a related work order may be predicted. For example, a work order may be an order to replace a failed hardware component. Alarm A may additionally or alternatively be associated with an instruction to automatically perform a modification in a networked environment, such as switching the workload of a logical node to another logical node. For example, the switching of workloads may be useful in the case where a protocol connection is switched to another node before a node fails, which enables the protocol connection to be protected from being interrupted by the failure that generated alarm A.

[0037] As described above, the incoming alarm data fed to the machine learning classifier can be pre-processed by removing alarms from the machine learning classifier that are known to be irrelevant to the alarm cascade. Other examples of such alarms are alarms that do not occur within the maximum time interval 210 of any previous or subsequent alarms. This pre-processing is performed during the training phase and during the inference phase when predictions are made for the future. In some embodiments, notification level alarms are also removed from the data used for training and inference.

[0038] Alarms may have their timing processed based on their timestamp indicating when the alarm was generated, rather than the time the alarm was received in the FMS 110. This removes uncertainty from the prediction process that may result from jitter that may occur in the networking environment. In other words, for example, the maximum time interval 210 is applied to the timestamp indicating when the alarm was generated, rather than to the time the alarm was received in the FMS 110. Indeed, if a node fails in a networking environment, the propagation time of a message, such as an alarm, may be unpredictable.

[0039] Timeline 202 represents the inference pattern, where t0 is the current time. The alarm sequence {X1, X2, X3, X4} has been observed in the past, so based on training using the training data shown in timeline 201, FMS110 predicts that alarm A will occur during time interval 2A. When t0 is close to the occurrence of X4, that is, after t0, the system has observed alarm X4, and interval 2A can be relatively short. Conceptually, this can be thought of as the moment when A occurs at time interval 220 after alarm X4. Since the entire sequence {X1, X2, X3, X4} has been observed, the occurrence of alarm A can be predicted with a fairly high probability. Although the probability discussed here is high, in practice this will depend on the alarm cascade data generated in the networked environment. According to Figure 2A , it is assumed that the sequence {X1,X2,X3,X4} is highly predictive of alert A, although this cannot unambiguously represent all networking environments.

[0040] FMS 110 may generate a separate prediction for each future time interval of a plurality of future time intervals, such as time interval 2A regarding the occurrence of alert A. For example, the sequence {X1, X2, X3} may have been used to predict the occurrence of A during time interval 2F, which is longer than time interval 2A, or later than the start time of time interval 2A.

[0041] In each individual prediction, the FMS 110 can be configured to use different cutoff points to select input data in terms of the alarm data generated by the networked environment. Generally, the later the time period for generating the prediction, the earlier the cutoff point for the start of the time period including the alarm in the input data. In practice, different machine learning classifiers can be used to generate predictions for corresponding different time intervals. In particular, the FMS 110 can be configured to search only the initial part of the input alarm sequence when the time interval for generating a particular prediction is in the future. In other words, training can be performed with a longer input alarm sequence, and predictions in inference mode can be performed using only the initial part of the determined predicted input alarm sequence to generate predictions for future time intervals.

[0042] Time axes 203.1 and 203.2 represent the inference mode, where t0 is also the current time. In the case of time axis 203.1, the alarms X1 and X2 of the sequence {X1, X2, X3, X4} have been received and the FMS 110 generates a prediction that alarm A will occur during the time interval 2G, because it occurs after the initial part {X1, X2} of the sequence {X1, X2, X3, X4}. Moreover, the time elapsed from X2 to the alarm A along time axis 201 in the training data is the same as the time between X2 in time axis 203.1 and the alarm A in the time interval 2G. This prediction can be performed when the total duration of the sequence {X1, X2, X3, X4} from the first alarm X1 to the end (X1 to X4) in the sequence has not yet passed, in other words, the prediction can be generated when the sequence is still in progress and has not yet been completely received, but when its initial part has been received. Likewise, in other words, the initial portion {X1, X2} is used as the predicted input alarm sequence in the predictor for time interval 2G. For time interval 2F, time axis 203.2, the corresponding predicted input alarm sequence is {X1, X2, X3}. In general, the later the time interval for generating the prediction, the shorter the initial portion of the input alarm sequence used to generate the prediction.

[0043] The prediction of the situation on timelines 203.1 and 203.2 may be assigned a lower likelihood than the situation on timeline 202 because it is based on a shorter incoming alarm sequence and is therefore less certain. However, if alarm A occurs according to the prediction, the timing of alarm A may be quite reliable. Therefore, if alarm A is associated with a work instruction, or a modification instruction in the training data of timeline 201, then in the case of timeline 202 and in the cases of timelines 203.1 and 203.2, a work instruction, or an instruction to automatically perform a modification in a networked environment, may be predictively assigned to alarm A.

[0044] In the case of timeline 203.1 or 203.2, if the FMS110 assigns a work order or modification instruction to the forecast alarm A, the FMS110 can be configured to cancel the work order or modification instruction if the entire sequence {X1, X2, X3, X4} is not received. For example, if alarm X3 is not received after the prediction, the sequence will not be received within the maximum time interval 210 from alarm X2, and the prediction based on the initial part of the sequence {X1, X2} may be wrong. Such an erroneous prediction may be canceled together with its modification instructions or work instructions. A prediction based on a subset of the entire sequence may also expire when a new prediction is made for the same alarm based on a larger subset of the sequence. Earlier predictions become redundant because new predictions based on a longer alarm sequence may be more reliable. Expired predictions can be deleted.

[0045] In some embodiments, outstanding forecasts are not cancelled due to the arrival of a longer sequence, but rather the strategy followed is used, i.e., when the predicted alarm fails to occur within the predicted time interval, or the predicted alarm occurs before the end of the predicted time interval, the outstanding forecast is cancelled. The reason for this behavior is that even though the system knows that different alarm subsequences are related, each forecast is trained independently on its subsequence, and therefore each forecast has its own validity, also independent of other forecasts.

[0046] Furthermore, in these embodiments, not canceling predictions due to the arrival of longer sequences helps establish validation of the predictions and thereby create ground truth for retraining. For example, the system behavior may be as follows: subsequence 1 {X1, X2, X3} may result in a prediction of A in the future interval [0, T1] because it matches the rules learned by the classifier during training (e.g., {X1, X2, X3} → A[0, T1]).

[0047] Then, the new alarm X4 defines a longer subsequence {X1, X2, X3, X4}, but there is no corresponding rule (for example, there are {X1, X2, X3}→A[0, T1], {X1, X2, X3, X5}→A[0, T2], but there is no rule for the sequence {X1, X2, X3, X4}).

[0048] After receiving X3, the prediction is {X1,X2,X3}→A[0,T1]

[0049] After receiving X4, the prediction is “no prediction alarm”, but the previous prediction is still valid ({X1, X2, X3}→A[0, T1]), and will be cancelled when T1 passes or A occurs before T1.

[0050] In some embodiments, in the case of timeline 203.1 or 203.2, the prediction is made based only on an initial portion of the input alarm sequence rather than the entire alarm sequence, so the probability assigned to the prediction is low, and the FMS 110 is configured to send instructions to the networked environment to perform a modification that is only a portion of the modification that the prediction with a higher probability would prompt. This can also be generally done more extensively when the predicted probability is below a predefined threshold, regardless of the reason for the low predicted probability. For example, if the high probability prediction of alarm A will trigger the switching of all protocol connections of the node to which alarm A will be involved, the low probability prediction of alarm A will only trigger the switching of a portion (such as half) of the protocol connections of the node. This represents a middle ground between saving the protocol connections and reducing the signaling load in the network environment, because the switching may require a large amount of signaling. In some embodiments, if the probability of the prediction increases later, the complete modification can be made, such as if more predicted alarm sequences are received, all protocol connections can be switched. In terms of timeline 203.1 or 203.2, this can mean that alarm X3 is received within the maximum time interval 210 of alarm X2.

[0051] In some embodiments, multiple time intervals for which predictions are generated overlap in that they start at the same time and end at different times. For example, the multiple time intervals may be (t0, T1), (t0, 2×T1), (t0, 3×T1), (t0, 4×T1), and (t0, 5×T1). Note that in this model t0, N×T1 represents the occurrence of A, and A is the same for all N as t0 (existence) moves on the time axis. Therefore, in these embodiments, the likelihood of an alarm occurring in an interval increases with the length of the time interval because the latter interval includes the previous interval. Typically, when predictions are generated for multiple time intervals separately, each time interval can be associated with a different machine learning classifier that is trained with different training data associated with the relevant time interval.

[0052] The human user may be presented with one or more forecasts made by the FMS 110 and the work orders and / or modification orders assigned to the forecast(s). The human user may then cancel the work orders and / or modification orders before they are implemented in or for the networked environment based on his judgment of the current situation.

[0053] During the training and inference phases, more than one set of alternative features can be used to define alarms. Alarms can be characterized by their features, such as the physical or virtual nodes involved in the alarm, the severity, a timestamp indicating when the alarm was generated, etc. In some systems, alarms can be quite complex data structures, including more than a dozen features. If all features are used for training, the full feature set is used, resulting in a detailed prediction system. On the other hand, if each alarm must match a large number of features to meet the conditions in the sequence, the matching alarm sequences in the input may be less common. Instead of a full feature set, a core feature set can be used, in which only one or a few features, such as node type and / or alarm severity, are used during the training and inference phases. The number of alarm cascades detected that match the alarm sequences in the training data is much higher, because as the criteria are relaxed, more alarms will meet the conditions. For a single predicted alarm of the core feature set precision, it can be the prediction result of more than one input alarm sequence represented at the core feature set resolution. In other words, an alarm can have more than one potential cause. Using the complete and core feature sets to represent the alarm sequence is equivalent to transforming the alarm signal sequence into an invariant part and a variable part, wherein the invariant part does not predict the time when at least one second alarm signal occurs, and the variable part predicts the time when at least one second alarm signal occurs. The following table describes the core feature sets of the two alarm sequences:

[0054]

[0055]

[0056] The table describes two patterns, pattern 1 and pattern 2. Pattern 1 is a sequence of six alarms of three different types, A1, A2 and A3, occurring at timestamps TS as shown in the table. In other words, pattern 1 includes the sequence {A1(TS1), A2(TS2), A3(TS3), A1(TS4), A1(TS5), A3(TS6)}. Alarm type A1 is of severe M level and lasts for 60 minutes. Alarm type A2 is of severe level and lasts for 30 minutes, and alarm type A3 is of critical C level and lasts for 120 minutes.

[0057] As shown in the table, mode 2 includes the sequence {A1(TS1), A2(TS2), A3(TS3), A1(TS4), A1(TS5), A3(TS6)}. Alarm types A1 and A3 are the same as in mode 1, although the durations in this mode are 40 minutes and 70 minutes respectively, and alarm type A5 has a severity level and a duration of 100 minutes. For example, the duration can be expressed and used with a precision of 10 minutes, so that a duration of 11 minutes matches a duration of 10 minutes.

[0058] Therefore, the core feature set of mode 1 (here only type and severity are included) is 1M, 2M, 3C, and the core feature set of mode 2 is 1M, 3C, 5C. The complete feature set of the mode is 1M_3_60, 2M_1_30, 3C_2_120, and the complete feature set of mode 2 is 1M_2_40, 3C_2_70, 5C_2_100. Specifically, the alarm sequence of mode 1 represented by the core feature set is {1M, 2M, 3C, 1M, 1M, 3C}. Correspondingly, the alarm sequence of mode 2 represented by the core feature set is {1M, 5C, 3C, 1M, 5C, 3C}. The alarm sequence of mode 1 represented by the complete feature set is {1M_3_60, 2M_1_30, 3C_2_120, 1M_3_60, 1M_3_60, 3C_2_120}. Correspondingly, the alarm sequence of mode 2 represented by the complete feature set is {1M_2_40,5C_2_100,3C_2_70,1M_2_40,5C_2_100,3C_2_70}.

[0059] Figure 2B FIG. 1 illustrates an alarm prediction according to at least some embodiments of the present invention. Time advances from left to right, T0 represents the current time, such as Figure 2A As shown. The alarm sequence {X1, X2, X3, X4, X5, X6} is used to predict alarm A and its related modification instructions and / or work instructions. For example, the sequence can correspond to the above-mentioned mode 1 or mode 2. For example, the sequence can be represented by a complete feature set or a core feature set. Figure 2B In the diagram, the last alarm is aligned with t0 on all time axes. This is because the causal relationship between the alarms of the first sequence {X1, X2, X3, X4, X5, X6} and A is related to the time measurement of the timestamps in the network. It is also possible that the alarms are received with a delay and there is a displacement in "our" time between the current time in "our" time and the alarm timestamp. In other words, there may be a delay between the receipt of an alarm and a prediction based at least in part on the alarm. To simplify the illustration, T0 is aligned with the latest alarm in the diagram.

[0060] In timeline 204, the entire sequence from X1 to X6 has been observed, so this sequence can be used in the predictor associated with time interval 204T to generate a prediction for alarm A during time interval 204T. Since a sequence of six alarms is used to predict A, a fairly high likelihood can be assigned to the prediction.

[0061] In timeline 205, the initial part of the sequence has been observed, from X1 to X5, so this sequence can be used in the predictor associated with time interval 205T to generate a prediction of alarm A during time interval 205T. Since a sequence of five alarms is used to predict A, a fairly high probability can be assigned to the prediction. However, the probability can be lower than for time interval 204T because only five alarms were detected, which is less input data than the six alarms in the case of time interval 204T. For the predictor of time interval 205T, the loopback period for collecting input data extends from the current time t0 to the moment before alarm X1.

[0062] In timeline 206, the initial part of the sequence has been observed, from X1 to X4, so this sequence can be used in the predictor associated with time interval 206T to generate a prediction of alarm A during time interval 206T. Since a sequence of four alarms is used to predict A, a medium likelihood can be assigned to the prediction. The likelihood can be lower than for time interval 205T because only four alarms were detected, which is a smaller amount of input data than the five alarms in the case of time interval 205T. For the predictor of time interval 206T, the loopback period for collecting input data extends from the current time t0 to the moment before alarm X1.

[0063] In timeline 207, the initial part of the sequence has been observed, from X1 to X3, so this sequence can be used in the predictor associated with time interval 207T to generate a prediction of alarm A during time interval 207T. Since a sequence of three alarms is used to predict A, a low likelihood can be assigned to the prediction. The likelihood can be lower than for time interval 206T because only three alarms were detected, which is a smaller amount of input data than the four alarms in the case of time interval 206T. For the predictor of time interval 207T, the loopback period for collecting input data extends from the current time t0 to the moment before alarm X1.

[0064] exist Figure 2BIn each time axis in , the time period from alarm X1 to predicted alarm A is constant. During time periods 204T, 205T, 206T, and 207T, a separate predictor is used to generate a prediction of alarm A. The separate predictors are trained separately using separate training data. In detail, when training the predictors for time intervals 205T, 206T, and 207T, only the initial part of the entire sequence {X1, X2, X3, X4, X5, X6} is used. The longer the time interval for generating predictions in the future, the shorter the loopback period for collecting input data, and the shorter the input sequence used in prediction and training. In other words, each predictor is configured to predict networked alarms that occur in specific different time periods in the future. The shorter the networked alarm sequence used in the optimization (i.e., training) of each predictor, the longer the specific different time periods of the corresponding predictor will be in the future.

[0065] When performing the actual prediction, the predictors may be used simultaneously. Thus, the sequence of arriving alerts increases its length over time until it is cut using a maximum time interval 210, and all trained predictors produce inferences based on the input. This provides benefits in terms of being able to predict a specific alert. For example, a given alert may have a higher predicted probability, such as 60%, over a 1-day time horizon, but may also have a predicted probability of, for example, 30% probability over a 2-day time horizon, with the remaining probabilities being distributed over the other 4 days. If only predictors prepared for predictions over a 1-day time horizon are used, up to 40% of valid predictions may be missed.

[0066] Figure 2C The training of individual predictors is illustrated. Figure 2C Four predictors are illustrated in FIG, although the principles of the disclosed technology are not limited to this numerical example. Each of the predictors P0, P1, P2, and P3 is configured to predict an alarm occurring at a specific time interval after training, such as Figure 2B As shown. For predictor P0, the time interval is in the near future and the entire sequence {X1,X2,X3,X4,X5,X6} is used for training. For predictor P1, the time interval is further out than in the case of predictor P0, and a subset of the entire sequence {X1,X2,X3,X4,X5} is used for training. For predictor P2, the time interval is further out than in the case of predictor P1, and a subset of the entire sequence {X1,X2,X3,X4} is used for training. For predictor P3, the time interval is further out than in the case of predictor P2, and a subset of the entire sequence {X1,X2,X3} is used for training. Therefore, the sequences used in training are abbreviated to illustrate that at certain time intervals in the future, the entire sequence will not have time to be observed. A single predictor can be trained with multiple appropriately abbreviated training sequences.

[0067] For training, the training sequence can be represented by the complete feature set or the core feature set. Typically, for alarm sequences with the same alarm, the core feature set can be the same, but in a different order. In other words, the core feature set can be independent of the order of the alarms in the sequence. This enhances the robustness of the prediction process. When the core feature set is used in training, the observed alarms can also be provided to the training predictor represented by the core feature set. In addition to the features of the core feature set, the complete feature set can also include, for example, the number of alarm activations, the duration, and / or the order of the alarms in the sequence.

[0068] In some embodiments, a specific classifier is trained for each subsequence, each subsequence constituting a different complete set of features with total activation and total duration.

[0069] In one embodiment, the complete feature set of the alarm is used as the feature set for training the predictor and also as the feature set for inference; the reasons will be explained below. Initially, an alarm sequence is searched in the training data that can be used to predict a specific alarm A within a specific time interval. After the alarm sequence is found, it is selected for use in the inference phase to predict that alarm A will occur shortly after the last alarm in the alarm sequence. The sequence is then used in the inference phase, and it can be found that alarm A in the inference phase will only occur later, such as halfway through the entire time space for prediction, rather than shortly after the last alarm in the sequence as in the training data. This means that the alarm sequence can be suitable for predicting alarm A for a long time in the future. In order to optimize the predictor, alarm sequences using the same core feature set but with different complete feature sets can be evaluated. For example, for this purpose, the core feature set can include only the alarm type, and the complete feature set can include the alarm type, alarm duration, and alarm count. Then, a suitable alarm sequence can be selected for predicting alarm A in the later inference phase. Often, the alarm patterns can also be statistically analyzed based on causal chains to establish features suitable for predicting patterns of alarm occurrences at different time intervals in the future. Thus, the training data can be optimized, which avoids the problem of a machine learning classifier training itself to irrelevant aspects of the original training data.

[0070] Figure 3 An example apparatus capable of supporting at least some embodiments of the present invention is illustrated. Illustrated is a device 300, which may include, for example Figure 1The FMS 110 of the device 300. The device 300 includes a processor 310, which may include, for example, a single-core or multi-core processor, wherein the single-core processor includes one processing core and the multi-core processor includes more than one processing core. The processor 310 may generally include a control device. The processor 310 may include more than one processor. The processor 310 may be a control device. For example, the processing core may include, for example, a Cortex-A8 processing core manufactured by ARM Holdings or a Zen processing core designed by Advanced Micro Devices Corporation. The processor 310 may include at least one Intel Xeon or AMD Opteron processor. The processor 310 may include at least one application-specific integrated circuit ASIC. The processor 310 may include at least one field programmable gate array FPGA. The processor 310 may be a component for executing method steps in the device 300, such as storage, processing, prediction, triggering, transformation, and execution. The processor 310 may be configured at least in part by computer instructions to perform actions.

[0071] The processor may include a circuit system, or be constructed as one or more circuit systems, which are configured to perform the various stages of the method according to the embodiments described herein. As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) a pure hardware circuit implementation, such as an implementation in analog and / or digital circuit systems only, and (b) a combination of hardware circuits and software, such as, where applicable: (i) a combination of (multiple) analog and / or digital hardware circuits with software / firmware, and (ii) any portion of (multiple) hardware processors with software (including (multiple) digital signal processors), software and (multiple) memories, which work together to enable devices such as fault management systems to perform various functions), and (c) (multiple) hardware circuits and / or (multiple) processors, such as (multiple) microprocessors or (multiple) microprocessor parts, which require software (e.g., firmware) to operate, but when software is not required for operation, the software may not be present.

[0072] This definition of circuitry applies to all uses of the term in this application, including in any claims. As another example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its accompanying software and / or firmware. For example, if applicable to a particular claim element, the term circuitry also covers a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0073] Device 300 may include memory 320. Memory 320 may include random access memory and / or permanent memory. Memory 320 may include at least one RAM chip. Memory 320 may include, for example, solid-state, magnetic, optical and / or holographic memory. Memory 320 may be at least partially accessible by processor 310. Memory 320 may be at least partially included in processor 310. Memory 320 may be a component for storing information. Memory 320 may include computer instructions that processor 310 is configured to execute. When computer instructions configured to cause processor 310 to perform certain actions are stored in memory 320, and device 300 as a whole is configured to run under the guidance of processor 310 using computer instructions from memory 320, processor 310 and / or at least one of its processing cores may be considered to be configured to perform certain actions described above. Memory 320 may be at least partially included in processor 310. Memory 320 may be at least partially located outside device 300, but device 300 may access the memory.

[0074] Device 300 may include a transmitter 330. Device 300 may include a receiver 340. Transmitter 330 and receiver 340 may be configured to send and receive information, respectively, according to a communication protocol. Transmitter 330 may include more than one transmitter. Receiver 340 may include more than one receiver. Transmitter 330 and / or receiver 340 may be configured to operate according to a suitable communication standard.

[0075] The device 300 may include a user interface UI 360. The UI 360 may include at least one of a display, a keyboard, a touch screen, a vibrator arranged to signal a user by vibrating the device 300, a speaker, and a microphone. The user may be able to operate the device 300 via the UI 360, for example, to configure alarm prediction parameter training.

[0076] The processor 310 may be equipped with a transmitter that is arranged to output information from the processor 310 to other devices included in the device 300 via electrical conductors inside the device 300. Such a transmitter may include a serial bus transmitter that is arranged to output information to the memory 320 for storage therein, for example, via at least one electrical conductor. As an alternative to the serial bus, the transmitter may include a parallel bus transmitter. Similarly, the processor 310 may include a receiver that is arranged to receive information in the processor 310 from other devices included in the device 300 via electrical conductors inside the device 300. Such a receiver may include a serial bus receiver that is arranged to receive information from the receiver 340, for example, via at least one electrical conductor, for processing in the processor 310. As an alternative to the serial bus, the receiver may include a parallel bus receiver.

[0077] Device 300 may include a fingerprint sensor arranged to at least partially authenticate a user of device 300. In some embodiments, device 300 lacks at least one of the above devices.

[0078] The processor 310, the memory 320, the transmitter 330, the receiver 340 and / or the UI 360 may be interconnected in a variety of different ways via electrical conductors within the device 300. For example, each of the above devices may be individually connected to a main bus within the device 300 to allow the devices to exchange information. However, those skilled in the art will appreciate that this is just an example, and that various ways of interconnecting at least two of the above devices may be selected according to the embodiment without departing from the scope of the present invention.

[0079] Figure 4 is a flow chart according to at least some embodiments of the present invention. The diagram illustrates the time slicing and pattern creation phases.

[0080] Alarm aggregation can be performed in two dimensions: in space, alarms occur in the same network element and / or topologically connected network elements; in time, a maximum time interval 210 is used.

[0081] Initially, in stage 410, a general loopback period is defined. The loopback period refers to the maximum time difference between the occurrence of the first alarm and the subsequent predicted alarm in an alarm sequence that can be used to predict the subsequent alarm. In essence, the loopback period constitutes the dimension of the time range of the machine learning based alarm prediction system.

[0082] In stage 420, alarm sequences are created to form alarm aggregates. Alarm grouping for this purpose can be based on spatial and temporal relationships between alarms so as to identify potential causal chains with the alarm to be predicted as the last alarm from a temporal perspective. Grouping at this stage can be done at the intra-node level for alarms that affect the same equipment components, or at the inter-node level for alarms of equipment with known topological or functional relationships in the time domain, such as alarm A, which is to be predicted and provide work instructions or modification instructions. That is, alarm A marked with work instructions and / or modification instructions is identified within a defined spatial range, and alarms within the same spatial range that occurred before alarm A are collected until the first alarm is separated from its adjacent alarms by more than 100%. Figure 2A This provides an alarm sequence: X1(TS0), X2(TS1), ... Xn(TS), A(TS*), where the alarm inter-arrival time (the difference between the timestamps TS of adjacent alarms) is less than Figure 2AThe maximum value of the difference TS*-TS0 of the alarms in the training data is the loopback period LP. In the first sequence definition stage, the general loopback period GPL can be used.

[0083] In stage 430, time slicing is performed. This refers to creating multiple time intervals for which separate predictions are to be generated using corresponding separate machine learning based predictors to be trained using the training data. Stage 430 takes input from stages 420 and 450.

[0084] In stage 440, taking input from stage 420, basic statistics defining the subsequences are calculated; for example, the distribution of the lengths of causal alert chains. This is useful because it allows to determine what is the maximum time horizon for the forecast; for example, if the maximum length of the chain is 7 days, then it is clear that no meaningful forecast beyond 7 days can be provided; this defines the maximum forecast time horizon. Furthermore, observing the distribution allows to determine the time slice / time discretization step size to be used for the "blind period".

[0085] In stage 450, the blind period step size is obtained. The blind period step size is another term for the quantization step size in the process. BLIND_PERIOD[i]:i*QUANTIZATION_STEP, where i is in the range [0,M]. The quantization step size refers to the length of the time interval into which the "maximum prediction time range" is subdivided. Within a given blind period, the alarm sequence considered can be in the range [T0-LP, T0-BLIND_PERIOD] (from the past to the future). BLIND_PERIOD[i] is defined for each of the M prediction problems, i.e., the period during which the corresponding alarm sequence has not yet arrived. For example, in Figure 2A In the time axis 203.1, the alarms X3 and X4 are in the blind period relative to the time interval 2G. Observing the distribution and the maximum prediction time range, time slicing / time discretization steps can be performed for the blind period and the calculated blind period and interval are provided to the stage 430 performing time slicing or discretization.

[0086] In phase 460, new alarm sequences with different blinding periods are created. For each different predictor for the corresponding time interval that generates a separate prediction, a suitably truncated version of the alarm sequence {X1, X2, X3, X4} is generated, taking into account that when the time interval is in the future, not all alarms in the sequence have time to occur.

[0087] Statistics on subsequence lengths can be used in inference mode so that each classifier associated with a given blind period bounds the input sequence received in online mode, using statistics (e.g., median or third quartile) calculated after time / slice discretization of the full sequence as the maximum loopback and using the maximum time interval 210 as the cutoff criterion. These statistics are calculated in block 460.

[0088] The system can be configured to define a maximum prediction time range. The user can configure a prediction time range that is different from the maximum prediction time range. If the configured prediction time range is longer than the maximum prediction time range, the prediction performance may be hampered because the system will predict many false positives, as there is no causal relationship, and therefore no prediction for alarms that occur between the maximum prediction time range and the configured prediction time range.

[0089] The system can be configured to calculate the best forecast horizon that optimizes forecast performance. In the following, we assume that the initial forecast horizon is equal to or less than the maximum forecast horizon, and in this example, we assume that they are equal. A system with a maximum forecast horizon of 10 days can have 10 predictors, each with its own blinding period.

[0090] In the following, the following definitions apply: Prediction performance, where different metrics can be used. A non-limiting example is the F1 score between precision and recall. Cumulative pattern distribution is the accumulation of pattern length distributions. Two methods are now introduced:

[0091] First, method 1: select a percentile of the cumulative pattern distribution, such as the 75th percentile, and the pattern length corresponding to the 75th percentile becomes the optimal prediction time range.

[0092] Next, method 2: calculate the performance of applying only the first blind period, i.e., only using predictor 1 to obtain predictor 1 performance. Then calculate the performance of applying the first blind period, and the second blind period, i.e., using predictor 1 and predictor 2, and obtain predictor 1 performance and predictor 2 performance, and so on, until all predictors are characterized. Then, in the correspondence of calculating a step size in the blind period, find the best maximum blind period. For example, the maximum blind period can be 6 days; this means that only predictors 1 to 6 are used for the best performance and the best prediction time range is 6 days.

[0093] These algorithms work because adding more predictors increases the amount of predictions, thereby improving recall; at the same time, as the blind period increases, the prediction horizon increases and the length of the considered alarm subsequences decreases, thereby increasing the number of false alarms, so the best performance is obtained at some point in time between the zero blind period and the maximum feasible blind period.

[0094] To summarize, the whole process can be divided into the following stages. First, a preliminary analysis is performed to define a "general loop period" called GLP to define the alarm sequence of interest from the alarm input stream. Secondly, each sequence is read and the cutoff time is determined by the maximum time interval 210. Thus, the longest alarm sequence length is determined as the maximum chain length. Third, basic statistics of the defined subsequences can be calculated; for example, the length distribution of the alarm sequence. This is useful because it allows to determine which is the maximum time range for prediction; for example, if the maximum chain length of the sequence is 7 days, it is obvious that no valuable predictions beyond 7 days can be provided; this defines the maximum prediction time range. In addition, the observation distribution and the maximum prediction time range can determine the time slice / time discretization step to be used for the blind period.

[0095] Fourth, the observed alarm sequence can be used to start a time slicing / discretization process that discretizes the sequence, which can apply a maximum chain length starting from the complete sequence ending with the predicted alarm A, and gradually eliminate alarms starting from A in the backward direction according to the discretization step size (also called "blind period") until the maximum prediction time range. Fifth, for each blind period, statistics of the subsequence lengths can be calculated as, for example, mean, median, quartiles. Sixth, for each subsequence corresponding to a specific blind period, a complete feature set is obtained. Each classifier corresponding to a given "blind period" can be trained by the complete summary of the subsequence obtained by the discretization process in the same blind period step size.

[0096] Statistics on subsequence lengths can be used in inference mode so that each classifier associated with a given blind period accepts an input sequence received in online mode, using statistics (e.g., median or third quartile) calculated after time / slice discretization of the full sequence as maximum loopback and using the maximum time interval 210 as cutoff criterion. This maximum loopback is a characteristic of each blind period of each predictor calculated by block 460.

[0097] Figure 5 is a flow chart of a method according to at least some embodiments of the present invention. For example, the stages of the method shown may be performed in the FMS 110, or when installed in the FMS, in a control device configured to control the functions of the FMS.

[0098] Stage 510 includes storing a set of parameters of a machine learning classifier configured to predict a networked alarm, the set of parameters including at least at least one maximum time interval. Stage 520 includes processing a first sequence of alarm signals originating from a networked environment, consecutive alarms being included in the first sequence of alarm signals occurring at the most time intervals, the most time intervals being included in the at least one maximum time interval between each other. Finally, stage 530 includes using the set of parameters of the machine learning classifier, and the machine learning classifier itself, to predict at least one second alarm signal to occur during the first time interval based on the first sequence of alarm signals.

[0099] It should be understood that the disclosed embodiments of the present invention are not limited to the specific structures, process steps or materials disclosed herein, but can be extended to equivalents that will be recognized by those skilled in the relevant art. It should also be understood that the terms used herein are only used to describe specific embodiments and are not intended to be limiting.

[0100] Reference to an embodiment or embodiments in this specification indicates that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in at least one embodiment of the invention. Thus, the phrases "in one embodiment" or "in an embodiment" appearing in various places in this specification do not necessarily all refer to the same embodiment. When terms such as approximately or substantially are used to reference values, the exact values ​​are also disclosed.

[0101] As used herein, for convenience, multiple items, structural elements, constituent elements and / or materials can be presented in a common list. However, these lists should be interpreted as each member in the list is individually identified as a separate and unique member. Therefore, any individual member in such a list should not be interpreted as the de facto equivalent of any other member in the same list only according to its presentation in a common group (without contrary indication). In addition, various embodiments and examples of the present invention and alternatives to its various components can be referenced herein. It should be understood that these embodiments, examples and alternatives should not be interpreted as de facto equivalents to each other, but should be regarded as separate and autonomous representations of the present invention.

[0102] In addition, the described features, structures or characteristics can be combined in any suitable manner in one or more embodiments. In the foregoing description, many specific details, such as examples of length, width, shape, etc., are provided to provide a thorough understanding of embodiments of the present invention. However, those skilled in the relevant art will recognize that the present invention can be practiced without one or more specific details, or practiced using other methods, components, materials, etc. In other cases, in order to avoid obscuring aspects of the present invention, well-known structures, materials or operations are not shown or described in detail.

[0103] Although the above examples illustrate the principles of the present invention in one or more specific applications, it will be apparent to those skilled in the art that many modifications may be made to the form, usage and details of implementation without departing from the principles and concepts of the present invention without exercising creative ability. Therefore, the present invention is limited only by the following claims.

[0104] In this document, the verbs "to comprise" and "to include" are used as open limitations, neither excluding nor requiring the presence of unrecited features. Unless explicitly stated otherwise, the features recited in the dependent claims may be freely combined with each other. Furthermore, it should be understood that the use of "a" or "an" (i.e., the singular) in this document does not exclude a plurality.

[0105] Industrial Applicability

[0106] At least some embodiments of the present invention have industrial applications in managing networked environments, such as communications networks.

[0107] List of abbreviations

[0108] AMF: access and mobility management functions, access and mobility management functions

[0109] CAR: classifier based on associative rules, classifier based on association rules LP: loopback period, loopback period

[0110] LTE: long term evolution

[0111] MME: mobility management entity

[0112] SGSN: serving general packet radio service support nodes, serving general packet radio service support nodes

[0113] TS: time stamp

[0114] VNF: virtualized network function

[0115] WiMAX: worldwide interoperability for microwave access, global interoperability for microwave access

[0116] WCDMA: wideband code division multiple access WLAN: wireless local area network

[0117] Reference numerals list

[0118]

Claims

1. An apparatus comprising at least one processing core, at least one memory, the at least one memory comprising computer program code, the at least one memory and the computer program code being configured to, together with the at least one processing core, enable the apparatus to at least: - storing a set of parameters of a machine learning classifier configured to predict a networked alarm, the set of parameters comprising at least one maximum time interval; - processing a first sequence of alarm signals originating from a networked environment, consecutive alarms being contained in said first sequence of alarm signals occurring at a maximum time interval, said maximum time interval being contained in said at least one maximum time interval between each other, and - using the set of parameters of the machine learning classifier and the machine learning classifier, predicting at least one second alarm signal to occur during a first time interval based on the first sequence of alarm signals.

2. The apparatus according to claim 1, wherein the at least one memory and the computer program code are configured to, together with the at least one processing core, cause the apparatus to: predicting, based on a subset of the first sequence of alarm signals, the at least one second alarm signal occurring during a second time interval, the second time interval starting later than the first time interval, The device is configured to: The prediction is performed based on the subset of the first alarm sequence at a time when a total duration of the first alarm sequence starting from a first alarm in the first alarm sequence has not elapsed.

3. The apparatus according to claim 2, wherein the last alarm of each first subsequence has a different distance in time from the at least one second alarm signal predicted to occur during the second time interval, and The apparatus is configured to train a different predictor using each subsequence, wherein the apparatus is configured to use each trained predictor to predict the same at least one second alarm signal to occur during a second time interval.

4. The apparatus according to any one of claims 1 to 3, wherein the at least one memory and the computer program code are configured to, together with the at least one processing core, cause the apparatus to: triggering an action in response to predicting the at least one second alarm, wherein the triggered action comprises: The modification in the networking environment prevents the occurrence of the at least one second alarm, or the transmission of a work order to remedy the cause of the at least one second alarm signal.

5. The apparatus of claim 4, wherein the at least one memory and the computer program code are configured, together with the at least one processing core, to cause the apparatus to: automatically trigger the action without intervention by a human operator.

6. The apparatus according to any one of claims 1 to 5, wherein the machine learning classifier comprises: Classifier based on association rules.

7. An apparatus according to any one of claims 1 to 6, wherein the at least one memory and the computer program code are configured to, together with the at least one processing core, enable the apparatus to: update at least a portion of the parameters of a machine learning classifier based on a pattern in an alarm signal received in the apparatus.

8. An apparatus according to any one of claims 1 to 7, wherein the at least one memory and the computer program code are configured to, together with the at least one processing core, enable the apparatus to: transform the first alarm signal sequence into: an unchanging part that is not a predicted moment of occurrence of the at least one second alarm signal, and a changing part that is a predicted moment of occurrence of the at least one second alarm signal.

9. An apparatus according to any one of claims 1 to 8, wherein the at least one memory and the computer program code are configured to, together with the at least one processing core, enable the apparatus to: perform the prediction of the at least one second alarm signal, so that the apparatus generates a separate prediction for each future time interval of a plurality of future time intervals related to the occurrence of the at least one second alarm signal.

10. An apparatus according to claim 9, wherein the at least one memory and the computer program code are configured to, together with the at least one processing core, cause the apparatus to: assign to each of the individual predictions an individual likelihood of the predicted at least one second alarm signal occurring during the corresponding future time interval.

11. The apparatus according to claim 9 or 10, wherein each future time interval of the plurality of future time intervals ends at the same time instant, but each future time interval of the future time intervals starts at a different time instant.

12. The apparatus according to any one of claims 1 to 11, wherein the networked environment is a communication network.

13. The apparatus of any one of claims 1 to 12, wherein the networked environment is an aircraft.

14. A method comprising: - storing in the device a set of parameters of a machine learning classifier configured to predict a networked alarm, the set of parameters comprising at least one maximum time interval; - processing a first sequence of alarm signals originating from a networked environment, consecutive alarms being contained in said first sequence of alarm signals occurring at a maximum time interval, said maximum time interval being contained in said at least one maximum time interval, and - using the set of parameters of the machine learning classifier and the machine learning classifier, predicting at least one second alarm signal to occur during a first time interval based on the first sequence of alarm signals.

15. The method according to claim 14, further comprising: Based on a subset of the first alarm signal sequence, predicting the at least one second alarm signal to occur during a second time interval, the second time interval starting later than the first time interval, the device being configured to: perform the prediction based on the subset of the first alarm sequence at a moment starting from the first alarm in the first alarm sequence and before the total duration of the first alarm sequence has passed.

16. The method according to any one of claims 14 to 15, further comprising: An action is triggered in response to predicting the at least one second alarm, wherein the triggered action includes modification of the networking environment to prevent the at least one second alarm from occurring, or transmission of a work order to repair a cause of the at least one second alarm signal.

17. The method according to claim 16, further comprising: The device is enabled to automatically trigger the action without intervention by a human operator.

18. The method of any one of claims 14 to 17, wherein the machine learning classifier comprises: Classifier based on association rules.

19. The method according to any one of claims 14 to 18, further comprising: At least a portion of the parameters of the machine learning classifier are updated based on patterns in the alarm signal received in the device.

20. The method according to any one of claims 14 to 19, further comprising: The first alarm signal sequence is transformed into: a constant part which is not the predicted time instant of occurrence of the at least one second alarm signal, and a variable part which is the predicted time instant of occurrence of the at least one second alarm signal.

21. The method according to any one of claims 14 to 20, further comprising: The prediction of the at least one second alert signal is performed such that the apparatus generates a separate prediction for each future time interval of a plurality of future time intervals related to the occurrence of the at least one second alert signal.

22. The method according to claim 21, wherein an individual likelihood of the predicted at least one second warning signal occurring during the respective future time interval is assigned to each of the individual predictions.

23. The method of claim 21 or 22, wherein each future time interval of the plurality of future time intervals ends at the same time instant, but each future time interval of the future time intervals starts at a different time instant.

24. The method according to any one of claims 14 to 23, wherein the networked environment is a communication network.

25. The method of any one of claims 14 to 24, wherein the networked environment is an aircraft.

26. A non-transitory computer readable medium having stored thereon a set of computer readable instructions which, when executed by at least one processor, cause an apparatus to at least: - optimizing a set of parameters of a machine learning classifier configured to predict networked alarms, the set of parameters comprising at least one maximum time interval; -Providing a plurality of network alarm sequences as training data for the optimization of the parameter set of the machine learning classifier, wherein the plurality of network alarm sequences do not all have equal lengths, and consecutive alarms are included in the network alarm signal sequence that occurs at the most time intervals, and the most time intervals are included in at least one maximum time interval between each other.

27. The non-transitory computer readable medium of claim 26, wherein the machine learning classifier comprises: Classifier based on association rules.

28. A non-transitory computer-readable medium according to claim 26 or 27, wherein the parameter set of the machine learning classifier includes parameters for multiple predictors, each of the predictors is configured to: predict the network alarm to occur during a specific different time period in the future, wherein the shorter the network alarm sequence used in the optimization of each predictor in the predictors, the longer the specific different time period of the corresponding predictor in the future.

29. An apparatus comprising components for: - storing a set of parameters of a machine learning classifier configured to predict a networked alarm, the set of parameters comprising at least one maximum time interval; - processing a first sequence of alarm signals originating from a networked environment, consecutive alarms being contained in said first sequence of alarm signals occurring at a maximum time interval, said maximum time interval being contained in said at least one maximum time interval between each other, and - using the set of parameters of the machine learning classifier and the machine learning classifier, predicting at least one second alarm signal to occur during a first time interval based on the first sequence of alarm signals.

30. A non-transitory computer readable medium having stored thereon a set of computer readable instructions which, when executed by at least one processor, cause an apparatus to at least: - storing a set of parameters of a machine learning classifier configured to predict networked alarms, the set of parameters comprising at least one maximum time interval; - processing a first sequence of alarm signals originating from a networked environment, consecutive alarms being contained in said first sequence of alarm signals occurring at a maximum time interval, said maximum time interval being contained in said at least one maximum time interval between each other, and - using the set of parameters of the machine learning classifier and the machine learning classifier, predicting at least one second alarm signal to occur during a first time interval based on the first sequence of alarm signals.

31. A computer program configured to, when executed, cause an apparatus to at least perform the following: - storing a set of parameters of a machine learning classifier configured to predict networked alarms, the set of parameters comprising at least one maximum time interval; - processing a first sequence of alarm signals originating from a networked environment, consecutive alarms being contained in said first sequence of alarm signals occurring at a maximum time interval, said maximum time interval being contained in said at least one maximum time interval between each other, and - using the set of parameters of the machine learning classifier and the machine learning classifier, predicting at least one second alarm signal to occur during a first time interval based on the first sequence of alarm signals.

Images