System and Method for Detecting Abnormal Conditions Based on Weekly Behavior of Cells

Abstract

The invention relates to an anomaly detection system and method that enables the creation of a reference behavior specific to each cell by organizing traffic and performance data of base station cells in mobile communication networks according to the same days and time periods of the past weeks, comparing current data with this reference behavior, separating short-term fluctuations from deviations that persist for a certain period, identifying persistent deviations as anomalies even if fixed threshold values ​​are not exceeded, and communicating the detected anomalies to the user.

Description

1 TARIFF System and Method for Detecting Abnormal Conditions Based on Weekly Behavior of Cells TECHNICAL AREA 5 The invention involves a system and method for detecting abnormal conditions based on the weekly behavior of cells. It is related. The invention relates to traffic and activity of base station cells, particularly in mobile communication networks. The change in performance data over time, the historical behavior of each cell Based on this, evaluation and identification of situations that deviate from usual behavior. It is related to. PREVIOUS TECHNIQUE 15 Cell-based performance monitoring in mobile communication networks provides information about the operational status of the network. This is an important process for monitoring and ensuring the sustainability of service quality. In this monitoring... Traffic and performance indicators of base station cells are monitored regularly. The cell's operational status is evaluated based on the obtained values. The current 20 In applications, this evaluation is mostly based on instantaneous measurement values ​​or pre-determined values. It is based on defined fixed threshold values ​​and is a traffic or performance indicator. An alarm is generated when the set limit is exceeded. In the fixed threshold approach, the cell is considered to be operating normally as long as the relevant indicator does not exceed the limit value. This is acceptable. However, each base station cell is located in a region, and the user Due to its intensity and usage habits, it has its own unique operating system. The same numerical value can have different meanings in different cells, depending on the cell's context. a behavior that deviates significantly from its usual behavior but remains within a fixed threshold The change may not be perceived as an abnormality in existing systems. The cells themselves 30 Ignoring normal behavior, especially if it hasn't yet exceeded fixed alarm thresholds visibility of early-stage performance impairments that have not yet reached a certain level It can reduce it. Therefore, evaluating only the absolute value does not reflect the cell's past. the relative change between the behavior it exhibited under the same conditions of use and its current behavior This can lead to it being overlooked. In such a case, the network operator is technically 35 a situation that is unusual but considered normal in classic threshold control was noticed late is able to. 2 Another problem with current cell performance monitoring approaches is short-term traffic. fluctuations that truly create a problem and changes that continue for a certain period of time The problem is that they cannot always be reliably distinguished from each other. Temporary traffic. Considering the fluctuation as a direct cause of alarm leads to unnecessary alarm intensity. 5 It can increase, but conversely, it exhibits continuity but remains within fixed threshold limits. Missing the malfunction can lead to a real problem being detected late. Another shortcoming of current approaches is the lack of time-based comparison of historical data. When not done in sufficient detail, these 10 cell behaviors recur at specific days and times. Deviations from behavior cannot be systematically evaluated. However, the user density and traffic profile depend on the days of the week and time of day. It can change. Failure to take this time context into account results in variations from normal periodic change. This can lead to confusion between periodic performance degradation and past events. The failure to correlate the same days and time periods in previous weeks with current values ​​is particularly concerning for 15 weeks. This makes it difficult to detect periodic or slowly developing problems in the early stages. When changes in cell behavior are evaluated by looking at a single instantaneous value, repetitive However, disturbances that consistently remain below the classic alarm threshold are detected for a long time. It may not be possible to intervene, and intervention may only occur after the problem becomes apparent. It can be accomplished. 20 The shortcomings mentioned above are due to the fact that cells refer to their own past mode of operation. short-term analysis that compares weekly historical data with current data in terms of day and time. It can distinguish fluctuations from continuous changes and ensure that fixed threshold values ​​are not exceeded. a more sensitive anomaly that can identify significant deviations from normal behavior 25 This necessitates a diagnostic approach. As a result of research conducted in the literature, the anomaly numbered US20200084087A1, “Intelligent anomaly detection and root cause analysis in mobile networks (Intelligent Anomaly Detection in Mobile Networks) A patent document titled "Root Cause Analysis)" was found. This document is dated 30 Cell or base station data from RAN and KPI data received from mobile networks and base stations Establishing a station-specific normal behavior model and applying this normal model to current data. It is related to identifying deviations from behavior as anomalies. However, the aforementioned in the document, by matching the same days and time zones from previous weeks on a cell-by-cell basis. Establishing a reference behavior and short-term fluctuations continuing for a certain period of time. 35 a specific weekly time comparison stream in the form of separating it from deviations No evidence was found. 3 As a result of research conducted in the literature, the method numbered EP1638253A1, “Method of monitoring Patent titled "Wireless Network Performance (Method of Monitoring Wireless Network Performance)" A document was found. This document describes the expected performance profile of a cell. learning about the discrepancies between actual cell performance and expected performance 5 monitoring and determining whether the identified deviation indicates a malfunction. It is related to the evaluation. However, the document mentioned contains the past weeks' data for the cell. By establishing reference behavior from the same day and time zones, short-term fluctuations can be avoided. a specific process chain in the form of being separated from ongoing changes No evidence was found. 10 Ultimately, the problems mentioned above, which cannot be solved with current technology, are the subject of this technical analysis. This has made it necessary to make an innovation in the field. BRIEF DESCRIPTION OF THE INVENTION 15 The invention aims to eliminate the aforementioned disadvantages and create a new field in the relevant technical area. An anomaly detection system based on the weekly behavior of cells to bring advantages. and is related to the method. The main purpose of the invention is to enable each base station cell to operate according to its own past operational pattern. The aim is to ensure its evaluation. Another purpose of the invention is to analyze data from the same days and times in previous weeks. The goal is to enable the creation of cell-specific reference behavior using 25. Another purpose of the invention is to display current traffic and performance data in relation to the relevant time period. deviations from usual behavior by comparing past reference behavior. to determine. Another aim of the invention is to enable the cell to maintain its own reference values ​​even when fixed threshold values ​​are not exceeded. The aim is to enable the detection of unusual situations that deviate from normal behavior. Another purpose of the invention is to address short-term traffic fluctuations that persist for a specific period of time. The goal is to reduce unnecessary alarm density by isolating the changes from each other. 35 4 Another purpose of the invention is to address recurring or slowly developing phenomena over specific time periods. The goal is to enable earlier detection of performance degradations. Another purpose of the invention is to provide an alarm and monitoring interface for detected abnormal situations. The aim is to ensure that the information is communicated to the user and that the necessary intervention is supported. 5 Another objective of the invention is to provide an additional module to existing network monitoring and management systems. The aim is to ensure that it can be implemented as such. It is an abnormality detection system based on the weekly behavior of cells, and its characteristic is; 10  Traffic and performance data that provides cell-based traffic and performance data. source,  Processes cell-based data received from traffic and performance data sources, and The mentioned data can be organized according to different time periods for analysis. The data collection and preprocessing unit that makes it work, 15  Base station cell to which traffic and performance data belongs,  A network that transmits data obtained from a base station cell via data communication. transmission infrastructure  network transmission infrastructure via software running on an electronic device From the cell-based data obtained, for each cell, the same day of the previous weeks (20) and establishes reference behavior using data corresponding to time zones, short-term analysis that compares current data with reference behavior for a specific time period. It separates fluctuations from changes that continue over a certain period of time and a specific Behavioral analysis that identifies persistent deviations as abnormal. comparison unit, 25  determined as the analysis output by the behavioral analysis and comparison unit Alarm and monitoring interface that presents abnormal status data to the user. It includes. The structure of the invention and the best understanding of its advantages, including additional elements, are 30. This should be evaluated together with the figures explained below. BRIEF DESCRIPTION OF THE FIGURES Figure 1 shows the abnormal condition identified in 35 cell-based traffic and performance data acquisition. It is a representative illustration of the data transmission and analysis flow until it is delivered to the user. Figure 2 shows the workflow of the anomaly detection method based on the weekly behavior of the cells. It is a representative flowchart illustrating this. The drawings do not necessarily need to be scaled and are necessary for understanding the invention. Details that are not present may have been overlooked. Furthermore, at least significantly 5 Identical elements or elements with similar functions are numbered the same way. It is shown. REFERENCE NUMBERS 1. Traffic and performance data source 2. Data collection and preprocessing unit 3. Base station cell 4. Network transmission infrastructure 5. Behavioral analysis and comparison unit 15 6. Alarm and monitoring interface 1001. Data from a traffic and performance data source: cell-based traffic and performance data. transfer to collection and preprocessing unit 1002. Data collection and preprocessing unit collects 20 cell-based data from different time periods. organizing the data to make it suitable for analysis 1003. Behavior of data obtained from a base station cell via network transmission infrastructure. forwarding to the analysis and comparison unit 1004. Behavioral analysis and comparison unit analyzes the cell's data from previous weeks. Creating reference behavior using data from different days and time zones 25 1005. Behavioral analysis and comparison unit by current data to the relevant time period. Deviations are identified by comparing them to the corresponding reference behavior. 1006. Behavioral analysis and comparison unit with specific short-term fluctuations. the separation of changes that continue for a period of time and deviations that continue for a certain period 30 considered an abnormal situation 1007. Detected abnormal situations are reported to the user via the alarm and monitoring interface. transmission DETAILED DESCRIPTION OF THE INVENTION 35 6 This detailed explanation describes abnormal behavior based on the weekly behavior of the cells that are the subject of the invention. The situation assessment system and method are solely aimed at a better understanding of the issue, but not at anything else. This is explained with examples that will not create a limiting effect. Within the scope of the invention, traffic and performance data source (1), cell-based traffic and performance 5 data source from which data is obtained; data collection and preprocessing unit (2), traffic and by organizing the data from different time periods that it receives from the performance data source (1) The unit that makes it suitable for analysis; base station cell (3), traffic and performance data Analysis of data relating to the monitored cell; network transmission infrastructure (4), base station cell (3) communication infrastructure that enables transmission to the side; behavioral analysis and comparison unit (5), 10 Cell data from previous weeks was obtained through software running on an electronic device. deriving reference behavior from data, comparing current data with that reference behavior. comparing, differentiating between short-term fluctuations and changes that continue over a specific period, and A unit that identifies persistent deviations as abnormal; alarm and monitoring. The interface (6) detects abnormal 15 by the behavior analysis and comparison unit (5). It refers to the interface that communicates the status to the user and allows for system monitoring. is doing. The invention's operating principle involves cell-based traffic and performance data, traffic and performance. data is transferred from the data source (1) to the data collection and preprocessing unit (2) and at different times 20 It is arranged according to its slices. Obtained from the base station cell (3) data through network transmission infrastructure (4) to the behavior analysis and comparison unit (5) is transmitted. The behavioral analysis and comparison unit (5) in question, past for each cell Using data corresponding to the same days and times in the weeks, the cell's usual It establishes the reference behavior representing the work pattern. Current traffic and performance 25 The data is compared with the reference behavior corresponding to the relevant day and time period, and Deviations from the expected behavior are identified. During the evaluation, the behavioral analysis and comparison unit (5), short-term traffic It distinguishes fluctuations from changes that continue for a specific period. Short-term 30 Fluctuations are not taken into account in the assessment of abnormal situations, while continuous fluctuations are observed. Deviations are identified as abnormal conditions. Thus, current traffic or performance Even if the indicator does not exceed a predefined fixed threshold value, the base station The cell (3) was found to deviate unusually from its own past reference behavior. This approach reduces unnecessary alarm intensity while addressing early-stage issues, 35 contributing to making periodic or gradually developing performance deteriorations more visible. It provides. 7 Detected abnormal situations are communicated to the user via the alarm and monitoring interface (6), This supports network monitoring and necessary interventions. The system, as an additional module within operators' existing network monitoring and management systems It is structured in a way that allows for implementation. This enables a major change in the existing network infrastructure. 5 monitoring cell performance, identifying abnormalities, and without requiring It becomes possible to support intervention processes. The steps involved in the process are as follows:  Traffic and performance data source (1) cell-based traffic and performance 10 Transfer of data to the data collection and preprocessing unit (2) (1001),  Cells belonging to different time periods by the data collection and preprocessing unit (2) Organizing basic data to make it suitable for analysis (1002),  Network transmission infrastructure (4) of data obtained from base station cell (3) (1003), 15 to transmit to the behavior analysis and comparison unit (5)  Behavioral analysis and comparison unit (5) of the cell's history Reference behavior using data from the same days and times of the weeks creation (1004),  Behavioral analysis and comparison unit (5) by current data at the relevant time 20. Identifying deviations by comparing them to the reference behavior corresponding to the segment. (1005),  Short-term fluctuations by the behavioral analysis and comparison unit (5) isolating changes that continue for a specific period of time and continuing for a specific period deviations are considered as abnormal conditions (1006),  Detected abnormal situations are reported via the alarm and monitoring interface (6) 25 to be sent to the user (1007). The invention's operating principle involves analyzing the cell's current traffic and performance data from past events. cell-specific data created from data obtained on the same days and times over the weeks It is compared with the reference behavior. The deviations that emerge as a result of the comparison are 30 By evaluating continuity, short-term fluctuations are filtered out, and those that persist for a certain period are identified. Deviations that occur are identified as abnormal conditions, and the identified abnormal condition triggers an alarm. The evaluation is transmitted to the user via the monitoring interface (6). Thus, the evaluation is only instantaneous. based on the cell's own past behavior, regardless of a value or fixed threshold. is being carried out. 35

Claims

8 REQUESTS 1. Traffic and performance of base station cells (3) in mobile communication networks anomalies were identified by comparing the data with behavioral data from previous weeks. It is a system that enables the detection of situations, and its feature is; 5  Traffic and performance data that provides cell-based traffic and performance data. source (1),  Processes cell-based data received from traffic and performance data source (1) and Organize the mentioned data according to different time periods for analysis. data collection and preprocessing unit (2), 10  base station cell to which traffic and performance data belong (3),  transmitting data obtained from the base station cell (3) via data communication network transmission infrastructure (4),  network transmission infrastructure via software running on an electronic device (4) From the cell-based data obtained from each cell, 15 of the past weeks Reference behavior using data corresponding to the same day and time zones. generated by comparing current data with the reference behavior of the relevant time period. comparing, with short-term fluctuations continuing for a certain period Changes that differentiate and deviations that persist for a certain period of time are considered abnormal. Behavioral analysis and comparison unit (5), 20  as an analysis output by the behavior analysis and comparison unit (5) Alarm and monitoring interface that presents the identified anomaly data to the user. (6) It includes.

2. The system is compliant with claim 1 and its feature is the behavior analysis and comparison unit (5), Even if the current traffic or performance indicator does not exceed a fixed threshold value, the word The issue is that the indicator deviates from the cell-specific reference behavior, which is an abnormal condition. It is a unit that considers it as such.

3. The system is compliant with Request 1 and its feature is that the alarm and monitoring interface (6) is available on the network. It will work integrated with an additional module within the monitoring and management system. It is a structured interface.

4. Cells are created via software running on an electronic device. It is an abnormality detection method based on weekly behavior; its characteristic feature is: 9  Traffic and performance data source (1) cell-based traffic and performance Transfer of data to the data collection and preprocessing unit (2) (1001),  Data collection and preprocessing unit (2) for different time periods Organizing cell-based data to make it suitable for analysis (1002),  Network transmission infrastructure (4) of data obtained from base station cell (3) 5 (1003), to be transmitted to the behavior analysis and comparison unit (5),  Behavioral analysis and comparison unit (5) of the cell's history Reference behavior using data from the same days and times of the weeks creation (1004),  Behavioral analysis and comparison unit (5) by current data relevant 10 deviations compared to the reference behavior corresponding to the time period determination (1005),  Short-term fluctuations by behavioral analysis and comparison unit (5) isolating changes that continue for a specific period of time and a specific period of time continued deviations are considered an abnormal situation (1006), 15  Detected abnormal situations are reported via the alarm and monitoring interface (6) to be sent to the user (1007) It includes the steps of the process.

5. This method complies with Claim 4 and its characteristic is that it provides 20 current traffic or performance indicators. cell-specific reference behavior despite not exceeding a fixed threshold value If the deviation occurs, it will be considered an abnormal situation in the process step. It includes.

6. This method complies with Claim 4, and its characteristic is that the detected abnormality is reported to the operator's 25 Alarm and monitoring interface (6) that works within the existing network monitoring and management system It includes the steps of the process to be shown to the user.

Images