METHOD AND SYSTEM FOR PERFORMING ROOT CAUSE ANALYSIS FOR ONE OR MORE NETWORK FUNCTIONS (NFs)

Abstract

The present disclosure relates to a method and a system for performing root cause analysis for one or more NFs, the method comprising receiving, a network data from one or more NFs. The method comprising transmitting, the network data to an ingestion layer [204]. The method comprising processing, the network data received from the one or more NFs. The method comprising converting, the processed network data to a normalized network data. The method comprising storing, the normalized network data in at least one of a first database [216] and a second database [214]. The method comprising retrieving, the normalized network data from the at least one of the first database [216] and the second database [214]. The method comprising identifying, an anomaly associated with the one or more NFs. method comprising transmitting, the identified anomaly, to an analyser layer [208], for performing, a root cause analysis.

Description

METHOD AND SYSTEM FOR PERFORMING ROOT CAUSE ANALYSIS FOR ONE OR MORE NETWORK FUNCTIONS (NFs)FIELD OF INVENTION

[0001] Embodiments of the present disclosure relate generally to the field of wireless communication. More particularly, embodiment of the present disclosure relates to a method and system for performing root cause analysis for one or more network functions (NFs).BACKGROUND

[0002] The following description of the related art is intended to provide background information pertaining to the field of the disclosure. This section may include certain aspects of the art that may be related to various features of the present disclosure. However, it should be appreciated that this section is used only to enhance the understanding of the reader with respect to the present disclosure, and not as admissions of the prior art.

[0003] Network performance management systems typically track network elements and data from network monitoring tools and combine and process such data to determine key performance indicators (KPI) of the network. Integrated performance management systems provide the means to visualize the network performance data so that network operators and other relevant stakeholders are able to identify the service quality of the overall network, and individual / grouped network elements. By having an overall as well as detailed view of the network performance, the network operators can detect, diagnose and remedy actual service issues, as well as predict potential service issues or failures in the network and take precautionary measures accordingly.

[0004] The network performance management system monitors and collects data from various network elements and monitoring tools. These monitored values or Clear Codes values are configured for identifying different events during processing of any service request. Clear codes are unique codes which describe valuable information of the state of the network function. Clear Codes contain description of all cause codes and event codes reported by different program blocks running on network elements. Clear Codes provide very useful information to analyse the exact root cause of any error in a network element. Apart from these, clear codes can also be used for identifying the key successful events during the execution of a process. For example, during a voice call communication, when a call flow starts, different network functions and elementsgenerate different Clear Codes, which describe the success or failure events, and the like, for particular network elements during the communication going on between calling and called party. Through monitoring of these Clear Codes, any issue or error or failure can be analysed for identifying root cause of problems. However, the existing solutions have various limitations for analysing Clear Codes and finding the root cause factors of problems due to complex configurations, formats and manual efforts. The Clear Codes are 32 characters format codes, which are hard to analyse and to understand for a user, and there may be large number of Clear Codes for an ongoing requested service. Further, there is no such effective system and method which performs root cause analysis with Clear Codes using Artificial Intelligence / Machine Learning (AI / ML).

[0005] To detect the root cause analysis (RCA), an AI / ML model uses a decision tree model to self-train the AI / ML model based on the digits of the clear codes, as each digit of a clear code signifies a particular information.

[0006] For example: First set of digits in the clear code is used to identify the result, whether it is a success or an error (intemal / extemal). Second set of digits depict the network procedures. Third set of digits depict the type of interface, e.g., ingress / egress, respective of response codes. Fourth set of digits depict error codes. A probing solution in a network captures traffic from network elements. Based on these error codes, a probing solution determines the automatic root cause analysis (RCA). Additionally, it finds the RCA for network functions based on errors (external), interfaces (egress), and procedures (network).

[0007] Thus, there exists an imperative need in the art to provide a solution that can overcome these and other limitations of the existing solutions.SUMMARY

[0008] This section is provided to introduce certain aspects of the present disclosure in a simplified form that are further described below in the detailed description. This summary is not intended to identify the key features or the scope of the claimed subject matter.

[0009] An aspect of the present disclosure may relate to a method for performing root cause analysis for one or more network functions (NFs), the method comprising: receiving, a network data from one or more NFs, by a data collector unit. The method further comprises transmitting,the network data by the data collector unit to an ingestion layer. The method further comprises processing, the network data received from the one or more NFs, by the ingestion layer. The method further comprises converting, the processed network data to a normalized network data, by a normalization layer. The method further comprises storing, the normalized network data in at least one of a first database and a second database, by the normalization layer. The method further comprises retrieving, the normalized network data from the at least one of the first database and the second database, by a training layer. The method further comprises identifying, an anomaly associated with the one or more NFs, based on the normalized network data, by the training layer. The method further comprises transmitting, the identified anomaly, by the training layer to an analyser layer, for performing, a root cause analysis based on the identified anomaly.

[0010] In an exemplary aspect of the present disclosure, the network data comprises one or more network codes comprising unique identifiers in a sequential string format, received from the one or more NFs.

[0011] In an exemplary aspect of the present disclosure, processing the network data received from the one or more NFs by the ingestion layer comprises compressing the network data.

[0012] In an exemplary aspect of the present disclosure, the first database is a Distributed Data Lake.

[0013] In an exemplary aspect of the present disclosure, the second database is a Distributed File System.

[0014] In an exemplary aspect of the present disclosure, the method further comprises receiving, a request for real time trend data associated with the one or more NFs at a user interface; sending, the request to the analyser layer, wherein, the analyser layer further retrieves the normalised network data via a streaming engine from the second database; generating, a real-time trend report based on the retrieved normalised network data, to be displayed at the user interface.

[0015] In an exemplary aspect of the present disclosure, the method further comprises receiving, a request for forecasting trend data associated with the one or more NFs, at the user interface. The method further comprises sending, the request to the training layer, wherein the training layer further processes the request to generate a forecasting trend data. The method further comprises transmitting, the generated forecasting trend data, by the training layer to the analyser layer. Themethod further comprises generating, a forecasting trend report based on the generated forecasting trend data, by the analyser layer, to be displayed at the user interface.

[0016] In an exemplary aspect of the present disclosure, the training layer is trained based on a decision tree model to identify an anomaly related to the one or more NFs.

[0017] In an exemplary aspect of the present disclosure, wherein prior to transmitting, by the training layer, the anomaly to an analyser layer to perform a root cause analysis the method comprises receiving, a request for performing root cause analysis at the user interface. The method further comprises performing, the root cause analysis based on the anomaly, by the analyser layer. The method further comprises generating, a root cause analysis report based on performing the root cause analysis, by the analyser layer.

[0018] In an exemplary aspect of the present disclosure, post generating, the root cause analysis report, the method comprises displaying, the root cause analysis report at the user interface.

[0019] Another aspect of the present disclosure may relate to a system for performing root cause analysis for one or more network functions (NFs), the system comprises: a data collector unit configured to: receive a network data from one or more NFs; transmit the network data to an ingestion layer. The ingestion layer is configured to process the network data, and send, to a normalization layer, the processed network data. The normalization layer is configured to convert the processed network data to a normalized network data, store, the normalized network data to at least one of a first database and a second database. The system further comprises a training layer configured to retrieve the normalized network data from the at least one of the first database and the second database, identify, an anomaly associated with the one or more NFs based on the normalized network data and transmit, the anomaly to an analyser layer to perform a root cause analysis.

[0020] Yet another aspect of the present disclosure may relate to a non-transitory computer readable storage medium storing instruction for performing root cause analysis for one or more network functions (NFs), the instructions include executable code which, when executed by one or more units of a system, causes a data collector unit to receive a network data from one or more NFs. Further, the instructions include executable code which, when executed causes the data collector unit to transmit the network data to an ingestion layer. Further, the instructions include executable code which, when executed causes the ingestion layer to process the network data, andsend, to a normalization layer, the processed network data. Further, the instructions include executable code which, when executed causes the normalization layer of the system to convert the processed network data to a normalized network data and store, the normalized network data to at least one of a first database and a second database. Further, the instructions include executable code which, when executed causes a training layer to retrieve the normalized network data from the at least one of the first database and the second database, identify, an anomaly associated with the one or more NFs based on the normalized network data and transmit, the anomaly to an analyser layer to perform a root cause analysis.OBJECTS OF THE DISCLOSURE

[0021] Some of the objects of the present disclosure, which at least one embodiment disclosed herein satisfies are listed herein below.

[0022] It is an object of the present disclosure to provide a system and a method for performing root cause analysis for one or more network functions (NFs).

[0023] It is another object of the present disclosure to provide a method and a system for proactively identifying and addressing the network issues using AI / ML based techniques with Clear codes on the fly.

[0024] It is another object of the present disclosure to provide a method and a system for providing AI / ML based technique with Clear codes describing an easier user understandable string format to know root cause factors of occurring problems in the network.DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Also, the embodiments shown in the figures are not to be construed as limiting the disclosure, but the possible variants of the method and system according to the disclosure are illustrated herein to highlight the advantages of the disclosure. It will beappreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components or circuitry commonly used to implement such components.

[0026] FIG. 1 illustrates an exemplary block diagram of a computing device

[0100] upon which the features of the present disclosure may be implemented in accordance with exemplary implementation of the present disclosure.

[0027] FIG. 2 illustrates an exemplary block diagram of a system

[0200] for performing root cause analysis for one or more network functions (NFs), in accordance with exemplary implementations of the present disclosure.

[0028] FIG. 3 illustrates a method flow diagram

[0300] for performing root cause analysis for one or more network functions (NFs), in accordance with exemplary implementations of the present disclosure.

[0029] FIG. 4 illustrates an exemplary architecture diagram of a system

[0400] for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention.

[0030] FIG. 5 illustrates an exemplary flow diagram

[0500] of data normalization and storage for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention.

[0031] FIG. 6 illustrates a flow diagram

[0600] of analyser usage for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention.

[0032] FIG. 7 illustrates a system architecture

[0700] for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention.

[0033] The foregoing shall be more apparent from the following more detailed description of the disclosure.DETAILED DESCRIPTION

[0034] In the following description, for the purposes of explanation, various specific details are set forth in order to provide a thorough understanding of embodiments of the present disclosure. It will be apparent, however, that embodiments of the present disclosure may be practiced without these specific details. Several features described hereafter may each be used independently of one another or with any combination of other features. An individual feature may not address any of the problems discussed above or might address only some of the problems discussed above.

[0035] The ensuing description provides exemplary embodiments only, and is not intended to limit the scope, applicability, or configuration of the disclosure. Rather, the ensuing description of the exemplary embodiments will provide those skilled in the art with an enabling description for implementing an exemplary embodiment. It should be understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the disclosure as set forth.

[0036] Specific details are given in the following description to provide a thorough understanding of the embodiments. However, it will be understood by one of ordinary skill in the art that the embodiments may be practiced without these specific details. For example, circuits, systems, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail.

[0037] Also, it is noted that individual embodiments may be described as a process which is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations may be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed but could have additional steps not included in a figure.

[0038] The word “exemplary” and / or “demonstrative” is used herein to mean serving as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited by such examples. In addition, any aspect or design described herein as “exemplary” and / or “demonstrative” is not necessarily to be construed as preferred or advantageous over other aspects or designs, nor is it meant to preclude equivalent exemplary structures and techniques known to those of ordinary skill in the art. Furthermore, to the extent that the terms “includes,” “has,” “contains,” and other similar words are used in either the detailed description or the claims,such terms are intended to be inclusive in a manner similar to the term “comprising” as an open transition word without precluding any additional or other elements.

[0039] As used herein, a “processing unit” or “processor” or “operating processor” includes one or more processors, wherein processor refers to any logic circuitry for processing instructions. A processor may be a general-purpose processor, a special purpose processor, a conventional processor, a digital signal processor, a plurality of microprocessors, one or more microprocessors in association with a Digital Signal Processing (DSP) core, a controller, a microcontroller, Application Specific Integrated Circuits, Field Programmable Gate Array circuits, any other type of integrated circuits, etc. The processor may perform signal coding data processing, input / output processing, and / or any other functionality that enables the working of the system according to the present disclosure. More specifically, the processor or processing unit is a hardware processor.

[0040] As used herein, “a user equipment”, “a user device”, “a smart-user-device”, “a smartdevice”, “an electronic device”, “a mobile device”, “a handheld device”, “a wireless communication device”, “a mobile communication device”, “a communication device” may be any electrical, electronic and / or computing device or equipment, capable of implementing the features of the present disclosure. The user equipment / device may include, but is not limited to, a mobile phone, smart phone, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, wearable device or any other computing device which is capable of implementing the features of the present disclosure. Also, the user device may contain at least one input means configured to receive an input from unit(s) which are required to implement the features of the present disclosure.

[0041] As used herein, “storage unit” or “memory unit” refers to a machine or computer-readable medium including any mechanism for storing information in a form readable by a computer or similar machine. For example, a computer-readable medium includes read-only memory (“ROM”), random access memory (“RAM”), magnetic disk storage media, optical storage media, flash memory devices or other types of machine-accessible storage media. The storage unit stores at least the data that may be required by one or more units of the system to perform their respective functions.

[0042] As used herein “interface” or “user interface” refers to a shared boundary across which two or more separate components of a system exchange information or data. The interface may also be referred to a set of rules or protocols that define communication or interaction of one or moremodules or one or more units with each other, which also includes the methods, functions, or procedures that may be called.

[0043] All modules, units, components used herein, unless explicitly excluded herein, may be software modules or hardware processors, the processors being a general-purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more microprocessors in association with a DSP core, a controller, a microcontroller, Application Specific Integrated Circuits (ASIC), Field Programmable Gate Array circuits (FPGA), any other type of integrated circuits, etc.

[0044] Root Cause Analysis involves the detection and evaluation of anomalies or deviations in network performance by comparing real-time trends against established secondary data (e.g., normal operational data, threshold data, historical trend data).

[0045] As used herein the transceiver unit includes at least one receiver and at least one transmitter configured respectively for receiving and transmitting data, signals, information or a combination thereof between units / components within the system and / or connected with the system.

[0046] As discussed in the background section, the current known solutions have several shortcomings. The present disclosure aims to overcome the above-mentioned and other existing problems in this field of technology by providing method and system of performing root cause analysis for one or more network functions (NFs).

[0047] As discussed in the background section, the current known solutions have several shortcomings. The present disclosure aims to overcome the above-mentioned and other existing problems in this field of technology by providing method and system for an AI / ML based proactive root cause analysis with sequential occurrence of Clear codes for analysis.

[0048] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the accompanying drawings.

[0049] FIG. 1 illustrates an exemplary block diagram of a computing device

[0100] upon which the features of the present disclosure may be implemented in accordance with exemplary implementation of the present disclosure. In an implementation, the computing device

[0100] may also implement a method for managing performance data of a node in a network utilising thesystem. In another implementation, the computing device

[0100] itself implements the method for managing performance data of a node in a network using one or more units configured within the computing device

[0100] , wherein said one or more units are capable of implementing the features as disclosed in the present disclosure.

[0050] The computing device

[0100] may include a bus

[0102] or other communication mechanism for communicating information, and a hardware processor

[0104] coupled with bus

[0102] for processing information. The hardware processor

[0104] may be, for example, a general-purpose microprocessor. The computing device

[0100] may also include a main memory

[0106] , such as a random-access memory (RAM), or other dynamic storage device, coupled to the bus

[0102] for storing information and instructions to be executed by the processor

[0104] , The main memory

[0106] also may be used for storing temporary variables or other intermediate information during execution of the instructions to be executed by the processor

[0104] , Such instructions, when stored in non-transitory storage media accessible to the processor

[0104] , render the computing device

[0100] into a special-purpose machine that is customized to perform the operations specified in the instructions. The computing device

[0100] further includes a read only memory (ROM)

[0108] or other static storage device coupled to the bus

[0102] for storing static information and instructions for the processor

[0104] ,

[0051] A storage device

[0110] , such as a magnetic disk, optical disk, or solid-state drive is provided and coupled to the bus

[0102] for storing information and instructions. The computing device

[0100] may be coupled via the bus

[0102] to a display

[0112] , such as a cathode ray tube (CRT), Liquid crystal Display (LCD), Light Emitting Diode (LED) display, Organic LED (OLED) display, etc. for displaying information to a computer user. An input device

[0114] , including alphanumeric and other keys, touch screen input means, etc. may be coupled to the bus

[0102] for communicating information and command selections to the processor

[0104] , Another type of user input device may be a cursor controller

[0116] , such as a mouse, a trackball, or cursor direction keys, for communicating direction information and command selections to the processor

[0104] , and for controlling cursor movement on the display

[0112] , This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allow the device to specify positions in a plane.

[0052] The computing device

[0100] may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and / or program logic which in combination with the computing device

[0100] causes or programs the computing device

[0100] to be a special-purpose machine. According to one implementation, the techniques herein are performed by the computing device

[0100] in response to the processor

[0104] executing one or more sequences of one or more instructions contained in the main memory

[0106] , Such instructions may be read into the main memory

[0106] from another storage medium, such as the storage device

[0110] , Execution of the sequences of instructions contained in the main memory

[0106] causes the processor

[0104] to perform the process steps described herein. In alternative implementations of the present disclosure, hard-wired circuitry may be used in place of or in combination with software instructions.

[0053] The computing device

[0100] also may include a communication interface

[0118] coupled to the bus

[0102] , The communication interface

[0118] provides a two-way data communication coupling to a network link

[0120] that is connected to a local network

[0122] , For example, the communication interface

[0118] may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, the communication interface

[0118] may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, the communication interface

[0118] sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

[0054] The computing device

[0100] can send messages and receive data, including program code, through the network(s), the network link

[0120] and the communication interface

[0118] , In the Internet example, a server

[0130] might transmit a requested code for an application program through the Internet

[0128] , the ISP

[0126] , the local network

[0122] , the host

[0124] and the communication interface

[0118] , The received code may be executed by the processor

[0104] as it is received, and / or stored in the storage device

[0110] , or other non-volatile storage for later execution.

[0055] Referring to FIG. 2, an exemplary block diagram of a system

[0200] for performing root cause analysis for one or more network functions (NFs), is shown, in accordance with the exemplary implementations of the present disclosure. The system

[0200] comprises at least one data collector unit

[0202] , at least one ingestion layer

[0204] , at least one normalization layer

[0206] , at least one analyser layer

[0208] , at least one streaming engine

[0210] , at least one training layer

[0212] , at least one second database

[0214] , at least one first database

[0216] and at least one user interface

[0218] , Also, all of the components / units of the system

[0200] are assumed to be connected to each other unless otherwise indicated below. As shown in the figures all units shown within the system

[0200] should also be assumed to be connected to each other. Also, in FIG. 2 only a few units are shown, however, the system

[0200] may comprise multiple such units or the system

[0200] may comprise any such numbers of said units, as required to implement the features of the present disclosure. Further, in an implementation, the system

[0200] may reside in a server or a network entity.

[0056] The system

[0200] is configured for performing root cause analysis for one or more network functions (NFs), with the help of the interconnection between the components / units of the system

[0200] ,

[0057] In order to perform a root cause analysis for one or more network functions (NFs) the data collector unit

[0202] is configured to receive a network data from one or more NFs. The data collector unit

[0202] is further configured to transmit the network data to an ingestion layer

[0204] ,

[0058] In an implementation of the present disclosure, the purpose of performing root cause analysis is to identify the fundamental issue causing network troubles. The data collector unit

[0202] is responsible for receiving and storing network data received from multiple NFs. The network data comprises one or more network codes comprising unique identifiers in a sequential string format received from the one or more NFs. The network data includes metrics such as traffic volumes, error rates and latency. In an implementation, the network data may represent Clear Code values, which are configured for identifying different events during processing of any service request. Clear codes are unique codes which describe valuable information of the state of the network function. Clear Codes contain description of all cause codes and event codes reported by different program blocks running on network elements. Clear Codes provide very useful information to analyse the exact root cause of any error in a network element. Apart from these, clear codes can also be used for identifying the key successful events during the execution of a process.

[0059] Thereafter, the ingestion layer

[0204] is configured to process the network data, and send, to a normalization layer

[0206] , the processed network data.

[0060] In an implementation of the present disclosure, the ingestion layer

[0204] is configured to process the network data by compressing the network data received from the one or more NFs. Moreover, the ingestion layer

[0204] fetches the data from the data collector unit

[0202] , compresses it and sends it to the normalization layer over File Transfer Protocol (FTP).

[0061] Also, the normalization layer

[0206] is configured to convert the processed network data to a normalized network data. Further, the normalization layer

[0206] is configured to store, the normalized network data to at least one of a first database

[0216] and a second database

[0214] , In an implementation, the normalization layer

[0206] receives the network data from the ingestion layer

[0204] , it then pre-processes the network data based on predefined metadata and rules (fieldname and type), such that the network data may be ready to be stored in the corresponding data sources, such first database

[0216] and second database

[0214] ,

[0062] In an implementation of the present disclosure, the process of converting the processed network data to normalized network data by the normalization layer

[0206] begins with the receipt of the processed data from the ingestion layer

[0204] , This data might be in various formats and structures, depending on the source NFs. The normalization layer

[0206] regulates the network data into a format. This may involve converting different data types into a unified schema and handling missing values. Further, normalized network data refers to network information that has been transformed to a standardized structure, eliminating differences and inconsistencies. The normalization layer

[0206] post processing the data, stores the normalized network data in the first database

[0216] as well as in second database

[0214] ,

[0063] In an example, the first database

[0216] is a distributed data lake and the second database

[0214] is a distributed file system. The first database

[0216] , described as a distributed data lake, is designed to store large volumes of diverse data types. The second database

[0214] is described as a distributed file system, which ensures data is stored across multiple nodes or servers.

[0064] Then, the training layer

[0212] is configured to retrieve the normalized network data from the at least one of the first database

[0216] and the second database

[0214] , The databases respond to the query by the training layer

[0212] by locating the requested normalized network data within their respective storage structures. The data is then fetched and transferred back to the training layer

[0212] in a format that is ready for further analysis.

[0065] Furthermore, the training layer

[0212] is configured to identify, an anomaly associated with the one or more NFs based on the normalized network data. In an example, identifying an anomaly by the training layer

[0212] involves analysing the normalized network data to detect deviations from expected patterns or behaviours. The training layer

[0212] employs machine learning algorithms, such as a decision tree model, to evaluate the normalized data. By comparing thecurrent data with the past data, the training layer

[0212] can identify irregularities that signify potential anomalies. These anomalies may indicate performance issues, security breaches, within the network functions. An anomaly associated with the network functions (NFs) can be any deviation from normal patterns that may indicate a problem. Examples include unusually high error rates and sudden drops in network performance. Also, the training layer

[0212] is further configured to transmit, the anomaly to an analyser layer

[0208] to perform a root cause analysis.

[0066] In an example, wherein prior to transmitting, by the training layer

[0212] , the anomaly to an analyser layer

[0208] to perform a root cause analysis, the system comprises the user interface

[0218] configured to receive a request for performing root cause analysis. Further, the analyser layer

[0208] is configured to perform the root cause analysis based on the anomaly. Then, the analyser layer

[0208] configured to generate a root cause analysis report based on performing the root cause analysis.

[0067] Further, post generating, by the analyser layer

[0208] , the root cause analysis report, the analyser layer

[0208] is configured to display the root cause analysis report at the user interface

[0218] ,

[0068] In an implementation of the present disclosure, the training layer

[0212] employs machine learning techniques to analyse the data, identify anomalies in network functions. Then, the training layer

[0212] is trained based on a decision tree model to identify an anomaly related to the one or more NFs. The anomaly is an unexpected or irregular event or data point within the network functions. Examples of anomalies may include high error rates, latency variation and unauthorised access attempts. The training layer

[0212] runs multiple Artificial Intelligence (AI) / Machine Learning (ML) algorithms continuously to find any failure scenario and send data to the analyser layer

[0208] , After feeding the Clear Codes to AI / ML algorithms, the training layer

[0212] has the capability to generate the root cause of network functions in case of any failure code it gets from the Clear Codes data. This way proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis.

[0069] The system further comprises a user interface

[0218] configured to receive a request for real time trend data associated with the one or more NFs and send, the request to the analyser layer

[0208] , In an example, the user interface

[0218] is designed to receive input from users, such as requests for real-time trend data related to network traffic volumes, error rates and user login attempts. The real-time trend data provides insights into the current performance and behaviour ofnetwork functions. This data is continuously updated, allowing users to monitor and analyse the network’s status and trends as they occur in real-time.

[0070] In an example the analyser layer

[0208] is further configured to retrieve the normalised network data via a streaming engine

[0210] from the second database

[0214] , The analyser layer

[0208] is further configured to generate, a real-time trend report to be displayed at the user interface

[0218] , In an example, the analyser layer

[0208] not only performs root cause analysis but also handles requests for real-time trend data. It retrieves normalized network data from the second database

[0214] via a streaming engine

[0210] and generates reports that display ongoing trends and patterns, which are then sent to the user interface

[0218] for user viewing. The streaming engine facilitates real-time data processing by continuously collecting and transmitting data from the database to the analyser layer

[0208] , This setup allows the analyser layer

[0208] to access up-to- date data without the need for batch processing. The streaming engine

[0210] is the technology or platform that enables the continuous processing and delivery of data in real-time. An example of a streaming engine is Apache Kafka, which is widely used for building real-time data pipelines and streaming applications.

[0071] The retrieved normalized network data includes processed information from various network functions. This data could encompass performance metrics, error logs, traffic statistics and user activity records. The real-time trend report based on this data may include for example, User Equipment (UE) mobility information, UE communication information, UE abnormal behaviour information.

[0072] In an example, the real-time trend report generated by the analyser layer

[0208] provides a comprehensive overview of the ongoing performance and behaviour of network functions. This report is designed to be displayed on the user interface

[0218] ,

[0073] The user interface

[0218] is further configured to receive a request for a forecasting trend data associated with the one or more NFs and send, the request to the training layer

[0212] ,

[0074] In an example, the user interface

[0218] enables users to input requests for specific actions, such as requesting forecasting trend data. This request is captured by the user interface

[0218] and transmitted to the training layer

[0212] , The forecasting trend data involves analysing past and current network data to predict future behaviours and trends. In an example, forecasting trend data may be for example, an anticipated increases in data traffic and expected error rates.

[0075] Further, the training layer

[0212] is further configured to process the request to generate a forecasting trend data. The, the analyser layer

[0208] is further configured to receive the forecasting trend data from the training layer

[0212] and generate, a forecasting trend report to be displayed at the user interface

[0218] ,

[0076] In an example, the training layer

[0212] processes requests for forecasting trend data. It utilizes historical and current network data to generate predictions about future trends. The analyser layer

[0208] receives the forecasting trend data from the training layer

[0212] and generates a forecasting trend report. This report provides a detailed overview of the predicted future trends in network functions, based on the forecasting data generated by the training layer.

[0077] In an example, the user interface

[0218] enables users to input requests for specific actions, such as performing a root cause analysis. Before the training layer

[0212] transmits an identified anomaly to the analyser layer

[0208] , it ensures the anomaly is properly detected and prepared for further analysis.

[0078] In an example, the analyser layer

[0208] is responsible for conducting the root cause analysis based on the anomalies identified by the training layer

[0212] , It generates a detailed root cause analysis report that explains the origins of the identified issues. The analyser layer

[0208] also handles requests received via the user interface

[0218] for performing root cause analysis. The root cause analysis report generated by the analyser layer

[0208] provides a comprehensive overview of the issues affecting network functions and their root causes. This report is intended to be displayed on the user interface

[0218] , giving users detailed insights into the nature and origins of network anomalies.

[0079] Referring to FIG. 3, an exemplary method flow diagram

[0300] for performing root cause analysis for one or more network functions (NFs), in accordance with exemplary implementations of the present disclosure is shown. In an implementation the method

[0300] is performed by the system

[0200] , Further, in an implementation, the system

[0200] may be present in a server device to implement the features of the present disclosure. Also, as shown in FIG. 3, the method

[0300] starts at step

[0302] ,

[0080] At step 304, In order to perform root cause analysis for one or more network functions (NFs), the method comprises receiving, a network data from one or more NFs, by a data collectorunit

[0202] , In an example, the purpose of performing root cause analysis is to identify the fundamental issue causing network troubles. The data collector unit

[0202] is responsible for receiving and storing network data received from multiple NFs.

[0081] At step 306, the method comprises, transmitting, the network data by the data collector unit

[0202] to an ingestion layer

[0204] , In an example, the network data comprises one or more network codes comprising unique identifiers in a sequential string format received from the one or more NFs. The network data includes metrics such as traffic volumes, error rates and latency. In an implementation, the network data may represent Clear Codes values, which are configured for identifying different events during processing of any service request. Clear codes are unique codes which describe valuable information of the state of the network function. Clear Codes contain description of all cause codes and event codes reported by different program blocks running on network elements. Clear Codes provide very useful information to analyse the exact root cause of any error in a network element. Apart from these, clear codes can also be used for identifying the key successful events during the execution of a process.

[0082] At step 308, the method comprises, processing, the network data received from the one or more NFs, by the ingestion layer

[0204] , In an implementation of the present disclosure, the processing the network data received from the one or more NFs by the ingestion layer

[0204] comprises compressing the network data. Moreover, the ingestion layer

[0204] fetches the data from the data collector unit

[0202] , compresses it and send it to the normalization layer

[0206] over File Transfer Protocol (FTP).

[0083] At step 310, the method comprises, converting, the processed network data to a normalized network data, by a normalization layer

[0206] , In an example, the normalization layer

[0206] receives the network data from the ingestion layer

[0204] , it then pre-processes the network data based on predefined metadata and rule (fieldname and type), such that the network data may be ready to be stored in the corresponding data source, such first database

[0216] and second database

[0214] ,

[0084] In an implementation of the present disclosure, the process of converting the processed network data to normalized network data by the normalization layer

[0206] begins with the receipt of the processed data from the ingestion layer

[0204] , This data might be in various formats and structures, depending on the source NFs. The normalization layer

[0206] regulates the network data into a format. This may involve converting different data types into a unified schema and handlingmissing values. Further, the normalized network data refers to network information that has been transformed to a standardized structure, eliminating differences and inconsistencies.

[0085] At step 312, the method comprises, storing, the normalized network data in at least one of a first database

[0216] and a second database

[0214] , by the normalization layer

[0206] , In an example, the first database

[0216] is a distributed data lake and the second database

[0214] is a distributed file system. The first database

[0216] , described as a distributed data lake, is designed to store large volumes of diverse data types. The second database

[0214] is described as a distributed file system, which ensures data is stored across multiple nodes or servers. Thereafter, the training layer

[0212] is configured to retrieve the normalized network data from the at least one of the first database

[0216] and the second database

[0214] , The databases respond to this retrieval query by locating the requested normalized network data within their respective storage structures. The data is then fetched and transferred back to the training layer

[0212] in a format that is ready for further analysis.

[0086] Furthermore, the training layer

[0212] is configured to identify, an anomaly associated with the one or more NFs based on the normalized network data. In an example, identifying an anomaly by the training layer

[0212] involves analysing the normalized network data to detect deviations from expected patterns or behaviours. The training layer

[0212] employs machine learning algorithms, such as a decision tree model, to evaluate the normalized data. By comparing the current data with the past data, the training layer

[0212] can identify irregularities that signify potential anomalies. These anomalies may indicate performance issues, security breaches, within the network functions. Also, the training layer

[0212] is further configured to transmit, the anomaly to an analyser layer

[0208] to perform a root cause analysis. An anomaly associated with the network functions (NFs) can be any deviation from normal patterns that may indicate a problem. Examples include unusually high error rates and sudden drops in network performance.

[0087] The normalization layer

[0206] , post processing the data, stores the normalized network data in the first database as well as in second database.

[0088] At step 314, the method comprises, retrieving, the normalized network data from the at least one of the first database

[0216] and the second database

[0214] , by a training layer

[0212] , The training layer

[0212] , in order to identify network failure and faults, retrieves the Clear Codes from the databases to perform the fault identification.

[0089] In an example, prior to transmitting, by the training layer

[0212] , the anomaly to an analyser layer

[0208] to perform a root cause analysis the method comprises receiving, a request for performing root cause analysis at the user interface

[0218] ; performing, the root cause analysis based on the anomaly, by the analyser layer

[0208] ; and generating, a root cause analysis report based on performing the root cause analysis, by the analyser layer

[0208] ,

[0090] Further, post generating, the root cause analysis report, the method comprises displaying, the root cause analysis report at the user interface

[0218] ,

[0091] In an implementation of the present disclosure, the training layer

[0212] employs machine learning techniques to analyse the data, identifying anomalies in network functions. Then, the training layer

[0212] is trained based on a decision tree model to identify an anomaly related to the one or more NFs. The anomaly is an unexpected or irregular event or data point within the network functions. Examples of anomalies include high error rates, latency variation and unauthorised access attempts. The training layer

[0212] runs multiple Artificial Intelligence (AI) / Machine Learning (ML) algorithms continuously to find any failure scenario and send data to the analyser layer

[0208] , After feeding the Clear Codes to AI / ML algorithms, the training layer

[0212] has the capability to generate the root cause of network functions in case of any failure code it gets from the Clear Codes data. This way proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis.

[0092] At step 316, the method comprises, identifying, an anomaly associated with the one or more NFs, based on the normalized network data, by the training layer

[0212] ,

[0093] At step 318, the method comprises, transmitting, the identified anomaly, by the training layer

[0212] to an analyser layer

[0208] , for performing, a root cause analysis based on the identified anomaly.

[0094] The method further comprising, receiving, a request for real time trend data associated with the one or more NFs at a user interface

[0218] , In an example, the user interface

[0218] is designed to receive input from users, such as requests for real-time trend data such as network traffic volumes, error rates and user login attempts. The real-time trend data provides insights into the current performance and behaviour of network functions. This data is continuously updated, allowing users to monitor and analyse the network’s status and trends as they occur in real-time.

[0095] In an example, the request is sent to the analyser layer

[0208] , wherein, the analyser layer

[0208] further retrieves the normalised network data via a streaming engine

[0210] from the second database

[0214] and generates, a real-time trend report based on the retrieved normalised network data, to be displayed at the user interface

[0218] , The analyser layer

[0208] not only performs root cause analysis but also handles requests for real-time trend data. It retrieves normalized network data from the second database

[0214] via a streaming engine

[0210] and generates reports that display ongoing trends and patterns, which are then sent to the user interface

[0218] for user viewing. The streaming engine

[0210] facilitates real-time data processing by continuously collecting and transmitting data from the database to the analyser layer

[0208] , This setup allows the analyser layer

[0208] to access up-to-date data without the need for batch processing. The streaming engine

[0210] is the technology or platform that enables the continuous processing and delivery of data in realtime. An example of a streaming engine is Apache Kafka, which is widely used for building realtime data pipelines and streaming applications.

[0096] The retrieved normalized network data includes processed information from various network functions. This data could encompass headers such as, performance metrics, error logs, traffic statistics and user activity records. The real-time trend report based on this data may include for example, User Equipment (UE) mobility information, UE communication information, UE abnormal behaviour information.

[0097] In an example, the real-time trend report generated by the analyser layer

[0208] provides a comprehensive overview of the ongoing performance and behaviour of network functions. This report is designed to be displayed on the user interface

[0218] ,

[0098] The method further comprises, receiving, a request for forecasting trend data associated with the one or more NFs, at the user interface

[0218] , In an example, the user interface

[0218] enables users to input requests for specific actions, such as requesting forecasting trend data. The forecasting trend data involves analysing past and current network data to predict future behaviours and trends.

[0099] Further, the method comprises sending, the request to the training layer

[0212] , wherein the training layer

[0212] further processes the request to generate a forecasting trend data; transmitting, the generated forecasting trend data, by the training layer

[0212] to the analyser layer

[0208] and generating, a forecasting trend report based on the generated forecasting trend data, by the analyser layer

[0208] , to be displayed at the user interface

[0218] , In an example, the training layer

[0212] processes requests for forecasting trend data. It utilizes historical and current network data to generate predictions about future trends. The analyser layer

[0208] receives the forecasting trend data from the training layer

[0212] and generates a forecasting trend report. This report provides a detailed overview of the predicted future trends in network functions, based on the forecasting data generated by the training layer.

[0100] In an example, the user interface

[0218] enables users to input requests for specific actions, such as performing a root cause analysis. Before the training layer

[0212] transmits an identified anomaly to the analyser layer

[0208] , it ensures the anomaly is properly detected and prepared for further analysis.

[0101] In an example, the analyser layer

[0208] is responsible for conducting the root cause analysis based on the anomalies identified by the training layer

[0212] , It generates a detailed root cause analysis report that explains the origins of the identified issues. The analyser layer also handles requests received via the user interface

[0218] for performing root cause analysis. The root cause analysis report generated by the analyser layer

[0208] provides a comprehensive overview of the issues affecting network functions and their root causes. This report is intended to be displayed on the user interface

[0218] , giving users detailed insights into the nature and origins of network anomalies.

[0102] Thereafter, the method terminates at step 320.

[0103] Referring to FIG. 4, an exemplary architecture diagram of a system

[0400] for performing root cause analysis for one or more network nodes, in accordance with the exemplary embodiments of the present invention. The system

[0400] comprises data collector unit

[0202] , ingestion layer

[0204] , normalization layer

[0206] , analysis engine

[0406] , Artificial Intelligence (AI) / Machine Learning (ML)

[0222] , distributed data lake

[0404] and operation center

[0408] , Further, FIG. 4 is intended to be read in conjunction with the exemplary block diagram of a system

[0200] as shown in FIG. 2.

[0104] In a preferred embodiment, in the system

[0400] , the data collector unit

[0202] stores Clear codes data collected from different network nodes in the network. As shown in the FIG. 4, there may be multiple data collector unit

[0202] to collect network data from multiple network nodes or network functions (NF), like NF 1, NF2, NF3. The ingestion layer

[0204] receives the network data from the data collector Unit

[0202] and provides the same to the normalization layer

[0206] , Thenormalization layer

[0206] receives the network data from the ingestion layer

[0204] , it then pre- processes the network data based on predefined metadata and rules (fieldname and type), such that the network data may be ready to be stored in the distributed data lake

[0404] , In an example, the network data comprises one or more network codes comprising unique identifiers in a sequential string format received from the one or more NFs. The network data includes metrics such as traffic volumes, error rates and latency. In an implementation, the network data may represent Clear Codes values, which are configured for identifying different events during processing of any service request.

[0105] The distributed data lake

[0404] , is designed to store large volumes of diverse data types.

[0106] The AI / ML layer

[0402] is adapted to perform machine learning on the normalized network data, to identify the RCA factors or parameters from the normalized network data. In an implementation, the AI / ML layer

[0402] performs the same function as the training layer

[0212] as shown in FIG. 2.

[0107] The AI / ML layer

[0402] runs multiple Al or ML algorithms continuously to find any failure scenario and send data to the analysis engine

[0406] , In an implementation, the analysis engine

[0406] performs the same function as the analyser layer

[0208] as shown in FIG. 2. After feeding the Clear Codes to AI / ML algorithms, the AI / ML layer

[0402] has the capability to generate the root cause of network functions in case of any failure code it gets from the Clear Codes data. This way proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis.

[0108] The analysis engine

[0406] is further adapted to initiate the RCA operations based on the identified RCA factors or parameters. The RCA report is then transmitted by the analysis engine

[0406] to an operation center

[0408] for initiating appropriate actions. In an implementation, the analysis engine

[0406] performs the same function as the analyser layer

[0208] as shown in FIG. 2.

[0109] Referring to FIG. 5, which illustrates a flow diagram

[0500] of data storage and AI / ML fine tuning for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention. Further, FIG. 5 is intended to be read in conjunction with the exemplary block diagram of a system

[0200] as shown in FIG. 2 and the exemplary architecture diagram of a system

[0400] as shown in FIG. 4 The systems and flow diagrams as shown in FIG. 2 and FIG. 4 and FIG. 5 complement each other.

[0110] In the depicted system, the process begins with the Data Records

[0502] , which store raw network data from various Network Functions (NFs) forwarding the raw network data to the ingestion layer

[0204] , In an implementation, the network data may represent Clear Codes values, which are configured for identifying different events during processing of any service request. Clear codes are unique codes which describe valuable information of the state of the network function. Clear Codes contain description of all cause codes and event codes reported by different program blocks running on network elements. Clear Codes provide very useful information to analyse the exact root cause of any error in a network element. Apart from these, clear codes can also be used for identifying the key successful events during the execution of a process. The ingestion layer

[0204] is responsible for the initial processing of the incoming network data. This initial processing by the ingestion layer

[0204] involves compressing the raw network data. Once processed, the network data moves to the normalization layer

[0206] , The normalization layer

[0206] receives the network data, it then pre-processes the network data based on predefined metadata and rules (fieldname and type), by which it is transformed into a standardized format suitable for further analysis. Thereafter, the network data may be ready to be stored in the corresponding data sources, such as first database

[0216] and second database

[0214] ,[OHl] The normalized data is then stored in the Distributed Data Lake

[0404] , which is designed to store large volumes of diverse data types. For analytical purposes, the Artificial Intelligence (AI) / Machine Learning (ML)

[0222] retrieves the normalized data from the distributed data lake

[0404] , This AI / ML layer

[0402] employs advanced machine learning algorithms to analyse the data, identifying anomalies and generating forecasting trend data. In an implementation, the AI / ML layer

[0402] may be present in the training layer

[0212] as shown in FIG. 2. Multiple AI / ML algorithms are continuously run to find any failure scenario. After the Clear Codes are fed to the AI / ML layer

[0402] , the AI / ML algorithms generate the root cause of network functions in case of any failure code they get from the Clear Codes data. This way proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis. This process by which AI / ML layer

[0402] continuously analyses the network data is referred to as fine tuning of AI / ML algorithms to learn the deviations and trends in the network data. By continuously analyzing the network data, the AI / ML layer

[0402] self-trains its algorithms.

[0112] Referring to FIG. 6, which illustrates an exemplary flow diagram

[0600] of analyser layer usage for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention. Further, FIG. 6 is intended to be readin conjunction with the exemplary block diagram of a system

[0200] as shown in FIG. 2, the exemplary architecture diagram of a system

[0400] as shown in FIG. 4 and the exemplary flow diagram

[0500] as shown in FIG. 5. The systems and flow diagrams as shown in FIG. 2, FIG. 4, FIG. 5 and FIG. 6 complement each other.

[0113] The user interface

[0218] is designed to receive input from a user, such as requests for realtime trend data related to network functions. The real-time trend data provides insights into the current performance and behaviour of network functions. This data is continuously updated, allowing the user to monitor and analyse the network’ s status and trends as they occur in real-time.

[0114] The request from the user is forwarded to the analyser layer

[0208] that not only performs root cause analysis but also handles requests for real-time trend data. It retrieves normalized network data from the distributed file system

[0504] via a streaming engine

[0210] and generates reports that display ongoing trends and patterns, which are then sent to the user interface

[0218] for user viewing. The streaming engine

[0210] is the technology or platform that enables the continuous processing and delivery of data in real-time. The distributed file system

[0504] ensures data is stored across multiple nodes or servers. The streaming engine on receiving the normalized network data retrieval request from the analyser layer

[0208] , sends a request to collect data from distributed file system

[0504] , which then sends back the raw network data to the streaming engine

[0210] , which further forwards the raw network data to the analyser layer

[0208] , Further, in an implementation, a normalization layer

[0206] may be present to normalize the raw network data received from data collection unit

[0202] as shown in FIG.2, and then store the normalized network data in the distributed file system

[0504] and distributed data lake

[0404] ,

[0115] In an example, the real-time trend report generated by the analyser layer

[0208] provides a comprehensive overview of the ongoing performance and behaviour of network functions. This report is designed to be displayed on the user interface

[0218] , The user interface

[0218] enables the user to input requests for specific actions, such as requesting forecasting trend data. The forecasting trend data involves analysing past and current network data to predict future behaviours and trends.

[0116] In an exemplary scenario, a request from the user may be for a forecasting trend data. The AI / ML layer

[0402] processes requests for forecasting trend data. It utilizes historical and current network data to generate predictions about future trends. The analyser layer

[0208] receives the forecasting trend data from the AI / ML layer

[0402] and generates a forecasting trend report. Thisreport provides a detailed overview of the predicted future trends in network functions, based on the forecasting data generated by the training layer.

[0117] Further, the user interface

[0218] enables the user to input requests for specific actions, such as performing a root cause analysis. Before the AI / ML layer

[0402] transmits an identified anomaly to the analyser layer

[0208] , it ensures the anomaly is properly detected and prepared for further analysis, the analyser layer

[0208] is responsible for conducting the root cause analysis based on the anomalies identified by the AI / ML layer

[0402] , It generates a detailed root cause analysis report that explains the origins of the identified issues. The analyser layer

[0208] also handles requests received via the user interface

[0218] for performing root cause analysis. The user interface

[0218] initiates the process by sending a data request to the analyser layer

[0208] , Upon receiving the request, the analyser layer

[0208] communicates with the streaming engine

[0210] to fetch the required normalized network data from the distributed file system

[0504] , The streaming engine

[0210] continuously collects and transmits data from the distributed file system

[0504] to the analyser layer

[0208] , Once the analyser layer

[0208] retrieves the data, it processes the information to generate the requested reports or analyses. If the request involves detecting anomalies or forecasting trends, the analyser layer

[0208] may also engage with the AI / ML layer

[0402] , After processing, the analyser layer

[0208] sends the results back to the user interface

[0218] , This output can include detailed reports on root cause analysis, real-time trends, or predictive forecasts, which are then displayed to the user.

[0118] The root cause analysis report generated by the analyser layer

[0208] provides a comprehensive overview of the issues affecting network functions and their root causes. This report is intended to be displayed on the user interface

[0218] , giving users detailed insights into the nature and origins of network anomalies.

[0119] Referring to FIG. 7, which illustrates a system architecture

[0700] for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention. Further, FIG. 7 is intended to be read in conjunction with the exemplary block diagram of a system

[0200] as shown in FIG. 2, the exemplary architecture diagram of a system

[0400] as shown in FIG. 4 and the exemplary flow diagram

[0500] as shown in FIG. 5. The systems and flow diagrams as shown in FIG. 2, FIG. 4, FIG. 5 and FIG. 7 complement each other.

[0120] The data records

[0502] receive and store network data from multiple network functions (NFs). This network data includes unique identifiers, traffic volumes, error rates, and latencymetrics. Clear Codes within the data provide valuable information about the state of network functions. This collected data is then transmitted to the ingestion layer

[0204] , The ingestion layer

[0204] processes the received network data by compressing it and transmitting it to the normalization layer

[0206] using File Transfer Protocol (FTP). This layer ensures that the data is prepared for further processing.

[0121] The normalization layer

[0206] converts the processed network data into a normalized format, eliminating differences and inconsistencies. This standardized data is then stored in either the distributed data lake

[0404] or the distributed file system

[0504] , The distributed file system

[0504] is designed to store large volumes of diverse data types. In an implementation, the distributed data lake

[0404] is same as the first database

[0216] and distributed file system

[0504] is same as second database

[0214] as shown in FIG. 2. The AI / ML layer

[0402] retrieves normalized network data from the distributed data lake

[0404] , It employs machine learning techniques, specifically a decision tree model, to analyse this data and identify anomalies. These anomalies indicate unexpected or irregular events in network functions, such as high error rates, latency variations, or unauthorized access attempts. Upon identifying an anomaly, the AI / ML layer

[0402] sends this information to the analyser layer

[0208] , The AI / ML layer

[0402] runs multiple Artificial Intelligence (AI) / Machine Learning (ML) algorithms continuously to find any failure scenario and send data to the analyser layer

[0208] , After feeding the Clear Codes to AI / ML algorithms, the AI / ML layer

[0402] has the capability to generate the root cause of network functions in case of any failure code it gets from the Clear Codes data. This way proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis.

[0122] The analyser layer

[0208] performs root cause analysis based on the identified anomalies. It generates detailed reports explaining the origins of the issues and displays these reports on the user interface

[0218] , Additionally, the analyser layer

[0208] handles real-time trend data requests by retrieving normalized network data via the streaming engine

[0210] from the distributed file system

[0504] and generating real-time trend reports for user display. The user interface

[0218] allows users to request real-time trend data and forecasting trend data. The real-time trend data provides current insights into network performance, such as traffic volumes and error rates. The forecasting trend data, generated by the AI / ML layer

[0402] , predicts future network behaviours and trends based on historical data. The user interface

[0218] also displays root cause analysis reports generated by the analyser layer

[0208] ,

[0123] The streaming engine

[0210] facilitates real-time data processing by continuously collecting and transmitting data from the distributed file system

[0504] to the analyser layer

[0208] , This enables the analyser layer

[0208] to access up-to-date data without batch processing, allowing for timely analysis and reporting.

[0124] The present disclosure further discloses a non-transitory computer readable storage medium storing instruction for performing root cause analysis for one or more network functions (NFs), the instructions include executable code which, when executed by one or more units of a system

[0200] , causes a data collector unit

[0202] to receive a network data from one or more NFs. Further, the instructions include executable code which, when executed causes the data collector unit

[0202] to transmit the network data to an ingestion layer

[0204] , Further, the instructions include executable code which, when executed causes the ingestion layer

[0204] to process the network data, and send, to a normalization layer

[0206] , the processed network data. Further, the instructions include executable code which, when executed causes the normalization layer

[0206] to convert the processed network data to a normalized network data and store, the normalized network data to at least one of a first database

[0216] and a second database

[0214] , Further, the instructions include executable code which, when executed causes a training layer

[0212] to retrieve the normalized network data from the at least one of the first database

[0216] and the second database

[0214] , identify, an anomaly associated with the one or more NFs based on the normalized network data and transmit, the anomaly to an analyser layer

[0208] to perform a root cause analysis.

[0125] As is evident from the above, the present disclosure provides a technically advanced solution for performing root cause analysis for one or more network nodes. The present disclosure provides the method and system which performs network root cause analysis with Clear codes using AI / ML layer

[0402] or the training layer

[0212] , The Clear codes for success and failure call for every interface (for e.g., 5G Nodes) are stored with meaning full string characters, which are understandable to a user. The Clear codes have its defined dictionary to understand the meaning of each value inside it. After feeding this dictionary to AI / ML layer

[0402] based technique, it has the capability to generate the root cause factors of network functions in case of any failure code it gets from data. The present system and method are more efficient and fast to process the root cause analysis for determining the issues and errors in network and requires no manual efforts for analysis.

[0126] While considerable emphasis has been placed herein on the disclosed implementations, it will be appreciated that many implementations can be made and that many changes can be madeto the implementations without departing from the principles of the present disclosure. These and other changes in the implementations of the present disclosure will be apparent to those skilled in the art, whereby it is to be understood that the foregoing descriptive matter to be implemented is illustrative and non-limiting.

[0127] Further, in accordance with the present disclosure, it is to be acknowledged that the functionality described for the various components / units can be implemented interchangeably. While specific embodiments may disclose a particular functionality of these units for clarity, it is recognized that various configurations and combinations thereof are within the scope of the disclosure. The functionality of specific units as disclosed in the disclosure should not be construed as limiting the scope of the present disclosure. Consequently, alternative arrangements and substitutions of units, provided they achieve the intended functionality described herein, are considered to be encompassed within the scope of the present disclosure.

Claims

We Claim:

1. A method [300] for performing root cause analysis for one or more network functions (NFs), the method comprising: receiving, a network data from one or more NFs, by a data collector unit [202]; transmitting, the network data by the data collector unit [202] to an ingestion layer [204]; processing, the network data received from the one or more NFs, by the ingestion layer [204]; converting, the processed network data to a normalized network data, by a normalization layer [206]; storing, the normalized network data in at least one of a first database [216] and a second database [214], by the normalization layer [206]; retrieving, the normalized network data from the at least one of the first database [216] and the second database [214], by a training layer [212]; identifying, an anomaly associated with the one or more NFs, based on the normalized network data, by the training layer [212]; and transmitting, the identified anomaly, by the training layer [212] to an analyser layer [208], for performing, a root cause analysis based on the identified anomaly.

2. The method [300] as claimed in claim 1, wherein the network data comprises one or more network codes comprising unique identifiers in a sequential string format, received from the one or more NFs.

3. The method [300] as claimed in claim 1, wherein processing the network data received from the one or more NFs by the ingestion layer [204] comprises compressing the network data.

4. The method [300] as claimed in claim 1, wherein the first database [216] is a Distributed Data Lake.

5. The method [300] as claimed in claim 1, wherein the second database [214] is a Distributed File System.

6. The method [300] as claimed in claim 1, further comprising: receiving, a request for real time trend data associated with the one or more NFs at a user interface [218];sending, the request to the analyser layer [208], wherein, the analyser layer [208] further retrieves the normalised network data via a streaming engine [210] from the second database [214]; generating, a real-time trend report based on the retrieved normalised network data, to be displayed at the user interface [218],7. The method [300] as claimed in claim 6, further comprising: receiving, a request for forecasting trend data associated with the one or more NFs, at the user interface [218]; sending, the request to the training layer [212], wherein the training layer [212] further processes the request to generate a forecasting trend data;- transmitting, the generated forecasting trend data, by the training layer [212] to the analyser layer [208]; generating, a forecasting trend report based on the generated forecasting trend data, by the analyser layer [208], to be displayed at the user interface [218],8. The method [300] as claimed in claim 1, wherein the training layer [212] is trained based on a decision tree model to identify an anomaly related to the one or more NFs.

9. The method [300] as claimed in claim 6, wherein prior to transmitting, by the training layer [212], the anomaly to an analyser layer [208] to perform a root cause analysis the method comprises: receiving, a request for performing root cause analysis at the user interface [218]; performing, the root cause analysis based on the anomaly, by the analyser layer [208]; and generating, a root cause analysis report based on performing the root cause analysis, by the analyser layer [208],10. The method [300] as claimed in claim 9, wherein post generating, the root cause analysis report, the method comprises: displaying, the root cause analysis report at the user interface [218],11. A system [200] for performing root cause analysis for one or more network functions (NFs), the system comprises: a data collector unit [202] configured to: o receive a network data from one or more NFs;o transmit the network data to an ingestion layer [204]; the ingestion layer [204] configured to: o process the network data, and o send, to a normalization layer [206], the processed network data; the normalization layer [206] configured to: o convert the processed network data to a normalized network data; o store, the normalized network data to at least one of a first database [216] and a second database [214]; and a training layer [212] configured to: o retrieve the normalized network data from the at least one of the first database [216] and the second database [214], o identify, an anomaly associated with the one or more NFs based on the normalized network data; o transmit, the anomaly to an analyser layer [208] to perform a root cause analysis.

12. The system [200] as claimed in claim 11, wherein the network data comprises one or more network codes comprising unique identifiers in a sequential string format received from the one or more NFs.

13. The system [200] as claimed in claim 11, wherein the ingestion layer [204] is configured to process the network data by compressing the network data received from the one or more NFs.

14. The system [200] as claimed in claim 11, wherein the first database [216] is a Distributed Data Lake.

15. The system [200] as claimed in claim 11, wherein the second database [214] is a Distributed File System.

16. The system [200] as claimed in claim 11, wherein the system further comprises: a user interface [218] configured to: o receive a request for real time trend data associated with the one or more NFs; o send, the request to the analyser layer [208]; the analyser layer [208] further configured to: o retrieve the normalised network data via a streaming engine [210] from the second database [214]; o generate, a real-time trend report to be displayed at the user interface [218],17. The system [200] as claimed in claim 16, wherein the system further comprises: the user interface [218] further configured to: o receive a request for a forecasting trend data associated with the one or more NFs; o send, the request to the training layer [212]; the training layer [212] further configured to process the request to generate a forecasting trend data; the analyser layer [208] further configured to: o receive the forecasting trend data from the training layer [212]; o generate, a forecasting trend report to be displayed at the user interface [218],18. The system [200] as claimed in claim 11, wherein the training layer [212] is trained based on a decision tree model to identify an anomaly related to the one or more NFs.

19. The system [200] as claimed in claim 16, wherein prior to transmitting, by the training layer [212], the anomaly to an analyser layer [208] to perform a root cause analysis, the system comprises: the user interface [218] configured to receive a request for performing root cause analysis; the analyser layer [208] configured to perform the root cause analysis based on the anomaly; the analyser layer [208] configured to generate a root cause analysis report based on performing the root cause analysis.

20. The system [200] as claimed in claim 19, wherein post generating, by the analyser layer [208], the root cause analysis report, the analyser layer [208] is configured to display the root cause analysis report at the user interface [218],21. A non-transitory computer readable storage medium storing instruction for performing root cause analysis for one or more network functions (NFs), the instructions include executable code which, when executed by one or more units of a system [200], causes: a data collector unit [202] to: o receive a network data from one or more NFs; o transmit the network data to an ingestion layer [204]; the ingestion layer [204] to: o process the network data, ando send, to a normalization layer [206], the processed network data; the normalization layer [206] to: o convert the processed network data to a normalized network data; o store, the normalized network data to at least one of a first database [216] and a second database [214]; and a training layer [212] to: o retrieve the normalized network data from the at least one of the first database [216] and the second database [214], o identify, an anomaly associated with the one or more NF s based on the normalized network data; o transmit, the anomaly to an analyser layer [208] to perform a root cause analysis.

Images