Technique for monitoring a wireless telecommunications infrastructure

Abstract

A technique for monitoring a wireless telecommunications infrastructure is described. As to a first method aspect of the technique, the method obtains a data set of at least one log file comprising at least two log entries, determines an index of a degree of anomaly for each of the at least two log entries or for each of the sequences of the log entries, and transmits a report indicative of those one or more log entries or sequences that are corresponding to the highest determined index to a central server. As to a second method aspect, a central server receives the report from an edge node for monitoring the wireless telecommunications infrastructure.

Description

[0001] Technique for monitoring a wireless telecommunications infrastructure

[0002] Technical Field

[0003] The present disclosure relates to a technique for monitoring a wireless telecommunications infrastructure. More specifically, and without limitation, methods and devices are provided for shared monitoring of a wireless telecommunications infrastructure at an edge node and a central server.

[0004] Background

[0005] In the context of the digital transformation and the transition to Industry 4.0, connectivity is increasing, as well as the amount of data generated and the resulting huge data flows. This leads to challenges in the design of telecommunication networks for low latency (e.g., especially ultra-reliable low latency communication, URLLC) and careful use of resources. The physical distance between a central server and the user equipment imposes unavoidable latency, therefore there is a need to reduce the physical distance for regular computation and communication as much as possible.

[0006] As a result, edge computing - i.e. decentralized computing - has emerged as a way to increase efficiency. Instead of using a centralized data center to store or compute data for applications on the network, mobile edge computing uses resources close to the end user equipment.

[0007] One example of edge computing includes edge analytics performed by an Internet of Things (loT) gateway, e.g. remote to field devices, for processing sensor data from that field devices, which is also referred to as field edge aggregation or fog computing. The edge analytics software is typically deployed on an loT gateway and processes the sensor data from multiple field units, for example, on a factory floor or in a building with multiple actuators or machines or other on-premises data sources.

[0008] The fifth generation (5G) radio access technology is the next generation distributed or cellular network that aspires to achieve substantial improvement on quality of service, such as higher throughput and lower latency. Edge computing is an emerging technology that enables the evolution to 5G by bringing cloud capabilities near to the end users (or user equipment, UEs). They are both poised to significantly improve the performance of applications and enable huge amounts of data to be processed in real-time. 5G increases speeds by up to ten times that of 4G, whereas mobile edge computing reduces latency by bringing compute capabilities into the network, closer to the end user. To achieve URLLC, necessary for further out use cases like autonomous drones or remote surgery, the combination of 5G and edge computing will be necessary. This means both a bigger, faster pipe in conjunction with a shorter distance for the data to travel.

[0009] Edge computing can enable operators to change their backhaul business models. For data-heavy applications, such as those requiring high-definition video or extensive data analysis, even with 5G, sending data constantly back to the cloud will be expensive and deteriorate the customer experience. Instead, data could be filtered out, with the full stream travelling only as far as a local edge site, before being analyzed, rationalized, and only what is necessary streamed and stored in the centralized cloud. If operators decouple access and backhaul connectivity pricing, offering reduced backhaul for streaming to the edge rather than the centralized cloud, they can incentivize application developers to use edge computing sites, rather than on-premises or on-device workarounds.

[0010] The emerging 5G mobile networking promises ultrahigh network bandwidth and ultra-low communication latency, e.g., less than one millisecond, benefiting a wide range of applications, including live video streaming, online gaming, virtual and augmented reality, and Vehicle-to-X, to name but a few. The backbone Internet, however, does not keep up, particularly in latency of more than hundred millisecond, due to its store-and-forward design and the physical barrier from signal propagation speed, not to mention congestion that frequently happens. Caching is known to be effective to bridge the speed gap, which has become a critical component in the 5G deployment as well. Besides storage, 5G base stations (BSs) will also be powered with strong computing modules, offering mobile edge computing (MEC) capability.

[0011] Maintaining the quality and security of the network is a key point for wireless telecommunications and edge services. Therefore, the network has to be constantly monitored. However, comprehensively monitoring and effectively controlling the network needs to be done at a central server, which has the drawback of latency due to the physical distance of the central server to the RAN and UEs and implies large data transfer to the central server to be processed. In particular, centralized processing of large control data can thwart timely countermeasures or reduce their effectiveness due to insufficient analysis of the control data.

[0012] Summary

[0013] Accordingly, there is a need for a technique for a dynamic wireless telecommunication infrastructure that can achieve the comprehensive monitoring and effective control without thwarting timely countermeasures or reducing their effectiveness.

[0014] As to a first method aspect, a method of monitoring a wireless telecommunications infrastructure is provided. The method comprises the step of obtaining a data set of at least one log file comprising at least two log entries of the wireless telecommunications infrastructure. The method further comprises the step of determining an index for each of the log entries of the at least one log file or for each of at least two sequences of the log entries. The index is indicative of a degree of anomaly in the wireless telecommunications infrastructure. The method further comprises the step of transmitting a report to a central server. The transmitted report is indicative of those one or more log entries or sequences that are corresponding to the highest determined index.

[0015] By determining the index for each of the log entries of the at least one log file or for each of the at least two sequences of the log entries and transmitting the report indicative of selected log entries or sequences of the log entries corresponding to the highest determined index, the data transmission to the central server can be significantly reduced. For example, due to the determining of the index for each of the at least two sequences of the log entries, embodiments of the method can enable the central server to monitor if an entry is missing or delayed in those indicated one or more sequences and / or can inform the central server that a log entry is missing or delayed in the those indicated one or more sequences.

[0016] Therefore, embodiments of the method can enable the central server to use less processing and computing power to monitor the wireless telecommunications infrastructure with synergistic effect of lowering the latency. In addition, the method enables the central server to comprehensively monitor the wireless telecommunications infrastructure in real time by receiving a reduced report on important preprocessed log entries (e.g., one or more incomplete sequences of log entries) and / or preprocessed log files (e.g., one or more incomplete log files) from components of the wireless telecommunications infrastructure according to the degree of the anomaly of the wireless telecommunications infrastructure determined for said log entries or sequences.

[0017] By virtue of determining the index, embodiments of the method can prioritize the one or more log entries of the log file(s) and / or the one or more sequences of the log entries transmitted to the central server out of the one or more log files. Thus, embodiments of the method can reduce the signaling on a link between a radio access network (RAN) of the wireless telecommunications infrastructure and the central server, e.g. at a core network (CN) of the wireless telecommunications infrastructure, such as an SI interface or a next generation (NG) interface. Furthermore, by reporting selectively on those one or more log entries of the at least one log file or on those one or more log sequences of log entries critical for the operation of the wireless telecommunications infrastructure according to the determined index, a processing capacity of the central server can be utilized more effectively, e.g. in a systematic search for the source of the anomaly and a corresponding action to overcome the anomaly.

[0018] Same or further embodiments can focus the reporting to the central server to time critical log entries of the at least one log file according to the index so that the central server is more rapidly notified of a time-critical anomaly. Furthermore, by focusing the reporting on those log entries of the at least one log file and / or the at least one log file indexed highest as to the degree of the anomaly for the wireless telecommunications infrastructure, an absence or delay of an expected event can be timely reported. Moreover, the method may comprise transmitting (i.e., reporting) not only express errors in the log entries of the at least one log file and / or the sequences of the log entries of the at least one log file and / or the at least one log file, but may, alternatively or additionally, indicate to the central server that an event in the wireless telecommunications infrastructure is outstanding or overdue. For example, a log entry (or other data) that is missing or delayed in one of the sequences may be detected, e.g. using a frequency analysis as further described below. The index of the respective sequence may be determined based on the frequency analysis of the log entries in the sequence.

[0019] The report may be indicative of (e.g., based on) those one or more log entries or sequences of the log entries that correspond to the highest index determined from the at least two log entries of the at least one log file and / or the sequences of the log entries, e.g. exclusively or only those one or more log entries that correspond to the highest index and / or those one or more sequences of the log entries that correspond to the highest index determined from the at least one log file. Alternatively or in addition, the report may be indicative of a proper subset of the log entries of the at least one log file. That is, the report may be indicative of less log entries than the log entries of the at least one obtained log file. For example, the report may be indicative of a predefined number or a predefined fraction of the at least two log entries of the at least one log file corresponding to the highest determined index or indices.

[0020] The log files may be obtained from radio devices accessing the wireless telecommunications infrastructure or from one or more access nodes providing wireless access in the wireless telecommunications infrastructure. Alternatively or in addition, the log files may be system files that keep a registry of events, processes, and / or messages that have happened within an operating system of the wireless telecommunications infrastructure.

[0021] The index may be a number (e.g., an integer and / or a non-zero value). Alternatively or in addition, the index may refer to a ranking or an order of the at least two log entries (or the at least two sequences of log entries) of the at least one log file based on a metric for the degree of anomaly in the wireless telecommunications infrastructure.

[0022] The anomaly may be a deviation from what is expected (e.g., predefined) in the wireless telecommunications infrastructure, e.g. a state or event (e.g. as recorded in one of the entries or in the absence of an entry) that deviates from a predefined pattern. Herein, the predefined pattern may comprise a trained or hard-coded pattern. Each sequence of log entries may correspond to one predefined pattern.

[0023] Optionally, a machine leaning (ML) system (e.g., implemented by the edge node) may extract the log entries from the obtained at least one log file and / or may determine the sequences of log entries from the at least one log file and / or may determine the indices. The ML system may comprise an LSTM-CRF system, which is a combination of long short-term memory (LSTM) and a conditional random field (CRF). The LSTM may be a type of RNN. The CRF may be a type of a probabilistic graphical model (PGM). LSTM-CRF system may be used to capture both the sequential and the structural aspects of events recorded by the log entries, which may have variable lengths. The LSTM-CRF system may be used for extracting the log entries from the log files and / or for the determining of the index and / or for determining the sequences as a set of related log entries. Alternatively or in addition, the ML system may comprise a transformer, which is an architecture (i.e., a type) of a neural network system that uses attention mechanisms to learn the dependencies between events represented by the log entries, optionally regardless of their position in the sequence. This architecture may be used to handle long-range dependencies and / or to parallelize a computation at the edge node.

[0024] The index may be indicative of the degree of the anomaly, i.e. an indication of the magnitude of the anomaly, e.g. a scale of the deviation (e.g., a time offset between an expected time and an actual time of an event represented by a delayed log entry or a time elapsed since the event is became due or outstanding). Alternatively or in addition, the index (i.e., the degree of anomaly) may be a scale of the amount of damage (e.g., an outage time and / or a number of radio device affected by the anomaly) on the wireless telecommunications infrastructure as a result of the anomaly.

[0025] Alternatively or in addition, the index may serve not just as a measurement of the current state of the anomaly but as an indicator of the potential consequences on the wireless telecommunications infrastructure in terms of disruption of services, collateral damage, and future risks. In other words, the index (i.e., the degree of anomaly) may be a degree of severity or limitation or risk for the operation of the wireless telecommunications infrastructure. For example, in addition to the operational impacts, the index might also reflect risk factors for the wireless telecommunications infrastructure. This could involve potential future anomalies or escalating the current anomaly, the probability of recurring issues, or the extent of vulnerabilities in the wireless telecommunications infrastructure. For instance, an anomaly that exposes a network vulnerability exploitable for future complications may be assigned a higher value of the index. The index may represent an advanced risk assessment and / or can enable proactive incident handling and network maintenance by the central server.

[0026] The method may be performed by an edge node, e.g. an access node, of the wireless telecommunications infrastructure. The central server may be a node not located at the edge node. Multiple edge nodes may report to the same central server. Alternatively or in addition, the central server may be a node configured for at least one of analysis, troubleshooting (e.g., controlling), and performance monitoring of the wireless telecommunications infrastructure. The central server may be outside of the wireless telecommunications infrastructure.

[0027] The obtained data set (e.g., according to the first method aspect) may comprise at least two log files. Optionally, each of the at least two sequences may correspond to one of the at least two log files.

[0028] Alternatively or in addition, the at least two sequences of the log entries may correspond to the two log files.

[0029] The transmitted report (e.g., according to the first method aspect) may include the one or more log entries of the at least one log file corresponding to the highest determined index and / or may include the one or more sequences of log entries corresponding to the highest determined index. Alternatively or in addition, the transmitted report may include a summary of the one or more log entries of the at least one log file corresponding to the highest determined index and / or may include a summary of the one or more sequences of log entries corresponding to the highest determined index. For example, the summary may be a classifier of the anomaly, e.g. the absence of an expected event in the respective sequence.

[0030] The report generated and transmitted to the central server may contain data from the one or more log entries of the at least one log file or log files that have the highest index from an array of the one or more log entries of the at least one log file.

[0031] Alternatively or in addition, the summary may comprise data aggregated based on the contents of the one or more log files or the sequences, e.g. by eliminating redundant data between different log files or sequences or by reporting only on a (e.g., log type) group of log entries of the at least one log file or sequences or by reporting the frequency of a log entry (e.g., content or log type) instead of repeating the content in different log entries or log files. Alternatively or in addition, the method may further comprise compressing the data of the one or more log entries of each of the at least one log file and / or the at least two log entries and / or each of the sequences before transmitting to the central server.

[0032] The wireless telecommunications infrastructure may be or may comprise a radio access network (RAN). Performing the selected subset of actions may mean that the parent process implements (e.g., configures) these actions within the wireless telecommunications infrastructure (e.g., in the RAN). The RAN may be a fourth generation (e.g., 4G LTE) RAN or a fifth generation (e.g., 5G NR) RAN.

[0033] The wireless telecommunications infrastructure may be referred to as network. The network may be a cellular network or any kind of telecommunications network where the link to and from end nodes is wireless and the network is distributed over land areas.

[0034] The one or more log files may comprise historical record of status (e.g., a log entry indicative of a state or event) of the wireless telecommunications infrastructure (e.g., network). The log files may comprise one or more types of data, e.g. from different components in the network (which may generate different types of data and / or record different types of data). The contents and / or structure of the log files may reflect or correspond to the types of data.

[0035] A first example of the data type (e.g., log entry type) may comprise an "Event Log". The Event Log may comprise a high-level log that records information about network traffic and usage, such as login attempts, failed password attempts, and application events. A second example of the data type may comprise a "Server Log". The Server Log may comprise a text document containing a record of activities related to a specific server in a specific period of time. A third example of the data type may comprise a "System Log" (abbreviated: syslog). The syslog may comprise a record of events or messages from an operating system of a component of the wireless telecommunications infrastructure and / or from a layer of a radio communication protocol. The syslog may include at least one of: startup messages, system changes, unexpected shutdowns, errors, and warnings. An operating system of the wireless telecommunications infrastructure (e.g., of a component of the wireless telecommunications infrastructure such as a base station) may generate one or more syslogs. A fourth example of the data type may comprise an "Authorization Log" and / or "Access Log". These logs may comprise a list of people or bots accessing certain applications or files. A "Change Logs" may comprise a chronological list of changes made to a configuration of the wireless telecommunications infrastructure (e.g., a base station configuration), an application and / or file. An "Availability Logs" may comprise track system performance, uptime, and availability. A "Resource Logs" may comprise information about connectivity issues and capacity limits. A "Threat Logs" may comprise information about system, file, or application traffic that matches a predefined security profile within a firewall. The log files may comprise one or more variety of contents.

[0036] The log files may comprise health messages (e.g., periodic heart beat messages), e.g., as log entries, that do not indicate a warning or error on the network. The index determined for a log file comprising a health message may be a first index. The index determined for a log file comprising a warning message may be a second index that is greater than the first index. The index determined for a log file comprising an error message may be a third index that is greater than the first index and / or the second index.

[0037] The anomalies may be inappropriate network behavior, such as unauthorized applications or unusual port usage by a known program; data exfiltration, such as a suspiciously large amount of data being transferred; hidden threats, such as advanced malware; point anomalies, where a single data point deviates from the expected pattern, range, or norm; collective anomalies, where individual data points appear normal when viewed in isolation; and contextual anomalies. Network anomalies may also be (e.g., temporal) irregularities in data transmission or log file transmission.

[0038] The index may be determined for at least one or each log entry in each of the obtained at least one log file. Furthermore, the index may be determined for a type of one or more log entries instead of an individual log entry, for example, an anomaly in health messages may be a missing health message in the expected sequence of log entries.

[0039] The index may be a number from 1 to 10 or from 1 to 100. For example, the higher the determined number is, the more likely the respective log file or the log entry or the sequence is caused by an anomaly or the higher is the risk of a service interruption in the wireless telecommunications infrastructure. The index may be indicative of a severity of the respective log file or entry or sequence (e.g. of an event or state indicated by the respective entry or log file). The index, as an indication of a degree of anomaly, may also be referred to as a severity number (e.g., severity degree).

[0040] The central server may be located anywhere in the wireless telecommunications infrastructure, for example in the network node, core node, central cloud, etc.

[0041] The log files (e.g., according to the first method aspect) may be obtained from at least one of a user equipment (UE) or a plurality of UEs served by the wireless telecommunications infrastructure; and a network node of the wireless telecommunications infrastructure providing wireless access.

[0042] The log files may be obtained from (e.g., provided by) any component of the network such as applications, containers, databases, firewalls, endpoints, internet of things (loT) devices, networks, servers, web servers, etc.

[0043] The user equipment (UE) may be a radio device wirelessly connected to the RAN. The network node may be a base station of the RAN.

[0044] The method (e.g., according to the first method aspect) may further comprise the step of storing the log files in a data structure according to the determined index.

[0045] The method may further comprise storing (e.g., saving or recording) the at least one obtained log file in a data base, e.g., for further processing, sorting, etc. Alternatively or in addition, the method may further comprise sorting the at least one log file according to the index, optionally in descending order (e.g., in a list). In other words the obtained log files may be sorted and saved in a different data structure as they have been obtained. Alternatively or in addition, the at least two log entries of the at least one log file may be maintained as nodes (and leaves) of a binary tree, wherein the tree is ordered according to the index. The highest index may correspond to the root of the ordered tree. Alternatively or in addition, a corresponding list or tree may be used for storing and / or sorting the sequences or the log files. The method may comprise selectively transmitting the one or more log entries of the at least one log file from the sorted list or ordered tree of the at least one log file according to the index. For example, the method may comprise transmitting a first number of the log entries (e.g., a few) from the top of the list sorted in descending order or the ordered tree.

[0046] The at least one log file (or one or more log entries therein) may be stored and used later for further processing (e.g., for detecting an irregularity indicative of the anomaly).

[0047] Each of the log entries of the at least one log file (e.g., according to the first method aspect) may comprise at least one of: a log line, a paragraph (e.g., wherein the paragraph comprises two or more detailed log entries or two or more log lines), and a line of a binary truth table of at least two log entries.

[0048] The paragraph may comprise two or more log entries according to a pattern and / or according to a data type and / or according to a sequence pattern.

[0049] The binary truth table may be defined as a table containing Os and Is according to an absence and existence of at least two log entries, respectively. The binary truth table may be used for an efficient frequency mining that may be used for anomaly detection in the wireless telecommunications infrastructure and / or for determining the index of any one of the sequences.

[0050] The method (e.g., according to the first method aspect) may further comprise the step of processing the at least one obtained log file. Alternatively or in addition, the processing may comprise at least one of: splitting text from the at least one log file into the log entries; assigning timestamps to each of the log entries; and removing variable parts from the text of the at least one log file.

[0051] The processing (e.g., an analysis) may be performed at a level of the log lines. The at least one log file (e.g., in which all logging events are recorded) may be processed (e.g., pre-processed) and / or broken down into log lines. The at least one log file may comprise a variety of log lines, e.g. health log lines, warning log lines, and / or error log lines. Optionally, the log lines may comprise a further variety of the health log lines and / or a further variety of the warning log lines and / or a further variety of the error log lines. The further variety may relate to different sources of the log lines or different locations of logged events (e.g. at the UE or at the network node).

[0052] In the processing (e.g., pre-processing) step, the at least one log file may be split into log lines. The timestamps of each of the log lines may be kept. Optionally, e.g. in case there is no specific timestamp included in a log line, the timestamp of the log file may be assigned to the log line. Optionally in case there is no specific timestamp included in a line, the method may (e.g., in the processing) check the whole corresponding log file for a timestamp and assign to each log line a timestamp, e.g., by keeping the chronological order. Alternatively or in addition, in the processing step, the log lines may be cleaned from variable parts by removing the variable parts. This step can simplify the log lines or the at least one log file, and / or reduce the size of the log lines or the at least one log file in the transmission, and / or ensure data privacy, and / or make lines or the at least one log file homogenous, e.g., for statistics across different nodes of the network or for grouping the log entries (e.g., log lines) of the at least one log file or log files or sequences based on keywords.

[0053] The variable parts may comprise IP addresses and / or identifiers (IDs), e.g., of the network nodes or the UEs. Alternatively or in addition, the variable parts may comprise any data that is not indicative of a specific error, e.g., not indicative of an error type or error cause, or warnings which do not contain information for detecting anomalies in network.

[0054] The processing (e.g., the assigning of the timestamps) may be implemented using a pipeline. The pipeline may determine a time (e.g., timestamp) when the log lines (e.g., log entries) were logged. The pipeline may determine the time when something was logged and / or the structure of the log lines that are obtained from a particular component of the wireless telecommunications infrastructure, e.g. the data type and / or the variety and / or the further variety.

[0055] Alternatively or in addition, the processing may be performed using an artificial intelligence model, e.g., a machine learning (ML) model. The method may comprise a step of training the ML model. The ML model may be trained to detect the structure of the log entries (e.g., log lines) that are in the at least one log file of a particular component of the wireless telecommunications infrastructure. The training step may comprise creating a vocabulary of words that occur frequently in the at least one log file, so that the ML models (e.g., algorithms) later have a fixed vocabulary of words to work with (e.g., to use for the processing). For example, the text in the at least one log file may be subject to word embedding. Word vectors resulting from the word embedding may be grouped in a predefined number of clusters, e.g. using k-means clustering. Each cluster may correspond to an expected word in the vocabulary. The vocabulary may be referred to as an expected vocabulary.

[0056] The training (e.g., the creating the vocabulary of words) and / or the processing (e.g., the splitting and / or grouping) may be performed for each of the data types and / or for each of the varieties of log lines (e.g., log entries) and / or for each of the further varieties (e.g., as mentioned above).

[0057] During the processing step, unknown words (i.e. words that are not in the vocabulary) in the log lines or the at least one log file may be replaced by a placeholder. That is, the placeholder may be indicative of a word that is not in the vocabulary or an unexpected word. The processing may relate to the at least one log file indicative of health messages (e.g., indicative of an operational status of the wireless telecommunications infrastructure).

[0058] A deficiency of the vocabulary (e.g., as measured by the number or frequency of placeholders) or a deviation of the words extracted from the vocabulary (e.g., as measured by a metric of the word vectors resulting from the word embedding) may be indicative of the degree of the anomaly. Alternatively or in addition, the absence of an expected word (e.g., a word in the vocabulary that is not in the at least one log file) may also be indicative of the degree of the anomaly. That is, any expected words and / or any log type (e.g., data log type, or briefly: data type) of log lines missing in the at least one log file may flagged to some degree the anomaly (e.g., the determined index). Herein, being indicative of the degree of the anomaly may be implemented as a contribution to the index (e.g., a weighted and / or linear term in the computation of the index) indicative of the degree of the anomaly.

[0059] Alternatively or in addition, the processing may comprise parsing the log lines, e.g. using one or more regular expressions (regex), an (e.g., English) dictionary, a parser-specific dictionary and a pattern of log types. The parsing may map each log line to one of the data types and / or to one of the varieties and / or to one of the further varieties. Alternatively or in addition, the parsing may comprise the removing of the variable parts (such as timestamps, numbers, IPs and IDs).

[0060] The method (e.g., according to the first method aspect) may further comprise the step of creating at least one log type based on the at least two log entries of the at least one log file. Alternatively or in addition, each of the at least one log type may comprise a log type group of at least one log entry in the at least one log file.

[0061] The created log types (briefly: types) may be specific for the log entries (e.g., log lines). That is, each log line may be associated to one (e.g., at most one) of the log types. Optionally, log entries (e.g., log lines) not associated to a log type may be excluded from the determining of the index. Alternatively or in addition, log entries (e.g., log lines) not associated to a log type may be flagged as to some degree of anomaly (e.g., a high degree of anomaly because they are highly unusual). The method may classify log entries (e.g., log lines) according to at least one characteristic of the respective log entry (e.g. log line) and create an associated log type and / or include the respective log entry (e.g., log line) in the created log type (i.e., in a group of log lines associated to the created log type).

[0062] The log type may be equal to, or a (e.g., logical) combination of, the data type and / or the varieties and / or the further varieties mentioned above and / or the words of the created vocabulary and / or the clusters of the embedding vectors. For example, one log type may comprise all the log entries (e.g., log lines) that are indicative of a warning for a missing data transmission at a UE. This example may be a logical combination of the variety "warning log lines" and the data type "syslog" (e.g., as the missing data transmission is a message from a radio protocol layer) and the further variety "UE" as the event occurred at a UE.

[0063] Alternatively or in addition, those log entries (e.g., log lines) that are similar or equal after the removing of the variable parts may define one log type and / or may be included in one log type group.

[0064] The step of creating the at least one log type may use a log type mapper. The log type mapper may group the log entries (e.g., log lines) into log types (e.g., based on content similarity), i.e. into the respective log type groups (briefly: group). In other words, the creating of the at least one log type may be implemented as classifying log entries (e.g., log lines) into log types (i.e., in groups associated with the log types). For example, the log entries (e.g., log lines) may be grouped using a clustering algorithm, e.g., according to a ML model such as k-means clustering, and / or based on a frequency of occurrence of the log entry (e.g., log line) and / or based on word embedding or sentence embedding of the log line. Such groups may be examples of the sequences. The frequency associated with the respective sequence may imply when the next occurrence of a log entry is expected, which may be used for determining the index of said sequence when the expected log entry is missing or delayed.

[0065] Alternatively or in addition, the method may determine an index for each of the at least one log type. The index may be indicative of a degree of anomaly in the wireless telecommunications infrastructure for the respective log type. For example an isolated log entry (e.g., log line) may be considered normal while a sequence of the same or equivalent log entry may be flagged as a degree of anomaly in the wireless telecommunications infrastructure. For example, the index may correspond to a number of the occurrences of the equivalent log entry.

[0066] By virtue of the created (e.g., log line-associated) log types (e.g., the created vocabulary), the method can highlight individual log entries (e.g., log lines) that may be normal when the wireless telecommunications infrastructure (e.g., network system) is running as expected. Alternatively or in addition, the created log types may contain valuable information in the event of failure. In this way, the transmitted reports may support (e.g., trigger) at least one of predictive maintenance and troubleshooting.

[0067] Alternatively or in addition, the determining of the index may comprise determining the index for each of the at least two log entries of the at least one log file, and / or for each of the log entries (e.g., those log lines to which a log type is associated) and / or for each of the at least one log type (e.g., for each group of the log type mapper). Alternatively or in addition, the method may comprise sorting, according to the determined index, the at least one log file and / or the at least one log type and / or the log entries (e.g., log lines).

[0068] The transmitted report to the central server may be indicative and / or comprising the at least one log entry and / or the at least one log type and / or the at least one log file. For example, the transmitted report may be indicative and / or comprising (e.g., only) those log entries and / or log types and / or log files that correspond to the highest determined index.

[0069] Since the use of words in the data set creates a large feature space for the clustering (e.g., based on the word embedding or the vocabulary), a performance of the clustering could be low as the distance between each point and all other points (i.e., all pairs of points representing the words, e.g., embedding vectors) may be calculated. To improve performance, the clustering may be adapted to only calculate the distance to other log entries (e.g., log lines) that are similar in length to the log entries (e.g., log line) currently under consideration. This means that only log entries (e.g., log lines) of similar length may be neighbors, which not only may save resources, but also makes sense for the underlying problem of creating log types from log entries (e.g., log lines) created by the same logging method or logging source.

[0070] The clustering may be further adapted to have the ability to use labels with the clustering, e.g. to perform a semi-supervised clustering when labels are available. This clustering technique (e.g., a clustering algorithm) may be performed by predefining clusters with the labelled data (e.g., log lines associated to a log type according to the label) and then adding additional clusters found by the DBSCAN. In this way, already labelled data (e.g., log lines with predefined log types) may be taken into account, and / or not all data has to be labelled.

[0071] The method, optionally the determining of the index (e.g., according to the first method aspect), may further comprise the step of detecting the anomaly in the wireless telecommunications infrastructure based on the obtained data set. The anomaly may be detected based on one or at least two words in the at least one log file or in the at least two log entries of the at least one log file or in the at least one group (e.g., of at the least two log entries); an incident indicated by the at least one log file or by the at least two log entries or the at least one group (e.g., of at least one log entry or the at least two log entries); a frequency of log entries per log type group; and a temporal pattern of log entries associated to different log types.

[0072] The detecting of the anomaly according to at least two different bases (e.g., any of the above methods) may also be referred to as the at least two detecting methods. The detection based on one or more words may also be referred to as word-based anomaly detection. The detection based on an incident may be also referred to as incident-based anomaly detection.

[0073] The detection based on a frequency of log entries (e.g., log lines) may also be referred to as frequency-based anomaly detection, e.g. implemented by a (smart) frequency filter. The frequency-based anomaly detection may be based on detecting an irregularity or a change in the frequency of log entries (e.g., log lines) associated to the same log type. Herein, the "frequency" may be indicative of a number of occurrences of the log entries (e.g., log lines) per log type group within a time interval. Alternatively or in addition, the "frequency" may be indicative of whether the log entries (e.g., log lines) one of one log type occur periodically or a periodically.

[0074] A pattern anomaly detector may implement the detection based on the temporal pattern. For example, the pattern anomaly detection may be based on the temporal pattern of two log entries (e.g., log lines), for example two sequences of the log entries, having the log type "warning" followed by a log line having the log type "error".

[0075] The detecting step may be understood as analyzing the log entries (e.g., log lines) and / or the at least one log type and / or the at least one log file. E.g., as part of the pipeline, the at least two log entries (e.g., log lines) and / or the at least one log type and / or the at least one log file may be passed to the frequency-based anomaly detection (briefly: frequency detector) for the analysis. The frequency detector may comprise the smart frequency filter and / or the pattern anomaly detector.

[0076] The detecting step (e.g., the frequency-based anomaly detection) may further comprise clustering (i.e., frequency clustering) the log entries (e.g., log lines) (optionally within one log type group) according to their periodicity (e.g., time periods between subsequent occurrences of the log entries having the same log type) and / or may comprise determining the frequency with which a certain log type occurs. The anomaly may be detected if the frequency changes (e.g., by a predefined percentage or frequency margin).

[0077] The detecting step may use density-based spatial cluster of application with noise (DBSCAN), e.g., for the frequency clustering. The DBSCAN may use a density-based clustering algorithm. The anomaly may be detected as an outlier identified by the DBSCAN.

[0078] The frequency-based or incident-based anomaly detection may work by looking at the number of occurrences of a log type over a period of time. A formula may then be applied to translate the occurrences into the index (e.g., as a severity score).

[0079] Different scenarios may be possible depending on the use case, for example, if the use case is associated with continuous integration pipelines and subsequent analysis, the index (e.g., severity score) may depend on the number of test cases in which the log type occurs. The index (e.g., severity score) may be weighted with a parameter depending on whether the use case failed or not. Therefore, if a log type appears in successful pipeline runs, the index (e.g., severity score) will be lower than if it only appears in failed pipeline runs. The calculation can be done, for example, using the following equation: in wherein fsuceSsfuiand ff ailedarethe percentages of runs, the log type appears in for failed and for successful. So for example,

[0080] „ > tsucessful runs the log type appeared in

[0081] J sucessful total number of sucessful runs ’ and the same goes for ffauea- Furthermore, p and X may be parameters that may be used to adapt the formula to the respective data. The index may also be referred to as severity.

[0082] Different algorithms may be used for word-based anomaly detection, such as a neural network that considers the context of the log entries (e.g., log lines), and / or a tree-based model and / or any other machine learning algorithm. These models may be used in the same way as other language models and may predict the probability of a word being the next word in a text context. If the probability is lower than a threshold, it may be interpreted as an anomaly. The algorithm may be trained with data from a stable wireless telecommunications infrastructure (e.g., network system) so that they may identify anomalies in the event of failure or deviation from the stable network system.

[0083] The method may be used to determine the index for log (i.e., log file and / or log entries (e.g., log lines)) the ML model was not trained for or that were not available prior to deployment.

[0084] Further methods such as, searching for specific keywords, may be used to adjust the index (e.g., as a severity score) described herein. This method can have the advantage that no labelled data is required, as is the case with other language models. However, not every log entries (e.g., log line) containing such a word contains relevant information. This may be because some errors or warning messages that appear repeatedly are normal and do not cause the system to fail. Therefore, this type of content-based analysis may not be the sole indicator of severity (e.g., index).

[0085] The frequency-based anomaly detection, may only consider the time of occurrence within a log type. The time distance between log entries (e.g., log lines) of the same log type may be calculated and then clustered. A density-based clustering algorithm with adapted distance calculation may be used. The distance metric may be defined by the following formula: wherein x and y are the two points from which the distance may be calculated. With this formula, the distance within a cluster may be very small if the cluster contains logs with very short time intervals, and may be larger if the logs within the cluster have long time intervals. A time difference of one minute may be long if the logs usually appear with a time difference of one minute, but it may not be long if the logs usually appear with a time difference of one hour.

[0086] If a pattern may be found for a log type, the severity score (e.g., index) of that log type may be ranked lower because log entries (e.g., log lines) indicating an error don't appear regularly over time. Alternatively or in addition, if a single log entry (e.g., log line) is an outlier for that pattern, its index (e.g., severity score) may be ranked higher. In this way, individual log entries (e.g., log lines) may be classified as anomalous, even though the group of that log type may not be normally an anomaly.

[0087] To decide whether a log type may be suitable for frequency analysis, the clusters need to be analyzed. The clusters with few outliers compared to the clustered data .rmeant cluster points) . . . points and with a high value for - are suitable. Not standard_deviation(cluster_points) many outliers in the training data, may refer to a common logarithmic type with not many biases, and the formula may help to decide whether the data points within a cluster are far apart or close together.

[0088] The clustering algorithm may group similar log entries (e.g., log lines) into one log type, and word-based anomaly detection may rank them in a different severity score, but both strategies may assign severity score (e.g., index) to a group of log entries (e.g., log lines), whereas frequency analysis may rank (e.g., determine an index for) log entries (e.g., log lines) within a log type differently.

[0089] The method may compare the log entries (e.g., log lines) and / or log types and / or log files with at least one of the previously obtained anomaly patterns. The patterns may be sequential information.

[0090] Alternatively or additionally, the method may detect the anomalous events in sequence, for example by using a negative sampling algorithm to automatically generate potentially anomalous sequences, so that a binary classification model may be trained through the observed normal samples and the generated anomalous samples. Alternatively or in addition, the method may use a similarity clustering model (e.g., method) to detect anomalous user behavior. The similarity clustering model may comprise four components: data log collector, data log analyzer, profile storage and behavior detector. In this model, the user behavior patterns may be clustered based on their similarity. When the similarity distance may exceed the over threshold, i.e. the observed behavior may be significantly different from the profile, the observed behavior may be identified as an anomaly.

[0091] Alternatively, or in addition, the method may use some machine learning (ML) models that learn the possible anomalies in a real-time streaming processing manner. By assigning a dynamic pairwise transition rate to each template pair and modelling the transition probability as a typical power-law distribution, this approach achieves real-time model building and updating. The ML models may be trained and anomaly detection may be performed in real time without any restrictions or assumptions on system log data.

[0092] Alternatively, or in addition, the method may monitor and classify at least one log file and / or at least one log type and / or log entries (e.g., log lines) (e.g. log records) based on sliding time windows and a time-varying evolving fuzzy rule-based classification model. The most frequent log pattern according to a control chart may be taken as the normal system state.

[0093] The method may use different anomaly detection methods and / or algorithms in parallel. The method may combine (e.g., dynamically combine, according to the network condition) different approaches to detect anomalies in the network.

[0094] The detecting of the anomaly (e.g., according to the first method aspect) may comprise combining at least two detecting methods. Alternatively or in addition, the determined index may be a function of results of the at least two detecting methods.

[0095] Alternatively, or in addition, the method can learn how to combine the existing methods to achieve the best results, for example learning a dynamic weighted linear combination of different methods. For example, some anomalies in the network may be more severe according to some anomaly detection methods. In other words the function may be predefined function, for example a linear function according to the effects of the detecting methods, and / or a weighted combination of the detecting method, which weights may be dynamically adjusted in training step.

[0096] The method may determine the index based on the result of anomaly detection step, for example based on one or more above mentioned anomaly detection methods. Alternatively or in addition, the method may determine the index based on the maximum anomaly degree (e.g., rank) according to the detecting methods. Alternatively or in addition, the method may determine the index based on the combined function of the at least two methods.

[0097] At least one or each of the steps of the method (e.g., according to the first method aspect) may be performed using a machine learning system. The ML system may also be referred to as artificial intelligence (Al) system or Al agent. The at least one steps or part of the steps of the method may be performed according to a ML algorithm. The ML system may comprise at least one neural network. For example, the creating of the log type or the assigning of one of the log types to each of the log entries (e.g., log lines) may be performed by a ML system comprising a encoder coupled to an input layer of the neural network and comprising an decoder coupled to an output layer of the neural network and outputting the log type.

[0098] The method (e.g., according to the first method aspect) may further comprise the step of receiving a request message from the central server. The request message may be indicative of requesting further log files or log entries to be transmitted.

[0099] The method (e.g., according to the first method aspect) may be performed by an edge node of the wireless telecommunications infrastructure.

[0100] The method may be performed by the edge node and / or the closest part of the network to the UE which has a capacity of processing data. The edge node may not transmit (e.g., forward) all of the obtained data set to the central server. In this way the data transmission traffic between the central server and the user equipment is minimized to the essential data for monitoring. In other words, most of the monitoring process may be performed by the edge node that is physically closer to the user equipment.

[0101] The edge node may transmit more (e.g., additional or further) data (e.g., log files and / or log types and / or log lines) upon receiving request from the central server. For example, the edge node may send the next few log files from the sorted list and / or send the log files comprising a condition (e.g., containing a specific error and / or warning).

[0102] The first method aspect may be performed by the edge node of the following second method aspect.

[0103] As to a second method aspect, a method of monitoring (e.g., controlling) a wireless telecommunications infrastructure is provided. The method comprises the step of receiving a report from an edge node of the wireless telecommunications infrastructure. The received report is indicative of one or more log entries or sequences of the log entries that are corresponding to a highest index out of at least two log entries of the at least one log file obtained at the edge node. The index is indicative of a degree of anomaly in the wireless telecommunications infrastructure.

[0104] The central server may receive the report transmitted by the edge node for monitoring (e.g., controlling) the wireless telecommunications infrastructure. The central server may request more data (e.g., log entries and / or log types and / or log files) for further controlling (e.g., investigation) and / or troubleshooting.

[0105] The received reports may be used for monitoring (e.g., controlling) the wireless telecommunications infrastructure in real-time. Alternatively or in addition, the monitoring may comprise predictive maintenance. The predictive maintenance may involve the detection of the anomalies before a system failure or error of the wireless telecommunications infrastructure occurs.

[0106] The method (e.g., according to the second method aspect) may further comprise the step of transmitting a request message to the edge node. The request message may be indicative of requesting further log entries or sequences of the log entries to be received from the edge node.

[0107] The method (e.g., according to the second method aspect) may further comprise the step of troubleshooting the wireless telecommunications infrastructures according to the received report and / or the received further log entries or sequences of the log entries.

[0108] The troubleshooting may be triggered by the index and / or a certain amount of anomalies in the wireless telecommunications infrastructure and / or certain types of anomalies. Herein, the step of troubleshooting may be a step of controlling the wireless telecommunications infrastructure (e.g., by transmitting control messages to network nodes that change a configuration of the network nodes) in order to mitigate the anomaly.

[0109] The method (e.g., according to the second method aspect) may be performed by a central server of the wireless telecommunications infrastructure, e.g. the central server mentioned in the context of the first method aspect. The central server may transmit the request message to the edge node for receiving more log files and / or log types and / or log entries for troubleshooting and / or further investigations. Alternatively or in addition, the request message may be indicative of requesting the further log entries or the sequence of log entries to be transmitted to the central server.

[0110] As to another device aspect, a computer program product is provided. The computer program product comprises program code portions for performing any one of the steps of the first method aspect when the computer program product is executed on one or more computing devices, optionally stored on a computer- readable recording medium.

[0111] The computer program product may be part of the edge node (e.g., an edge server).

[0112] As to a first device aspect, a node for monitoring a wireless telecommunications infrastructure is provided. The node comprising memory operable to store instructions and processing circuitry operable to execute the instructions, such that the node is operable to obtain a data set of at least one log file comprising at least two log entries of the wireless telecommunications infrastructure. The node is further operable to determine an index for each of the log entries of the at least one log file or for each of at least two sequences of the log entries. The index is indicative of a degree of anomaly in the wireless telecommunications infrastructure. The node is further operable to transmit a report to a central server. The transmitted report is indicative of those one or more log entries or sequences of the log entries that are corresponding to the highest determined index.

[0113] The node may be a network node, and / or a base station and / or a core node supporting a radio access network (RAN) in a wireless telecommunications infrastructure embodying the computer program product. The node may be further referred to an edge node (e.g., edge server).

[0114] The node (e.g., according to the first device aspect) may be further operable to perform any one of the steps of the first method aspect. As to another device aspect a node for monitoring a wireless telecommunications infrastructure (e.g., a node controlling or supporting a radio access network, RAN, in a wireless telecommunications infrastructure) is provided. The node is configured to obtain a data set of at least one log file comprising at least two log entries of the wireless telecommunications infrastructure. The node is further configured to determine an index for each of the log entries of the at least one log file or for each of at least two sequences of the log entries. The index is indicative of a degree of anomaly in the wireless telecommunications infrastructure. The node is further configured to transmit a report to a central server. The transmitted report is indicative of those one or more log entries or sequences of the log entries that are corresponding to the highest determined index.

[0115] The node (e.g., according to the other first device aspect) may be further configured to perform any one of the steps of the first method aspect.

[0116] The node (e.g., performing the first method aspect and / or according to the first device aspect or the other first device aspect) may be a core node of a core network (CN) of the wireless telecommunications infrastructure. Alternatively or in addition, the node may be a network node of a radio access network (RAN) of the wireless telecommunications infrastructure, optionally a base station or a central unit (CU) of the base station.

[0117] As to a second device aspect, a central server for monitoring a wireless telecommunications infrastructure is provided. The central server comprises memory operable to store instructions and processing circuitry operable to execute the instructions, such that the central server is operable to receiving a report from an edge node of the wireless telecommunications infrastructure. The received report is indicative of one or more log entries or sequences of the log entries that are corresponding to a highest index out of at least two log entries of the at least one log file obtained at the edge node. The index is indicative of a degree of anomaly in the wireless telecommunications infrastructure.

[0118] The central server (e.g., according to the second device aspect) may be further operable to perform any one of the steps of the second method aspect.

[0119] As to another second device, aspect a central server for monitoring a wireless telecommunications infrastructure is provided. The central server is configured to receive a report from an edge node of the wireless telecommunications infrastructure. The received report is indicative of one or more log entries or sequences of the log entries that are corresponding to a highest index out of at least two log entries of the at least one log file obtained at the edge node. The index is indicative of a degree of anomaly in the wireless telecommunications infrastructure.

[0120] The central server (e.g., according to another second device aspect) may be further configured to perform any one of the steps of the second method aspect.

[0121] The central server may be a computer program product comprising a program code portions for performing any one of the steps of the second method aspect. Alternatively or in addition, the central server may be part of a cloud. Alternatively or in addition, the computer program product for performing any one of the steps of the second method aspect may be part of a core node and / or a part of a remote network node with respect to the user equipment.

[0122] As to a system aspect, a communication system is provided. The communication system comprises a node comprising processing circuitry configured to execute any one of the steps of the first method aspect. The communication system comprises a host computer comprising processing circuitry configured to execute any one of the steps of the second method aspect.

[0123] The communication system (e.g., according to the system aspect) may further include a UE (e.g., as an embodiment of the radio device). The UE may comprise a radio interface and processing circuitry. The processing circuitry of the UE may be configured for radio access to the wireless telecommunications infrastructure. The UE may be configured to provide at least one log file to the edge node.

[0124] The radio network (e.g., according to the system aspect) may further comprise a base station, or a radio device functioning as a gateway, which is configured to communicate with the UE and / or configured to provide at least log file to the edge node.

[0125] The processing circuitry of the host computer (e.g., according to the system aspect) may be configured to execute a host application, thereby providing the user data. A processing circuitry of the UE may be configured to execute a client application associated with the host application.

[0126] The wireless telecommunications infrastructure (e.g., the radio network according to the system aspect) may comprise one or more nodes (e.g., network nodes or base stations) configured to execute any one of the steps of the first method aspect.

[0127] The radio network (e.g., in the communication system according to the system aspect) may further comprise a base station, or a radio device functioning as a gateway, which is configured to communicate with the UE and / or configured to execute any one of the steps of the first method aspect.

[0128] The processing circuitry of the host computer (e.g., according to the system aspect) may be configured to execute a host application, thereby providing the user data. The processing circuitry of the UE may be configured to execute a client application associated with the host application.

[0129] The edge node and / or the central server may comprise a network data analytics function (NWDAF).

[0130] Without limitation, for example in a 3GPP implementation, the user equipment (UE) may be any radio device configured for radio access to the wireless telecommunications infrastructure, e.g., according to a 3GPP specification.

[0131] The technique may be applied in the context of 3GPP New Radio (NR), e.g. as a fifth generation radio access technology of the wireless telecommunications infrastructure.

[0132] The technique may be implemented in accordance with a 3GPP specification, e.g., for 3GPP release 17 or 18 or later. The technique may be implemented for 3GPP LTE or 3GPP NR. The edge node or any other aspect of the invention may be implemented using or extending any 3GPP specification, e.g. at least one of 3GPP documents TS 23.558, version 18.3.0; TS 23.548, version 18.2.0; and 3GPP TS 23.288, version 18.2.0. The wireless telecommunications infrastructure (e.g., the RAN) may comprise one or more base stations, e.g., performing the first method aspect.

[0133] Any of the radio devices may be a 3GPP user equipment (UE) or a Wi-Fi station (STA). The radio device may be a mobile or portable station, a device for machinetype communication (MTC), a device for narrowband Internet of Things (NB-loT) or a combination thereof. Examples for the UE and the mobile station include a mobile phone, a tablet computer and a self-driving vehicle. Examples for the portable station include a laptop computer and a television set. Examples for the MTC device or the NB-loT device include robots, sensors and / or actuators, e.g., in manufacturing, automotive communication and home automation. The MTC device or the NB-loT device may be implemented in a manufacturing plant, household appliances and consumer electronics.

[0134] The wireless telecommunications infrastructure (e.g., the RAN) may be implemented by one or more base stations. The base station may encompass any station that is configured to provide radio access to any of the radio devices (UEs). The base stations may also be referred to as cell, transmission and reception point (TRP), radio access node or access point (AP). The base station and / or the relay radio device may provide a data link to a host computer providing the user data to the remote radio device or gathering user data from the remote radio device. Examples for the base stations may include a 3G base station or Node B, 4G base station or eNodeB, a 5G base station or gNodeB, a Wi-Fi AP and a network controller (e.g., according to Bluetooth, ZigBee or Z-Wave).

[0135] The RAN may be implemented according to the Global System for Mobile Communications (GSM), the Universal Mobile Telecommunications System (UMTS), 3GPP Long Term Evolution (LTE) and / or 3GPP New Radio (NR).

[0136] Brief Description of the Drawings

[0137] Further details of embodiments of the technique are described with reference to the enclosed drawings, wherein:

[0138] Fig. 1 shows a schematic block diagram of a first embodiment of a first device for monitoring a wireless telecommunication infrastructure; Fig. 2 shows a schematic block diagram of a first embodiment of a second device for monitoring a wireless telecommunication infrastructure;

[0139] Fig. 3 shows a flowchart for a first embodiment of a method for monitoring a wireless telecommunication infrastructure;

[0140] Fig. 4 shows a flowchart for a first embodiment of a method for monitoring a wireless telecommunication infrastructure;

[0141] Fig. 5A shows a schematic diagram of monitoring a wireless telecommunication infrastructure according to the prior art;

[0142] Fig. 5B shows a schematic diagram of a communication system including an embodiment of the devices of Fig. 1 and Fig. 2, which can include the features and steps of the methods of Fig. 3 and Fig. 4;

[0143] Fig. 6 shows a schematic diagram of a communication system including an embodiment of the devices of Fig. 1 and Fig. 2, which can include the features and steps of the methods of Fig. 3 and Fig. 4;

[0144] Fig. 7 shows a schematic block diagram of a second implementation of few steps of the method of Fig. 3 in any embodiment of the device of Fig. 1;

[0145] Fig. 8 shows an exemplary schematic diagram of a second implementation of one of the steps of the method of Fig. 3;

[0146] Fig. 9 shows an exemplary schematic diagram of a third implementation of one of the steps of the method of Fig. 3;

[0147] Fig. 10 shows another schematic diagram of a communication system including an embodiment of the devices of Fig. 1 and Fig. 2, which may include features and perform steps of the methods of Fig. 3 and Fig. 4;

[0148] Fig. 11 shows a schematic block diagram of a network node embodying the device of Fig. 1; Fig. 12 shows a schematic block diagram of a core node embodying the device of Fig. 1;

[0149] Fig. 13 schematically illustrates an example telecommunication network connected via an intermediate network to a host computer;

[0150] Fig. 14 shows a generalized block diagram of a host computer communicating via a base station or radio device functioning as a gateway with a user equipment over a partially wireless connection; and

[0151] Figs. 15 and 16 show flowcharts for methods implemented in a communication system including a host computer, a base station or radio device functioning as a gateway and a user equipment.

[0152] Detailed Description

[0153] In the following description, for purposes of explanation and not limitation, specific details are set forth, such as a specific network environment in order to provide a thorough understanding of the technique disclosed herein. It will be apparent to one skilled in the art that the technique may be practiced in other embodiments that depart from these specific details. Moreover, while the following embodiments are primarily described for a New Radio (NR) or 5G implementation, it is readily apparent that the technique described herein may also be implemented for any other radio communication technique, including a Wireless Local Area Network (WLAN) implementation according to the standard family IEEE 802.11, 3GPP LTE (e.g., LTE-Advanced or a related radio access technique such as MulteFire), for Bluetooth according to the Bluetooth Special Interest Group (SIG), particularly Bluetooth Low Energy, Bluetooth Mesh Networking and Bluetooth broadcasting, for Z-Wave according to the Z-Wave Alliance or for ZigBee based on IEEE 802.15.4.

[0154] Moreover, those skilled in the art will appreciate that the functions, steps, units and modules explained herein may be implemented using software functioning in conjunction with a programmed microprocessor, an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), a Digital Signal Processor (DSP) or a general purpose computer, e.g., including an Advanced RISC Machine (ARM). It will also be appreciated that, while the following embodiments are primarily described in context with methods and devices, the invention may also be embodied in a computer program product as well as in a system comprising at least one computer processor and memory coupled to the at least one processor, wherein the memory is encoded with one or more programs that may perform the functions and steps or implement the units and modules disclosed herein.

[0155] Fig. 1 schematically illustrates a block diagram of an embodiment of a device for monitoring a wireless telecommunication infrastructure (e.g., network and / or network system). The device is generally referred to by the reference sign 100. The device 100 may be further referred to as or embodied by an edge node and / or an access node and / or an edge server.

[0156] The device 100 may comprise a receiving module 102. The receiving module 102 may obtain (e.g., receive) a data set of at least one log file comprising at least two log entries, e.g. from one or more radio devices and / or one or more access nodes of the wireless telecommunication infrastructure. The receiving module 102 may further receive messages and / or reports from a central server 300.

[0157] The device 100 may further comprise a processing module 112. The processing module 112 may process (e.g., pre-proses) 206 the obtained 202 at least one log file, and / or save (e.g., store) 204 the at least one log file, and / or compress the at least one log file, and / or determine 212 an index for each of the at least two log entries of the at least one log file, and / or detect 210 an anomaly based on the obtained 202 at least one log file, and / or sort the at least one log file, optionally according to the determined 212 index.

[0158] The processing module 112 may further process the at least one log file and extract the log entries (e.g., log lines) and log types from the at least one log file, optionally from all the obtained 202 log files. The processing module 112 may determine 212 an index for each of the log entries (e.g., log lines) of the at least one log file or for each of the at least two sequences of the log entries and / or the log types. The processing module 112 may further sort the log entries (e.g., log lines) and / or the log types according to the determined 212 index.

[0159] The device 100 may further comprise a transmitting module 114. The transmitting module 114 may transmit a report to the central server 300. The transmitted report may be indicative of those one or more log entries (e.g., log lines) or sequences of the log entries and / or at least one log types and / or at least one log files of the at least one log file that are corresponding to the highest determined 212 index.

[0160] Alternatively or in addition, the transmitting module 114 may transmit further reports in response to the received message from the central server 300. The report may be indicative of the further one or more log entries (e.g., log lines) and / or at least one log types and / or at least one log files according to the determined 212 index.

[0161] The processing module 112 is in communication with the receiving module 102 and the transmitting module 114.

[0162] The device 100 may be implemented in a node of the wireless telecommunications infrastructure. The node and the components of the wireless telecommunications infrastructure may be monitored. The node may be a network node and / or core node of a wireless telecommunication infrastructure.

[0163] Fig. 2 schematically illustrates a block diagram of an embodiment of a device of monitoring (e.g., controlling or troubleshooting) a wireless telecommunication infrastructure. The device is generally referred to by the reference sign 300. The device 300 may be referred to as or embodied by a central server 300, e.g. the one mentioned in the context of the device 100.

[0164] The device 300 comprises a receiving module 314. The receiving module 314 receives the report (e.g., the at least one log entry and / or the at least one log file and / or a further requested at least one log file, or portions thereof) from the device 100. Noteworthy, the receiving module 314 may receive log entries (e.g., log lines) and / or log types (e.g., in the report).

[0165] The device 300 optionally further comprises a processing module 318. The processing module 318 may process the received 414 report and / or the at least one log file and / or log entries (e.g., lines) and / or log types. The processing module 318 may monitor the wireless telecommunication infrastructure, e.g. based on the received 414 report and / or the at least one log file and / or the log types and / or the log entries (e.g., lines). The processing module 318 may perform troubleshooting 418 and / or debugging, e.g., based on the received report. The device 300 may further comprise a transmitting module 316. The transmitting module may transmit (e.g., send) a message to the device 100. The message may be indicative of request for further information, e.g., further at least one log file (or their contents) or a further report indicative of further at least one log file (or their contents). The further information may be further log entries (e.g., log lines) and / or log types. The device 300 may need the further information for troubleshooting 418 and, therefore, may transmit 416 a message indicative of a request to the device 100, accordingly.

[0166] The processing module 318 may be in communication with the receiving module 314 and the transmitting module 316.

[0167] The device 300 may be implemented in a node of the wireless telecommunications infrastructure. The node and the components of the wireless telecommunications infrastructure may be monitored. The node may be a network node and / or core node of a wireless telecommunication infrastructure. The device 300 may be a central server located within a core node and / or may be part of a central cloud.

[0168] Fig. 3 shows an example flowchart of a method 200 of monitoring a wireless telecommunication infrastructure. The method may be performed by the device 100.

[0169] In a step 202, the method 200 may obtain 202 a data set of at least one log file comprising at least two log entries of the wireless telecommunications infrastructure. The step 202 may be performed by the receiving module 102 of the device 100.

[0170] The log entries of the at least one log file may comprise at least one of a log line; a paragraph, wherein the paragraph comprises two or more log entries or log lines; and a line of a binary truth table of at least two log entries.

[0171] Optionally, in step 204, the method 200 may store the obtained 202 at least one log file. Alternatively or in addition, the method 200 may store the at least one log file and / or the at least one log type and / or the log entries (e.g., log lines) in a data structure, optionally according to the determined 212 index. The step 204 may be performed by the processing module 112 of the device 100. Optional ly, in a step 206, the method 200 may process the at least one obtained 202 log file. The processing 206 may comprise at least one of splitting text from the at least one log file into log entries (e.g., log lines); assigning timestamps to each of the log entries (e.g., log lines); and removing variable parts from the text of the at least one log file, optionally from the text of each of the log entries (e.g., log lines). The step 206 may be performed by the processing module 112 of the device 100.

[0172] Optionally, in step 208, the method 200 may create at least one log type (e.g., a log type group) of at least one log entry (e.g., log line) based on the at least one log file. Alternatively or in addition, each of the at least one log type comprises a log type group of at least one log entry (e.g., log line) in the at least one log file. The at least one type of at least one log file may comprise at least one log entry (e.g., log line). The log type may comprise one or more log entries (e.g., log lines), wherein each of the variable parts of the log entries (e.g., log lines) has been removed. The one or more log entries (e.g., log lines) of the log type may have at least one similar characteristics with the other log entries (e.g., log lines) within the log type. The step 208 may be performed by the processing module 112 of the device 100.

[0173] Optionally, in step 210, the method 200 may detect 210 the anomaly in the wireless telecommunications infrastructure based on the obtained 202 data set. The anomaly may be detected based on at least two of words in the at least one log file or in the at least two log entries (e.g., log lines) of the at least one log file or in the at least one group of at least one log entry (e.g., log line); an incident indicated by the at least one log file or by the log entries (e.g., log lines) or the at least one group of at least one log entry (e.g., log line); a frequency of log entries (e.g., log lines) per log type group; and a temporal pattern of log entries (e.g., log lines) associated to different log types. The step 210 may be performed by the processing module 112 of the device 100.

[0174] In step 212, the method 200 may determine an index for each of the log entries of the at least one log file or for each of at least two sequences of the log entries. The index may be indicative of a degree of anomaly in the wireless telecommunications infrastructure. The detected 210 anomaly in the wireless telecommunications infrastructure may be used to determine 212 the index. The index may be indicative of a degree of anomaly in the wireless telecommunications infrastructure. The method 200 may determine an index for each of the log types and / or the log entries (e.g., log lines). The step 212 may be performed by the processing module 112 of the device 100.

[0175] The detecting 210 of the anomaly may comprise combining at least two detecting 210 methods. Alternatively or in addition, the determined 212 index may be a function of results of the at least two detecting 210 methods.

[0176] In step 214, the method 200 may transmit a report to a central server 300. The transmitted 214 report may be indicative of those one or more log entries or sequences (e.g., of log entries) that are corresponding to the highest determined 212 index. The report may be indicative of the result of previous steps of the method 200. The step 214 may be performed by the transmitting module 114 of the device 100.

[0177] Alternatively or in addition, the transmitted 214 report may include the one or more log entries of the at least one log file corresponding to the highest determined 212 index. Alternatively or in addition, the transmitted 214 report may include a summary of the one or more log entries of the at least one log file corresponding to the highest determined 212 index.

[0178] Optionally, in step 216, the method 200 may receive message from the central server 300. The message may be indicative of requesting further information (e.g., at least one log file and / or at least one log type and / or log entries (e.g., log lines)) to be transmitted 214. The step 216 may be performed by the receiving module 102 of the device 100.

[0179] Optionally in step 204, the method may store 204 the outcome of the process step 206 and / or the created 208 log types and / or the determined 210 indices. The method 200 may further store 204 the reports transmitted 214 to the central server 500 and / or the messages received 216 from the central server 300.

[0180] The method 200 may further use a hierarchical architecture, optionally in step 206 and step 210. For example, a degree of anomaly may be detected by one method of the step 210 and the result may be further fed to another method of the step 210 for anomaly detection. The method 200 may use a parallel architecture, optionally in step 206 and step 210. For example, at least one log file may be fed into two or more different methods of the step 210 in parallel for anomaly detection 210.

[0181] The fast and efficient anomaly detection 210 by the edge node 100, may increase the reliability of the communication system 500 and leads to prevent failure and / or detect any outside threats to the wireless communication system 500, such as shell clients and or malwares.

[0182] Fig. 4 shows an example flowchart of a method 400 of monitoring of a wireless telecommunication infrastructure. The method 400 may be performed by a central server 300.

[0183] In step 414, the method 400 receiving 414 a report, from the device 100. The received report may be indicative of one or more log entries or sequences (e.g., of the log entries) that are corresponding to the highest determined 212 index out of at least two log entries. The index may be indicative of a degree of anomaly in the wireless telecommunications infrastructure. The step 414 may be performed by the receiving module 314 of the device 300.

[0184] Optionally, in a step 416, the method 400 may transmit 416 a message (e.g., request message) to the device 100. The message may be indicative of requesting further log entries (e.g., log lines) or sequences (e.g., of the log entries) to be received 414 from the edge node 100. The message may be further indicative of requesting further log files and / or the log types from the edge node 100. The step 416 may be performed by the transmitting module 316 of the device 300.

[0185] Optionally, in step 418, the method 400 may troubleshoot the wireless telecommunications infrastructures according to the received 414 report and / or the received 414 further log entries and / or sequences of the log entries and / or the log files and / or the log types. The step 418 may be performed by the processing module 318 of the device 300. The method 400 may further store the received reports and / or the outcome of troubleshooting and monitoring.

[0186] Due to the complexity of the wireless telecommunication systems, the created logging data may be extensive, especially when these systems are becoming more widespread. Therefore, technologies like edge computing on the rise, and new processing strategies should be developed. The proposed method 200 may introduce a severity score (e.g., as the index) for each log entries (e.g., log line) and / or the at least one log file based on different criteria that represent the relevance of the log entry (e.g., log line). This way, in a normal state of the system, only log entries (e.g., log lines) may be transmitted 214 and stored in central server 300 that have a high severity score. In case of a failure and / or further investigation of a detected anomaly in the wireless telecommunications infrastructure, additional log entries (e.g., log lines) with lower determined 212 index may be requested from the edge node 100 for additional log analysis (e.g., monitoring and troubleshooting).

[0187] This is possible by first grouping the same log entries (e.g., log lines) into log types after some pre-processing 206 and then detecting 210 anomalies using a combination of several methodologies that consider the number of occurrences of a log type, the content, and the frequency. The method 200 may highlight specific log entries (e.g., log lines) that can be normal if the network system runs as expected but may also contain valuable information for a failure case. This way, the method 200 may support predictive maintenance as well as troubleshooting.

[0188] The method 200 enables data being preprocessed at the edge node 100, and an efficient, central data provision may be realized in the central server 300. For the decision about the relevance of the information, different criteria will be used, such that it is not only based on the appearance of certain words. Thereby a finer differentiation is possible, as well as a high efficiency for data transmitting and processing. Additionally, the differentiation without labeling the different kinds of log entries (e.g., log lines) as normal and abnormal is possible, which would bring a high amount of work with it. In other words, the method 200 enables monitoring the wireless telecommunication infrastructure without pre-training procedure and on-time learning procedure.

[0189] Fig. 5A shows a schematic diagram of the monitoring of a wireless telecommunication infrastructure according to the prior art. The monitoring and / or controlling of a wireless telecommunications infrastructure system 50 is done by a central server 30, for example a central cloud server 30. The central server 30 may receive the log files from all the components of the wireless telecommunications infrastructure, such as user equipment, for central analysis and provision. This consumes a huge amount of computing power, in addition to the massive data transfer between the user equipment and the central server 30. Moreover, the long physical distance between the user equipment and the central server 30 imposes a long latency, which is undesirable.

[0190] Fig. 5B shows a communication system 500 comprising a cloud edge device 100 (e.g. network node) according to Fig. 1 for performing method 200 and a central server 300 according to Fig. 2 for performing method 400.

[0191] In the context of the digital transformation and the transition to Industry 4.0, the connectivity is increasing, as is the amount of data generated and the resulting data flow. This leads to challenges in the design of telecommunication networks for low latency and careful use of resources.

[0192] One approach to improving efficiency is the edge computing - decentralized computing (e.g., data processing). With mobile edge computing (e.g., by cloud edge server 100), instead of using a centralized data center (e.g., central cloud server 300) for storage or computation for applications in the network, resources close to the end user are used, as showed in Fig. 5B.

[0193] This enables lower latency, efficient use of available resources, and a reduced network load. A typical network performance monitoring and troubleshooting process comprises problem identification, root cause analysis, and problem resolution.

[0194] To monitor of the wireless telecommunications infrastructure system 500 (shortly system) and in the event of a failure, it may be important to provide information about the state of the system and any conspicuous events. One source of data for this purpose may be the at least one log file, which contain information about the systems 500 and the applications. To minimize data transfer, only relevant information may be sent to the central cloud server 300. Since the at least one log file contain a lot of noise (health messages, normal status reports, irrelevant warnings, etc.), a technique (e.g., an algorithm) the method 200 enables to extract relevant information, compress it and transfer it to the central cloud server 300.

[0195] There are many methods proposed in the prior art, for example, one method is based on matching the incoming at least one log file with a known pattern. If the system is based on patterns or sequential information, it would alert system administrators when a new incoming log matches one of the previously obtained abnormal patterns. This method builds a detection model based on sequential information by preserving the log embedding. This is done using various anomaly detection algorithms for Linux environments. This method has some limitations, such as, the detected patterns are only those that are predefined and known by the domain experts. This means that the patterns also differ from product to product or company to company, and new patterns cannot be handled. The method is therefore not robust.

[0196] Another prior art method would be the InterpretableSAD algorithm, which uses a negative sampling algorithm to automatically generate potentially anomalous sequences so that it can be trained by a binary classification model using the observed normal samples and the generated anomalous samples. This method has limitations as binary classification is not a real case example, not everything can be categorized as anomalous or not anomalous, but rather with a rating for the event. Furthermore, the anomalous patterns are only generated, which means that the cases are known to the domain user and the new cases are not handled.

[0197] Another prior art method would be an anomalous user behavior detection model based on similarity clustering. The model consists of four components: a data log collector, a data log analyzer, a profile store and a behavior detector. In this method, the user behavior patterns are clustered based on their similarity. If the similarity distance exceeds the over threshold, i.e. the observed behavior differs significantly from the profile, the observed behavior is identified as an anomaly. This method has some drawbacks in that the tests are not performed on live / online systems and it has not yet been tested on sequential user behavior.

[0198] Another prior art method is a method that trains and detects anomalies in a realtime streaming processing manner. By assigning a dynamic pairwise transition rate to each template pair and modelling the transition probability as a typical powerlaw distribution, this approach achieves real-time model construction and updating. Its models are trained and anomaly detection is performed in real time without any restrictions or assumptions on system log data. This means that this method is based on message data and does not cover the frequency of a log, which is a feature that should be analyzed when diagnosing system logs. Another method proposed in the prior art is a real-time approach to monitoring and classifying log records based on sliding time windows and a time-varying evolving fuzzy rule-based classification model. The most frequent log pattern according to a control chart is taken as the normal system state. Similar to the previous method, only the log message is analyzed, even though they occupy different time windows, without considering the actual time stamp.

[0199] Software methods (e.g. solutions) according to the state of the art make it possible to request and analyses data, e.g. at least one log file. These in particular generate a large amount of complex data which must be searched for errors. This results in a large data transfer and a high effort for data analysis in case of errors.

[0200] Existing solutions mainly focus on the content of at least one log file or analyze log sequences. Anomaly detection can be done with different approaches to get the best result, so it can be beneficial to combine different approaches. Also, anomaly detection focuses on finding anomalies in the existing data, the approaches do not focus on the anomaly and that data is missing. The only case where this plays a role is in profile matching, which is not done at the log level. Another missing aspect is the analysis of time patterns. An anomaly can also mean that the time at which data is collected is anomalous.

[0201] Fig. 6 shows a communication system 500 comprising a cloud edge device 100 (e.g. network node) according to Fig. 1 for performing method 200 and a central server 300 according to Fig. 2 for performing method 400.

[0202] For high performance data handling, the data analysis may take place at the edge device 100 to extract data and provide centrally (e.g. to the central server 300) the necessary information about the processes for efficient monitoring as well as fast fault resolution. In this way, central monitoring by the central server 300 and rapid fault analysis (e.g. anomaly detection) by the edge device 100 may be realized. This method may be understood as a middle way between sending all data to a central server 300, which means that a lot of data has to be transferred and analyzed, and not sending any data and having to get it, if possible, in case of a failure (e.g. anomaly detection), which slows down the troubleshooting and does not support predictive maintenance at all. The edge server 100 and the central server 300 may communicate with each other, e.g. the central server 300 may receive report indicative of the at least one log entry of the at least one log file corresponding to the highest determined 212 index from the edge server 100 and send a request for more information (e.g. more log entries and / or sequences) to the edge server 100.

[0203] The data and at least one log file may be collected, processed and analyzed at the edge 100 and may be compressed there and transmit selectively (e.g. based on the highest index) to the central server 300. Thus, the amount of data transmission between the edge 100 and the central server 300 may be significantly reduced.

[0204] Optionally, the method 200 may be a pure software method and may be easily integrated into a single pod or container in the target edge server 100 (e.g., a network system component). Since it requires only one pod or container, it may provide easier deployment on the edge server 100. The edge server 100 may also be where all the analysis of the data takes place. The analysis, may be, for example, the training and detection (e.g., prediction) using an ML algorithm. The at least one log file may be collected in the edge server 100 and processed in a pipeline.

[0205] The ML model may be created during the training process. During this step, the model may be trained on partial data to understand the patterns and the relationship between the input and output parameters. For example, in this step it may learn the relationship between log types and severity based on words, occurrence and frequency. The log types may be similar log entries (e.g., log lines) grouped into one type. Then (e.g. after the training step), all the data may be fed into the created (e.g. ML) model and may be used to detect the anomalies in the at least one new log file, (i.e., predict new or unseen at least one log file).

[0206] After the prediction is made, the partial logs, the log entries and / or sequences corresponding to the highest determined 212 index, may be transmitted 214 to the central server 300 for monitoring. If more information is needed for troubleshooting by the central server 300, a request may be made (e.g., via transmitting a message) to the edge server 100 and more data may be received (e.g., retrieved). Fig. 7 shows a schematic block diagram of some exemplary steps of a first implementation of the method 200.

[0207] Optionally, in step 206 of the method 200, the edge server 100 may perform log file processing 206 (also referred to as preprocessing). The processing 206 may comprise splitting text from the at least one log file into log entries (e.g., log lines), and / or assigning timestamps to each of the log entries (e.g., log lines) (e.g., the occurred events of the logs), and / or removing variable parts of the at least one log file (e.g. text).

[0208] The edge node 100 may perform the analysis on the log entry (e.g., log line) level, therefore, the at least one log file may be preprocessed 206 and split into log entries (e.g., log lines). Alternatively or in addition, the pipeline may determine the time when something was logged (e.g., determine the timestamps) and it may learn the structure of the log entries (e.g., log lines) during training step. It may further learn the log entries (e.g., log lines) that have in a specific system component.

[0209] Alternatively or in addition, in step 206 the method 200 may parse text (e.g., log lines) based on, for example, a regular expression (regex), an English dictionary, a parser-specific dictionary, and a log types. This step may be especially important because it may remove variable parts like timestamps, numbers, IPs, and IDs. According to an exemplary embodiment of step 206, the method 200, in the training step may create a fixed vocabulary of words based on the often appearance of some words in the at least one log file and the algorithm may work with it. Alternatively or in addition, the unknown words may be replaced by a placeholder that signifies out of vocabulary.

[0210] Optionally, in step 208 of the method 200, the edge server 100 may perform a log type creation 208. Log type creation 208 may be understood as grouping log entries (e.g., log lines) into log types according to at least one similarity (e.g. the same log with different variable parts).

[0211] In this step 208, a log type mapper may group the log entries (e.g., log lines) into the log types based on content similarity, e.g., using a clustering algorithm. In this step the log types may comprise same logs (e.g., content wise) with different variable parts. Then the log entries (e.g., log lines) and / or log types and / or the at least one log file may be fed into, for example, a frequency detector algorithm 210 for further analysis. The frequency detector algorithm 210 may comprise two main subdivisions, smart frequency filter and pattern anomaly detector. This step 210 may help with the analysis of the log types, clustering of the log entries (e.g., log lines) for different timespans, and finding the frequencies that certain log types appear with.

[0212] A density-based spatial clustering of applications with noise (DBSCAN) may be used for step 208 and / or step 210. Using words of log data creates a large feature space for the clustering, which may reduce the performance of the algorithm as the distance of each point to all the other points would be calculated. To avoid this, the algorithm may be configured to only calculate the distance to other log entries (e.g., log lines) that are similar in length to the log entry (e.g., log line) currently being considered. This not only conserves resources, but also makes sense for the underlying problem of creating log types from log entries (e.g., log lines) that were created by the same logging method. The second adaptation of the algorithm may be the ability to use labels with the clustering, making it a semi-supervised approach if labels are available. This may be done by predefining clusters with the labelled data and then adding additional clusters found by the original DBSCAN algorithm. This way, already labelled data may be taken into account, but not all data needs to be labelled.

[0213] Optionally, in step 210 of the method 200, the edge server 100 may perform an anomaly detection 210. The anomaly detection 210 may comprise one or more methods that operate in parallel with each other and / or in a hierarchical manner. Exemplary methods for anomaly detection 210 may be word-based and / or eventbased and / or frequency-based anomaly detection methods.

[0214] The method 200 may determine 212 an index for each of the log entries of the at least one log file or for each of at least two sequences, e.g., log entries. The index may be indicative of a degree of anomaly (e.g. detected 210 by the edge server). The index may be referred to as a severity score, and the step 212 may be referred to as a severity calculation 212. Fig. 8 shows a schematic diagram of an exemplary step 210 of an embodiment of the method 200. Fig. 8 shows a smart batching for edge node 100. The smart batching may be used for repetitive logs, e.g., health messages that has been sent every hour. This data may be compressed, e.g., in case all the messages with a frequency are as expected, as is shown in Fig. 8 at lh and 5h (as an exemplary time that passes between two log entries (e.g., log lines) of the same type).

[0215] This exemplary use case of step 210 may also detect when messages (e.g., health messages) do not appear within the expected time frame, in which case an alert may be generated. This may be done using cluster analysis of the time elapsed between two logs of the same type.

[0216] Fig. 9 shows another schematic diagram of an exemplary step 210 of an embodiment of the method 200. Fig. 9 shows the pattern anomaly detection algorithm using frequency analysis. The algorithm may look for pattern changes in the frequency of appearance of log types. For example, if a log entry (e.g., log line) of a specific log type is generated every hour, but after a while the interval between these messages increases from lh to 1.05h, 1.12h, and may continue to increase, the algorithm may generate an alert and / or flag this as an anomaly (e.g., determine 212 an index for it). This may happen for many reasons, for example if many background processes are running in parallel, but the consequence is that some processes may stop running, which can lead to downtime. This should be dealt with before a failure or error occurs, and the pattern anomaly detector may detect it early. This may also be done using cluster analysis of the time passing between two lines of the same type.

[0217] Another use case of the algorithm may be to correlate log entries (e.g., log lines). Log entries (e.g., log lines) may be connected by the log types they appear with. Therefore, when a log entry (e.g., log line) of one log type appears, it may lead to a log entry (e.g., log line) of another log type. This may help to understand and find related processes (e.g., between log types) and may then be used for anomaly detection 210. The algorithm may detect 210 if log entries (e.g., log lines) are missing, which may then be shown in the network system (e.g., the edge node and / or central server) as an alarm. This may be used as a predictive maintenance application. It may also be used to predict errors and faults at an early stage if certain log types or combinations of log type always or often lead to an error or fault. Fig. 10 shows a schematic diagram of a communication system 500 including an embodiment of the edge node embodiment comprising a device 100 and a central server 300. The method 200 enables the communication system to operate faster and more efficiently, as most of the analysis and computation for monitoring takes place at the edge node 100, the location physically closest to the users (e.g., user equipment). In addition, data transmission between the user equipment and the central server 300 is minimized and reduced to only necessary information, optionally compressed reduced information.

[0218] The method 200 propose an algorithm based on statistics and machine learning to extract of relevant information from large amounts of data in the form of at least one log file.

[0219] The method 200 enables the frequency analysis of the different log types, optionally by grouping the log entries (e.g., log lines) into log types.

[0220] The edge node 100 may be a mobile edge computing (MEC) and / or multi-access edge computing (MAEC) node that provides execution resources (e.g., compute and storage) for applications with networking close to the end users (e.g., user equipment), typically within or at the edge of operator networks.

[0221] When troubleshooting, all data may be stored centrally to help identify errors and faults faster, at the expense of efficiency loss due to high data transfer and storage requirements. If the data is not centrally available, a significant amount of manual work is required to obtain the relevant information for failure analysis (e.g., debugging). The method 200 and the method 300 fall between these two prior art solutions by keeping data transfer and storage low, but still providing enough data to identify an error quickly. It also provides the ability to monitor edge nodes 100 and other components of the wireless telecommunications infrastructure systems 500 with a low corresponding load on the central data server 300.

[0222] The technique may be applied to uplink (UL), downlink (DL) or direct communications between radio devices, e.g., device-to-device (D2D) communications or sidelink (SL) communications. The device 100 may be part of a network node 1100 (e.g., transmitting station) or a core node 1200 (e.g., transmitting station) in the wireless telecommunication infrastructure. Alternatively or in addition, the device 100 may be part of a host computer 1410, 1330 and / or part of the cloud.

[0223] Each of the transmitting station 1100, 1200 may be a radio device or a base station. Herein, any radio device may be a mobile or portable station and / or any radio device wirelessly connectable to a base station or RAN, or to another radio device. For example, the radio device may be a user equipment (UE), a device for machine-type communication (MTC) or a device for (e.g., narrowband) Internet of Things (loT). Two or more radio devices may be configured to wirelessly connect to each other, e.g., in an ad hoc radio network or via a 3GPP SL connection. Furthermore, any base station may be a station providing radio access, may be part of a radio access network (RAN) and / or may be a node connected to the RAN for controlling the radio access. For example, the base station may be an access point, for example a Wi-Fi access point.

[0224] Herein, whenever referring to noise or a signal-to-noise ratio (SNR), a corresponding step, feature or effect is also disclosed for noise and / or interference or a signal-to-interference-and-noise ratio (SINR).

[0225] Fig. 11 shows a schematic block diagram for an embodiment of the device 100. The device 100 comprises processing circuitry, e.g., one or more processors 1104 for performing the method 200 and memory 1106 coupled to the processors 1104. For example, the memory 1106 may be encoded with instructions that implement at least one of the modules 102, 104 and 106.

[0226] The one or more processors 1104 may be a combination of one or more of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, microcode and / or encoded logic operable to provide, either alone or in conjunction with other components of the device 100, such as the memory 1106, base station functionality. For example, the one or more processors 1104 may execute instructions stored in the memory 1106. Such functionality may include providing various features and steps discussed herein, including any of the benefits disclosed herein. The expression "the device being operative to perform an action may denote the device 100 being configured to perform the action.

[0227] As schematically illustrated in Fig. 11, the device 100 may be embodied by a base station 11007e.g., functioning as a gNB. The base station 1100 comprises a radio interface 1102 coupled to the device 100 for radio communication with one or more radio devices, e.g., functioning as a UE.

[0228] Fig. 12 shows a schematic block diagram for an embodiment of the device 100. The device 100 comprises processing circuitry, e.g., one or more processors 1204 for performing the method 200 and memory 1206 coupled to the processors 1204. For example, the memory 1206 may be encoded with instructions that implement at least one of the modules 202, 204 and 206.

[0229] The one or more processors 1204 may be a combination of one or more of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, microcode and / or encoded logic operable to provide, either alone or in conjunction with other components of the device 100, such as the memory 1206, core node functionality. For example, the one or more processors 1204 may execute instructions stored in the memory 1206. Such functionality may include providing various features and steps discussed herein, including any of the benefits disclosed herein. The expression "the device being operative to perform an action" may denote the device 100 being configured to perform the action.

[0230] As schematically illustrated in Fig. 12, the device 200 may be embodied by a core node function 1200, e.g., functioning as a fifth generation core (5GC). The core node 1200 comprises an interface 1202 coupled to the device 100 for communication with one or more RAN nodes, e.g., functioning as a base station such as gNB.

[0231] With reference to Fig. 13, in accordance with an embodiment, a communication system 1300 includes a telecommunication network 1310, such as a 3GPP-type cellular network, which comprises an access network 1311, such as a radio access network, and a core network 1314. The access network 1311 comprises a plurality of base stations 1312a, 1312b, 1312c, such as NBs, eNBs, gNBs or other types of wireless access points, each defining a corresponding coverage area 1313a, 1313b, 1313c. Each base station 1312a, 1312b, 1312c is connectable to the core network 1314 over a wired or wireless connection 1315. A first user equipment (UE) 1391 located in coverage area 1313c is configured to wirelessly connect to, or be paged by, the corresponding base station 1312c. A second UE 1392 in coverage area 1313a is wirelessly connectable to the corresponding base station 1312a. While a plurality of UEs 1391, 1392 are illustrated in this example, the disclosed embodiments are equally applicable to a situation where a sole UE is in the coverage area or where a sole UE is connecting to the corresponding base station 1312.

[0232] Any of the base stations 1312 and the UEs 1391, 1392 may embody the device 100.

[0233] The telecommunication network 1310 is itself connected to a host computer 1330, which may be embodied in the hardware and / or software of a standalone server, a cloud-implemented server, a distributed server or as processing resources in a server farm. The host computer 1330 may be under the ownership or control of a service provider, or may be operated by the service provider or on behalf of the service provider. The connections 1321, 1322 between the telecommunication network 1310 and the host computer 1330 may extend directly from the core network 1314 to the host computer 1330 or may go via an optional intermediate network 1320. The intermediate network 1320 may be one of, or a combination of more than one of, a public, private or hosted network; the intermediate network 1320, if any, may be a backbone network or the Internet; in particular, the intermediate network 1320 may comprise two or more sub-networks (not shown).

[0234] The communication system 1300 of Fig. 13 as a whole enables connectivity between one of the connected UEs 1391, 1392 and the host computer 1330. The connectivity may be described as an over-the-top (OTT) connection 1350. The host computer 1330 and the connected UEs 1391, 1392 are configured to communicate data and / or signaling via the OTT connection 1350, using the access network 1311, the core network 1314, any intermediate network 1320 and possible further infrastructure (not shown) as intermediaries. The OTT connection 1350 may be transparent in the sense that the participating communication devices through which the OTT connection 1350 passes are unaware of routing of uplink and downlink communications. For example, a base station 1312 need not be informed about the past routing of an incoming downlink communication with data originating from a host computer 1330 to be forwarded (e.g., handed over) to a connected UE 1391. Similarly, the base station 1312 need not be aware of the future routing of an outgoing uplink communication originating from the UE 1391 towards the host computer 1330.

[0235] By virtue of the method 200 being performed by any one of the UEs 1391 or 1392 and / or any one of the base stations 1312, the performance or range of the OTT connection 1350 can be improved, e.g., in terms of increased throughput and / or reduced latency. More specifically, the host computer 1330 may indicate to the core node 1200 or the network node 1100 or the user equipment (e.g., on an application layer) the intent or the QoS of the traffic.

[0236] Example implementations, in accordance with an embodiment of the UE, base station and host computer discussed in the preceding paragraphs, will now be described with reference to Fig. 14. In a communication system 1400, a host computer 1410 comprises hardware 1415 including a communication interface 1416 configured to set up and maintain a wired or wireless connection with an interface of a different communication device of the communication system 1400. The host computer 1410 further comprises processing circuitry 1418, which may have storage and / or processing capabilities. In particular, the processing circuitry 1418 may comprise one or more programmable processors, application-specific integrated circuits, field programmable gate arrays or combinations of these (not shown) adapted to execute instructions. The host computer 1410 further comprises software 1411, which is stored in or accessible by the host computer 1410 and executable by the processing circuitry 1418. The software 1411 includes a host application 1412. The host application 1412 may be operable to provide a service to a remote user, such as a UE 1430 connecting via an OTT connection 1450 terminating at the UE 1430 and the host computer 1410. In providing the service to the remote user, the host application 1412 may provide user data, which is transmitted using the OTT connection 1450. The user data may depend on the location of the UE 1430. The user data may comprise auxiliary information or precision advertisements (also: ads) delivered to the UE 1430. The location may be reported by the UE 1430 to the host computer, e.g., using the OTT connection 1450, and / or by the base station 1420, e.g., using a connection 1460. The communication system 1400 further includes a base station 1420 provided in a telecommunication system and comprising hardware 1425 enabling it to communicate with the host computer 1410 and with the UE 1430. The hardware 1425 may include a communication interface 1426 for setting up and maintaining a wired or wireless connection with an interface of a different communication device of the communication system 1400, as well as a radio interface 1427 for setting up and maintaining at least a wireless connection 1470 with a UE 1430 located in a coverage area (not shown in Fig. 14) served by the base station 1420. The communication interface 1426 may be configured to facilitate a connection 1460 to the host computer 1410. The connection 1460 may be direct, or it may pass through a core network (not shown in Fig. 14) of the telecommunication system and / or through one or more intermediate networks outside the telecommunication system. In the embodiment shown, the hardware 1425 of the base station 1420 further includes processing circuitry 1428, which may comprise one or more programmable processors, application-specific integrated circuits, field programmable gate arrays or combinations of these (not shown) adapted to execute instructions. The base station 1420 further has software 1421 stored internally or accessible via an external connection.

[0237] The communication system 1400 further includes the UE 1430 already referred to. Its hardware 1435 may include a radio interface 1437 configured to set up and maintain a wireless connection 1470 with a base station serving a coverage area in which the UE 1430 is currently located. The hardware 1435 of the UE 1430 further includes processing circuitry 1438, which may comprise one or more programmable processors, application-specific integrated circuits, field programmable gate arrays or combinations of these (not shown) adapted to execute instructions. The UE 1430 further comprises software 1431, which is stored in or accessible by the UE 1430 and executable by the processing circuitry 1438. The software 1431 includes a client application 1432. The client application 1432 may be operable to provide a service to a human or non-human user via the UE 1430, with the support of the host computer 1410. In the host computer 1410, an executing host application 1412 may communicate with the executing client application 1432 via the OTT connection 1450 terminating at the UE 1430 and the host computer 1410. In providing the service to the user, the client application 1432 may receive request data from the host application 1412 and provide user data in response to the request data. The OTT connection 1450 may transfer both the request data and the user data. The client application 1432 may interact with the user to generate the user data that it provides.

[0238] It is noted that the host computer 1410, base station 1420 and UE 1430 illustrated in Fig. 14 may be identical to the host computer 1330, one of the base stations 1312a, 1312b, 1312c and one of the UEs 1391, 1392 of Fig. 13, respectively. This is to say, the inner workings of these entities may be as shown in Fig. 14, and, independently, the surrounding network topology may be that of Fig. 13.

[0239] In Fig. 14, the OTT connection 1450 has been drawn abstractly to illustrate the communication between the host computer 1410 and the UE 1430 via the base station 1420, without explicit reference to any intermediary devices and the precise routing of messages via these devices. Network infrastructure may determine the routing, which it may be configured to hide from the UE 1430 or from the service provider operating the host computer 1410, or both. While the OTT connection 1450 is active, the network infrastructure may further take decisions by which it dynamically changes the routing (e.g., on the basis of load balancing consideration or reconfiguration of the network).

[0240] The wireless connection 1470 between the UE 1430 and the base station 1420 is in accordance with the teachings of the embodiments described throughout this disclosure. One or more of the various embodiments improve the performance of OTT services provided to the UE 1430 using the OTT connection 1450, in which the wireless connection 1470 forms the last segment. More precisely, the teachings of these embodiments may reduce the latency and improve the data rate and thereby provide benefits such as better responsiveness and improved QoS.

[0241] A measurement procedure may be provided for the purpose of monitoring data rate, latency, QoS and other factors on which the one or more embodiments improve. There may further be an optional network functionality for reconfiguring the OTT connection 1450 between the host computer 1410 and UE 1430, in response to variations in the measurement results. The measurement procedure and / or the network functionality for reconfiguring the OTT connection 1450 may be implemented in the software 1411 of the host computer 1410 or in the software 1431 of the UE 1430, or both. In embodiments, sensors (not shown) may be deployed in or in association with communication devices through which the OTT connection 1450 passes; the sensors may participate in the measurement procedure by supplying values of the monitored quantities exemplified above, or supplying values of other physical quantities from which software 1411, 1431 may compute or estimate the monitored quantities. The reconfiguring of the OTT connection 1450 may include message format, retransmission settings, preferred routing etc.; the reconfiguring need not affect the base station 1420, and it may be unknown or imperceptible to the base station 1420. Such procedures and functionalities may be known and practiced in the art. In certain embodiments, measurements may involve proprietary UE signaling facilitating the host computer's 1410 measurements of throughput, propagation times, latency and the like. The measurements may be implemented in that the software 1411, 1431 causes messages to be transmitted, in particular empty or "dummy" messages, using the OTT connection 1450 while it monitors propagation times, errors etc.

[0242] Fig. 15 is a flowchart illustrating a method implemented in a communication system, in accordance with one embodiment. The communication system includes a host computer, a base station and a UE which may be those described with reference to Figs. 13 and 14. For simplicity of the present disclosure, only drawing references to Fig. 15 will be included in this paragraph. In a first step 1510 of the method, the host computer provides user data. In an optional substep 1511 of the first step 1510, the host computer provides the user data by executing a host application. In a second step 1520, the host computer initiates a transmission carrying the user data to the UE. In an optional third step 1530, the base station transmits to the UE the user data which was carried in the transmission that the host computer initiated, in accordance with the teachings of the embodiments described throughout this disclosure. In an optional fourth step 1540, the UE executes a client application associated with the host application executed by the host computer.

[0243] Fig. 16 is a flowchart illustrating a method implemented in a communication system, in accordance with one embodiment. The communication system includes a host computer, a base station and a UE which may be those described with reference to Figs. 13 and 14. For simplicity of the present disclosure, only drawing references to Fig. 16 will be included in this paragraph. In a first step 1610 of the method, the host computer provides user data. In an optional substep (not shown) the host computer provides the user data by executing a host application. In a second step 1620, the host computer initiates a transmission carrying the user data to the UE. The transmission may pass via the base station, in accordance with the teachings of the embodiments described throughout this disclosure. In an optional third step 1630, the UE receives the user data carried in the transmission.

[0244] As has become apparent from above description, at least some embodiments of the technique allow for an improved selection of a relay radio device and / or an improved selection of a SL connection establishment. Same or further embodiments can ensure that the traffic relayed by the relay radio device is given the appropriate QoS treatment. Many advantages of the present invention will be fully understood from the foregoing description, and it will be apparent that various changes may be made in the form, construction and arrangement of the units and devices without departing from the scope of the invention and / or without sacrificing all of its advantages. Since the invention can be varied in many ways, it will be recognized that the invention should be limited only by the scope of the following claims.

Claims

Claims1. A method (200) of monitoring a wireless telecommunications infrastructure, the method (200) comprising the steps of: obtaining (202) a data set of at least one log file comprising at least two log entries of the wireless telecommunications infrastructure; determining (212) an index for each of the log entries of the at least one log file or for each of at least two sequences of the log entries, wherein the index is indicative of a degree of anomaly in the wireless telecommunications infrastructure; and transmitting (214) a report to a central server (300), wherein the transmitted (214) report is indicative of those one or more log entries or sequences that are corresponding to the highest determined (212) index.

2. The method (200) of claim 1, wherein the obtained (202) data set comprises at least two log files, and wherein each of the at least two sequences corresponds to one of the at least two log files.

3. The method (200) of claim 1 or 2, wherein the transmitted (214) report includes the one or more log entries of the at least one log file corresponding to the highest determined (212) index, or wherein the transmitted (214) report includes a summary of the one or more log entries of the at least one log file corresponding to the highest determined (212) index.

4. The method (200) of any one of claims 1 to 3, wherein the log files are obtained (202) from at least one of: a user equipment, UE, or a plurality of UEs served by the wireless telecommunications infrastructure; and a network node of the wireless telecommunications infrastructure providing wireless access.

5. The method (200) of any one of claims 1 to 4, wherein the method (200) further comprises the step of storing (204) the log files in a data structure according to the determined (212) index.RECTIFIED SHEET (RULE 91) ISA / EP6. The method (200) of any one of claims 1 to 5, wherein the log entries of the at least one log file comprises at least one of: a log line; a paragraph, wherein the paragraph comprises two or more log entries or log lines; and a line of a binary truth table of at least two log entries.

7. The method (200) of any one of claims 1 to 6, wherein the method (200) further comprises the step of processing (206) the at least one obtained (202) log file, optionally wherein the processing (206) comprises at least one of: splitting text from the at least one log file into log entries; assigning timestamps to each of the log entries; and removing variable parts from the text of the at least one log file.

8. The method (200) of any one of claims 1 to 7, wherein the method (200) further comprises the step of creating (208) at least one log type based on the at least two log entries of the at least one log file, optionally wherein each of the at least one log type comprises a log type group of at least one log entry in the at least one log file.

9. The method (200) of any one of claims 1 to 8, wherein the method (200) further, optionally the determining (212) of the index, comprises the step of detecting (210) the anomaly in the wireless telecommunications infrastructure based on the obtained (202) data set, wherein the anomaly is detected (210) based on a combination of at least two of: one or more words in the at least one log file or in the at least two log entries of the at least one log file or in the at least one log type group of at least one log entry; an incident indicated by the at least one log file or by the log entries or the at least one log type group of at least one log entry; a frequency of log entries per log type group; and a temporal pattern of log entries associated to different log types.

10. The method (200) of claim 9, wherein the detecting (210) of the anomaly comprises combining at least two detecting (210) methods, optionally wherein the determined (212) index is a function of results of the at least two detecting (210) methods.RECTIFIED SHEET (RULE 91) ISA / EP11. The method (200) of any one of claims 1 to 10, wherein at least one of the steps of the method (200) is performed using a machine learning system.

12. The method (200) of any one of claims 1 to 11, wherein the method (200) further comprises the step of receiving (216) a request message from the central server (300), wherein the request message is indicative of requesting further log files or log entries to be transmitted (214).

13. The method (200) of any one of claims 1 to 12, wherein the method (200) is performed by an edge node of the wireless telecommunications infrastructure.

14. A method (400) of monitoring a wireless telecommunications infrastructure, the method (400) comprising the step of: receiving (414) a report from an edge node (100) of the wireless telecommunications infrastructure, wherein the received report is indicative of one or more log entries or sequences of the log entries that are corresponding to a highest index out of at least two log entries of the at least one log file obtained at the edge node (100), wherein the index is indicative of a degree of anomaly in the wireless telecommunications infrastructure.

15. The method (400) of claim 14, wherein the method (400) further comprises the step of transmitting (416) a request message to the edge node (100), wherein the request message is indicative of requesting further log entries or sequences of the log entries to be received (414) from the edge node (100).

16. The method (400) of claim 14 or 15, wherein the method (400) further comprises the step of troubleshooting (418) the wireless telecommunications infrastructures according to the received (414) report and / or the received (414) further log entries or sequences of the log entries.

17. The method (400) of any one of claims 14 to 16, wherein the method (400) is performed by a central server (300) of the wireless telecommunications infrastructure.

18. A computer program product (100) comprising program code portions for performing the steps of any one of the claims 1 to 13 when the computer programRECTIFIED SHEET (RULE 91) ISA / EPproduct is executed on one or more computing devices (1104; 1204), optionally stored on a computer-readable recording medium (1106; 1206).

19. A node (100; 1100; 1200) for monitoring a wireless telecommunications infrastructure, the node (100; 1100; 1200) comprising memory operable to store instructions and processing circuitry operable to execute the instructions, such that the node (100; 1100; 1200) is operable to: obtain (202) a data set of at least one log file comprising at least two log entries of the wireless telecommunications infrastructure; determine (212) an index for each of the log entries of the at least one log file or for each of at least two sequences of the log entries, wherein the index is indicative of a degree of anomaly in the wireless telecommunications infrastructure; and transmit (214) a report to a central server (300), wherein the transmitted (214) report is indicative of those one or more log entries or sequences of the log entries that are corresponding to the highest determined (212) index.

20. The node (100; 1100; 1200) of claim 19, further operable to perform any one of the steps of any one of claims 2 to 13.

21. A node (100; 1100; 1200) for monitoring a wireless telecommunications infrastructure, the node (100; 1100; 1200) being configured to: obtain (202) a data set of at least one log file comprising at least two log entries of the wireless telecommunications infrastructure; determine (212) an index for each of the log entries of the at least one log file or for each of at least two sequences of the log entries, wherein the index is indicative of a degree of anomaly in the wireless telecommunications infrastructure; and transmit (214) a report to a central server (300), wherein the transmitted (214) report is indicative of those one or more log entries or sequences of the log entries that are corresponding to the highest determined (212) index.

22. The node (100; 1100; 1200) of claim 21, further configured to perform any one of the steps of any one of claims 2 to 13.RECTIFIED SHEET (RULE 91) ISA / EP23. The node (100; 1100; 1200) of any one of claims 19 to 22, wherein the node is a core node of a core network, CN, of the wireless telecommunications infrastructure, or wherein the node is a network node of a radio access network, RAN, of the wireless telecommunications infrastructure, optionally a base station or a central unit of the base station.

24. A central server (300) for monitoring a wireless telecommunications infrastructure, the central server (300) comprising memory operable to store instructions and processing circuitry operable to execute the instructions, such that the central server (300) is operable to: receive (414) a report from an edge node (100) of the wireless telecommunications infrastructure, wherein the received report is indicative of one or more log entries or sequences of the log entries that are corresponding to a highest index out of at least two log entries of the at least one log file obtained at the edge node (100), wherein the index is indicative of a degree of anomaly in the wireless telecommunications infrastructure.

25. The central server (300) of claim 24, further operable to perform any one of the steps of any one of claims 15 to 17.

26. A central server (300) for monitoring a wireless telecommunications infrastructure, the central server (300) being configured to: receive (414) a report from an edge node (100) of the wireless telecommunications infrastructure, wherein the received report is indicative of one or more log entries or sequences of the log entries that are corresponding to a highest index out of at least two log entries of the at least one log file obtained at the edge node (100), wherein the index is indicative of a degree of anomaly in the wireless telecommunications infrastructure.

27. The central server (300) of claim 26, further configured to perform any one of the steps of any one of claims 15 to 17.

28. A communication system (500; 1300; 1400) comprising: a node (100; 1312; 1420) comprising processing circuitry (1428; 1438) configured to execute the steps of any one of claims 1 to 13; andRECTIFIED SHEET (RULE 91) ISA / EPa host computer (300, 1330; 1410) comprising processing circuitry (1418) configured to execute the steps of any one of claims 14 to 17.

29. The communication system (500; 1300; 1400) of claim 28, further including a UE (1391; 1392; 1430), wherein the UE (1391; 1392; 1430) comprises a radio interface (1102; 1437) and processing circuitry (1104; 1438), the processing circuitry (1104; 1438) of the UE (1391; 1392; 1430) being configured for radio access to the wireless telecommunications infrastructure, wherein the UE (1391; 1392; 1400) configured to provide at least one log file to the edge node (100).

30. The communication system (500; 1300; 1400) of any one of claims 28 to 29, wherein the radio network (1310) further comprises a base station (1100; 1200; 1112; 1420), or a radio device (1391; 1392; 1430) functioning as a gateway, which is configured to communicate with the UE (1391; 1392; 1430) and / or configured to provide at least log file to the edge node (100).

31. The communication system (500; 1300; 1400) of any one of claims 28 to 30, wherein: the processing circuitry (1418) of the host computer (1330; 1410) is configured to execute a host application (1412), thereby providing the user data; and a processing circuitry (1104; 1438) of the UE (1391; 1392; 1430) is configured to execute a client application (1432) associated with the host application (1412).RECTIFIED SHEET (RULE 91) ISA / EP

Images