First node, second node, first core network node, second core network node, communications system and methods performed thereby for handling signalling

Abstract

A computer-implemented method, performed by a first node (111). The first node (111) operates in a communications system (100). The first node (111) obtains (803), from one or more network nodes (120, 140) operating in the communications system (100), one or more respective indications indicating an amount of signalling per time unit handled by a set of resources in the communications system (100). The first node (111) determines (804), based on the obtained one or more respective indications, whether or not a signalling storm has been detected or is predicted to occur in the communications system (100). The first node (111) them sends (805), with the proviso a result of the determining (804) is that a signalling storm has been detected or is predicted to occur, an additional indication to a second node (112) operating in the communications system (100). The additional indication indicates a result of the determining (804).

Description

[0001] FIRST NODE, SECOND NODE, FIRST CORE NETWORK NODE, SECOND CORE NETWORK NODE, COMMUNICATIONS SYSTEM AND METHODS PERFORMED THEREBY FOR HANDLING SIGNALLING

[0002] TECHNICAL FIELD

[0003] The present disclosure relates generally to a first node and methods performed thereby for handling signalling. The present disclosure also relates generally to a second node, and methods performed thereby for handling the signalling. The present disclosure further relates generally to a first core network node, and methods performed thereby for handling the signalling. The present disclosure also relates generally to a second core network node, and methods performed thereby for handling the signalling. The present disclosure additionally relates generally to a communications system, and methods performed thereby for handling the signalling.

[0004] BACKGROUND

[0005] Computer systems in a communications network or communications system may comprise one or more nodes. A node may comprise a processing circuitry which, together with computer program code may perform different functions and actions, a memory, a receiving port, and a sending port. A node may be, for example, a server. Nodes may perform their functions entirely on the cloud.

[0006] The communications system may cover a geographical area which may be divided into cell areas, each cell area being served by a type of node, a network node in the Radio Access Network (RAN), radio network node or Transmission Point (TP), for example, an access node such as a Base Station (BS), e.g., a Radio Base Station (RBS), which sometimes may be referred to as e.g., gNB, evolved Node B (“eNB”), “eNodeB”, “NodeB”, “B node”, or Base Transceiver Station (BTS), depending on the technology and terminology used. The base stations may be of different classes such as e.g., Wide Area Base Stations, Medium Range Base Stations, Local Area Base Stations, and Home Base Stations, based on transmission power and thereby also cell size. A cell may be understood to be the geographical area where radio coverage may be provided by the base station at a base station site. One base station, situated on the base station site, may serve one or several cells. Further, each base station may support one or several communication technologies. The telecommunications network may also comprise network nodes which may serve receiving nodes, such as user equipments, with serving beams.

[0007] The standardization organization Third Generation Partnership Project (3GPP) is currently in the process of specifying a New Radio Interface called Next Generation Radio or New Radio (NR) or 5G-llniversal Terrestrial Radio Access (LITRA), as well as a Fifth Generation (5G) Packet Core Network, which may be referred to as 5G Core Network (5GC), abbreviated as 5GC.

[0008] Figure 1 is a schematic diagram depicting a particular example of a 5G reference architecture with a service based representation, as defined by 3GPP, and which may be used as a reference for the present disclosure. An Application Function (AF) 1 may interact with the 3GPP Core Network through a Network Exposure Function (NEF) 2. The AF 1 may allow external parties to use the Exposure Application Program Interfaces (APIs) offered by the Mobile Network Operator (MNO). In case the AF may be trusted, e.g., internal to the network operator, the AF may interact with the 3GPP Core Network directly, with no NEF involved. The NEF 2 may support different functionality, e.g., a set of APIs, e.g., sponsored Data, Quality of Service (QoS), etc., which may allow a content provider to request policies from the MNO, e.g., on a per user session and / or application basis. The NEF 2 may be understood to act as the entry point into the network of the operator, so an external AF, e.g., a content provider, may interact with the 3GPP Core Network through the NEF 2.

[0009] A Unified Data Repository (UDR), which is not depicted, may store data grouped into distinct collections of subscription-related information: subscription data, policy data, structured data for exposure, and application data. A Unified Data Management Function (UDM) 3 may generate 3GPP 5G AKA Authentication Vectors, handle user identification handling, support a UE's Serving Network Function (NF) Registration Management, e.g., storing the serving Access and Mobility Function (AMF) for a User Equipment (UE), storing the serving Session Management Function (SMF) for a UE's Protocol Data Unit (PDU) Session, etc., support retrieval of the UE's individual subscription data for slice selection, and handle subscription data for network exposure capabilities applicable to an individual UE or a group of UEs. A Policy Control Function (PCF) 4 may support a unified policy framework to govern the network behavior. Specifically, the PCF 4 may provide Policy and Charging Control (PCC) rules to a Policy and Charging Enforcement Function (PCEF), not depicted in Figure 1 . That is, an SMF 5 / User Plane function (UPF) 6 that may enforce policy and charging decisions according to provisioned Policy and Charging Control (PCC) rules. The SMF 5 may support different functionalities, e.g., session establishment, modify and release, and policy related functionalities such as termination of interfaces towards policy control functions, charging data collection, support of charging interfaces and control and coordination of charging data collection at the UPF 6. Specifically, the SMF 5 may receive PCC rules from the PCF 4 and configure the UPF 6 accordingly, e.g., for event reporting. This may happen through an N47 reference point, Packet Flow Control Protocol (PFCP) protocol as follows. The SMF 5 may control the packet processing in the UPF 6 by establishing, modifying or deleting PFCP sessions and by provisioning, e.g., adding, modifying or deleting, Packet Detection Rules (PDRs), Forwarding Action Rules (FARs), Quality Enforcement Rules (QERs) and / or Usage Reporting Rules (URRs) per PFCP session, whereby a PFCP session may correspond to an individual PDU session or a standalone PFCP session not tied to any PDU session. The UPF 6 may support handling of user plane traffic, e.g., based on the rules received from the SMF 5, specifically, e.g., packet inspection, packet routing and forwarding, traffic usage reporting, QoS handling, for example through FARs, QERs, and / or URRs. The PCF 4 may provide policy rules to a UE 8 through the AMF 9. The AMF 9 may manage access of the UE 8, for example, when the UE 8 may be connected through different access networks, and mobility aspects of the UE 8. An Network Data Analytics Function (NWDAF), not depicted either in Figure 1 , may be understood to represent an operator managed network analytics logical function. The NWDAF may be understood to be part of the 5GC architecture and use the mechanisms and interfaces specified for 5GC and for the Operations And Management (QAM). The NWDAF may interact with different entities for different purposes. A first purpose may be data collection based on event subscription, provided by AMF 9, SMF 5, PCF 4, UDM 3, AF 1 , directly or via NEF 2, and QAM; Another purpose may be retrieval of information from data repositories, e.g., UDR 5 via UDM 3 for subscriber-related information; A further purpose may be retrieval of information about Network Functions (NFs), e.g., Network Repository Function (NRF) for NF-related information, and Network Slice Selection Function (NSSF) for slice- related information; Yet another purpose may be on demand provision of analytics to consumers. Another purpose may be storage in an Analytics Data Repository Function (ADRF) for two types of data: collected Data, e.g., Event Exposure data, and Analytics reports. Also depicted in Figure 1 is a Network Slice Selection Function (NSSF) 10, NRF 11 , an Authentication Server Function (AUSF) 12, a Radio Access Network (RAN) 13, a Data Network (DN) 14, an Edge Application Server Discovery Function (EASDF) 15, a Network Slice Specific Authentication and Authorization Function (NSSAAF) 16, a Service Communication Proxy (SCP) 17 and a Network Slice Access Control Function (NSACF) 18. Each of the NSSF 10, the NEF 2, the NRF 11 , the PCF 4, the UDM 3, the AF 1 , the EASDF 15, the NSSAAF 16, the AUSF 12, the AMF 9, the SMF 5, the NSACF 18, the UE 8, the (R)AN 13, the UPF 6 and the DN 14 may have an interface through which they may be accessed, or reference points “N”, which as depicted in Figure 1 , may be, respectively: Nnssf 19, Nnef 20, Nnrf 21 , Npcf 22, Nudm 23, Naf 24, Nausf 21 , Neasdf 25, Nnssaaf 26, Nausf 27, Namf 28, Nsmf 29, Nnsacf 30, N1 31 , N2 32, N4 33, and N6 34. The RAN 13 may have an interface N3 35 with the UPF 6, and the UPF 6 may have an interface N9 36 with the DN 14.

[0010] Figure 2 is a schematic diagram depicting a particular example of a 5G reference architecture with a reference point representation, as defined by 3GPP, and which may be used as a reference for the present disclosure. In the addition to the reference points already shown in Figure 1 , Figure 2 depicts the following additional reference points: a) between the AMF 9 and each of the NSSF 10, AUSF 12, NSSAAF 16, UDM 3, NSACF 18, SMF 5, PCF 5, and AMF 9 which may, respectively: N22 37, N12 38, N58 39, N8 40, N80 41 , N11 42, N15 43 and N14 44, b) between the UDM 3 and each of the NSSAAF 16, AUSF 12 and SMF 5 which may be, respectively: N59 45, N13 46, and N10 47, c) between the PCF 4 and each of the SMF 5, NSACF 18 and AF 1 which may, respectively: N7 48, N81 49, N5 50.

[0011] NF services

[0012] In the 5GC service-based architecture defined by 3GPP [1], network functions may comprise services, which may be referred to as NF services, as shown in the schematic diagram depicted in Figure 3. A service, e.g., an NF service, may be understood as a functionality exposed by node, e.g., an NF, through a service-based interface which may be consumed by other nodes, e.g., NFs, which may be authorized. In the non-limiting example depicted in Figure 3, a network function 51 comprises a first NF service “NF Service 1” 52, a second NF service “NF Service 2” 53, and additional NF services up to “NF Service n” 54.

[0013] Each NF service may be accessible by means of a respective interface. An interface may consist of one or several operations, as shown in the schematic diagram depicted in Figure 4. An operation may be understood as an elementary unit a service, e.g., an NF service, may comprise. In the non-limiting example depicted in Figure 3, the network function 51 comprises the same plurality of NF services as Figure 3. The first NF service 52, “NF Service 1”, may be accessible via a first interface “Nnf_nfservice1” 55, the second NF service 53 “NF Service 2” may be accessible via a second interface “Nnf_nfservice2” 56. The second interface 56 may comprise a first operation “Nnf_nfservice2_operation1” 57 and a second operation “Nnf_nfservice2_operation2” 58, and the last NF service “NF Service n” may be accessible via another interface “Nnf_nfservicen” 59.

[0014] System procedures may be built by invocation of a number of NF services. A system procedure may be understood as a set of interactions, e.g., in the form of a signaling diagram, which may show how different nodes, e.g., 5GC NFs, in the system may interact which each other, e.g., using service based interfaces and invoking the corresponding service operations, to accomplish a specific procedure. An example may the "PDU session establishment" procedure, which may involve a set of nodes, e.g., 5GC NFs, using, e.g., Service Based Architecture (SBA) interfaces, services and operation. Figure 5 is a schematic diagram showing an illustrative example on how a procedure may be built. It may be understood to not be intended that the system procedures depict the details of the NF Services within each Network Function. In general, Network Functions may be understood to offer services, and may also comprise consumers of services offered by other NFs. The non-limiting example depicted in Figure 5 illustrates three different NF functions: NF A 60, NF B 61 and NF C 62. NF A 60 comprises a first plurality of NF services A, comprising NF Service A263 ... up to NF Service An 64. NF B 61 comprises a second plurality of NF services B, comprising NF Service B1 65 ... up to NF Service Bn 66, which is also a Consumer An of NF Service An 64 from NF A 60. NF C 62 comprises a first plurality of Consumers C, comprising a first Consumer B1 67, which is a consumer of the NF Service B1 65, a second Consumer B2 68, which is a consumer of NF Service A2 63, ... up to Consumer Bn 69, which is also a consumer of NF Service An 64 from NF A 60. A procedure may be established by the NF Service A2 63 providing a first service to Consumer B2 68 at 70, followed the NF Service An 64 providing a second service to NF Service Bn Consumer An 66 at 71 , and to Consumer Bn 69 at 72, and then followed by NF Service B1 65 providing a third service to Consumer B1 67 at 73.

[0015] 3GPP Rel19 AIML

[0016] 3GPP Rel19 Study Item Identifier (SID) on Artificial Intelligence (AI)ZMachine Learning (ML) (AIML) has agreed on a WT3.2 relative to signaling storms, relative to the study of the prediction, detection, prevention, and mitigation of network abnormal behaviors, that is, signaling storms, with the assistance of NWDAF. A signalling storm may be understood as an abnormal behavior in a communications network resulting in a high number of messages being trafficked in the communications network within a certain period of time, and which may affect the capacity, latency and / or overall performance of the communications network. Figure 6 is a sequence diagram depicting a non-limiting example of a signaling storm generated at the UPF and propagated towards SMF and PCF, but also towards AMF, RAN and UE. For simplicity, only 4 flows, that is, 5-tuples, are shown, but in practice there may be understood to be many more within an application session, resulting in a signaling storm. The steps depicted are summarized as follows. It may be understood that only selected messages are shown. Starting on panel a), of Figure 6, in steps 1 to 3) a UE 74 triggers a PDU Session Establishment procedure by sending an N1 PDU Session Establishment Request to an AMF 75. The AMF 75 sends an Nsmf PDU Session Create Request to an SMF 76, and the SMF 76 sends an Npcf_SMPolicyControl_Create Request to a PCF 77. In steps 4 and 5), the PCF 77 retrieves from a UDR 78 the subscriber data for UE-ID, by sending a Nudr Query Request to the UDR 78, and the UDR 78 sends a Nudr Query Response to the PCF 77 comprising Subscriber Data, specifically, a subscription to cloud gaming. In steps 6 and 7), based on the above information received from the UDR 78, that is, user subscribed to cloud gaming, which in this example requires QoS differentiation for cloud gaming applications, the PCF 77 installs PCC rules, specifically including a PCC rule for Application ID, e.g., gaming.com, a cloud gaming application requiring QoS differentiation, for which the PCF 77 subscribes to the SMF 76 on application start and stop events, APP STA / APP STO, and with the Reduced Application Detection Information (RADI) flag set to disabled, to enable the reporting of application detection information, and the associated QoS information. Continuing in panel b), in step 8), the SMF 76 triggers a PFCP Session Establishment procedure towards a UPF 79 to indicate the PDRs and the corresponding enforcement actions, e.g., FARs, QERs, URRs, etc, for the PDll session. Specifically, a PDR, here Application ID=gaming.com, associated to a URR including the subscription to the application start and stop events, that is, APP STA / APP STO, and with the RADI flag set to disabled, to enable the reporting of application detection information. In Step 9), based on the information received in Step 8 above, the UPF 79 enables reporting ApplicationDetection Information for Application ID=gaming.com. In Step 10) the UPF 79 answers the message in Step 8 with a PFCP Session Establishment response message indicating successful operation to the SMF 76. In Step 11), the SMF 76 answers the message in Step 2 indicating successful operation by sending an Nsmf PDU Session Create Response to the AMF 75. In Step 12), the AMF 75 answers the message in Step 1 indicating successful operation by sending an N1 PDU Session Establishment Response to the UE 74. In Steps 13 and 14), the user opens the application Application ID=gaming.com and application traffic for Application ID=gaming.com is initiated. Continuing in panel c), the UE 74 triggers multiple flows, in this example, for simplicity, four flows, two of them for each of two application servers, Application Server (AS) #1 80 and Application Server #2 81 , but in a real application there may be many more, leading to the signaling storm. The first flow, 5-tuple #1 , from the UE 74 to the UPF 79, includes the 5- tuple parameters: source IP address #1 , source port #1 , destination IP address #1 , destination port #1 , and IP Protocol #1 . In Steps 15 and 16) the UPF 79 detects application traffic for Application ID=gaming.com, and forwards it towards the Application Server #1 80, as the 5- tuple #1 including source IP address #1 , source port #1 , destination IP address #1 , destination port #1 , and IP Protocol #1 . In Steps 17 and 18, the UPF 79 reports ApplicationDetectionlnformation, by triggering a PFCP Session Report Request message to the SMF 76 including a Usage Report with the following information: APP STA, and ApplicationDetectionlnformation, including: Application ID, Application Instance ID, Flow Information and PDR ID. Continuing in panel d), in Step 19), the SMF 76 answers the message in Step 18 indicating successful operation by sending a PFCP Session Report Response to the UPF 79. In Step 20) the SMF 76 forwards the application start event to the PCF 77 by triggering an Npcf_SMPolicyControl_Update Request message including the following information: APP STA and AppDetectionlnfos, including: Application ID, Application Instance ID and Flow Information. In Steps 21 and 22) the PCF 77 generates a PCC rule based on the reported Flow Information in Step 20 above, and triggers an Npcf_SMPolicyControl_Update Response message to the SMF 76 including the following information: a PCC rule, including: Service Data Flow (SDF) Filter and QoS information. In Step 23), the SMF 76 generates an uplink Traffic Flow Template (TFT) based on the SDF Filter in the PCC rule received above. In Step 24) the SMF 76 forwards to the UE 74, through the AMF 75, the Uplink (UL) TFT by triggering a Namf_Communication_N1 N2MessageTransferReq-PDUSessionModificationCommand message including the following information Uplink TFT. Continuing in panel e), in Step 25) the AMF 75 answers the message in Step 24 indicating successful operation to the SMF 76. In Step 26), the AMF 75 forwards transparently to the UE 74 the UL TFT by triggering a N1_Communication_N1 N2MessageTransferReq-PDUSessionModificationCommand message including the following information: Uplink TFT. In Step 27), the UE 74 answers the message in Step 26 indicating successful operation to the AMF 75. In Step 28) the UE 74 routes traffic matching uplink the TFT through the corresponding QoS flow. Steps 29 to 71), continued over panels g-k), are not described as they are similar to the previous ones. They correspond to (3) new flows generated by the UE 74 for the cloud gaming application.

[0017] Signalling storms such as the example depicted in Figure 6, as well as in other examples, degrade the performance of a communications network, resulting in increased latency and low quality of experience.

[0018] SUMMARY

[0019] As part of the development of embodiments herein, one or more challenges with the existing technology will first be identified and discussed.

[0020] There is currently no mechanism to automatically predict or detect a signaling storm in the network of an MNO.

[0021] According to the foregoing, it is an object of embodiments herein to improve the handling of signalling in a communications system.

[0022] According to a first aspect of embodiments herein, the object is achieved by a computer- implemented method, performed by a first node. The method is handling signalling. The first node operates in a communications system. The first node obtains, from one or more network nodes operating in the communications system, one or more respective indications. The one or more respective indications indicate an amount of signalling per time unit handled by a set of resources in the communications system. The first node also determines, based on the obtained one or more respective indications, whether or not a signalling storm has been detected or is predicted to occur in the communications system. The first node then sends, with the proviso a result of the determining is that a signalling storm has been detected or is predicted to occur, an additional indication to a second node operating in the communications system. The additional indication indicates a result of the determining.

[0023] According to a second aspect of embodiments herein, the object is achieved by a computer-implemented method, performed by the second node. The method is for handling the signalling. The second node operates in the communications system. The second node receives, from the first node operating in the communications system, the additional indication indicating the result of the determination of whether or not a signalling storm has been detected or is predicted to occur in the communications system. The determination has been performed by the first node based on the one or more respective indications obtained by the first node from the one or more network nodes operating in the communications system. The one or more respective indications indicate the amount of signalling per time unit handled by the set of resources in the communications system. The second node then performs one or more actions based on the received additional indication.

[0024] According to a third aspect of embodiments herein, the object is achieved by a computer-implemented method, performed by a first core network node. The method is for handling the signalling. The first core network node operates in the communications system. The first core network node sends, to the first node operating in the communications system, the one or more respective indications indicating the amount of signalling per time unit handled by the set of resources in the communications system. The first node is an NWDAF. The first core network node is an NF. The sending is performed in response to a subscription to an event to receive notifications of signalling information. The subscription indicates: i) a first identifier of the event, and one or more of: ii) an indication of one or more reference points in the communications system wherein the amount of signalling is to be analyzed, iii) another indication of one or more services of the communications system for which the amount of signalling is to be analyzed, and iv) a further indication of one or more devices operating in the communications system wherein the amount of signalling is to be analyzed.

[0025] According to a fourth aspect of embodiments herein, the object is achieved by a computer-implemented method, performed by a second core network node. The method is for handling the signalling. The second core network node operates in the communications system. The second core network node sends, to the first node operating in the communications system, the one or more respective indications indicating the amount of signalling per time unit handled by the set of resources in the communications system. The first node is an NWDAF, or an MDAF. The second core network node is an OAM node. The one or more respective indications sent by the second core network node comprise at least one of one or more counters and one or more statistics indicating at least one of: i) an amount of signalling of the one or more reference points in the communications system wherein the amount of signalling is to be analyzed, and ii) ab amount of signalling of the one or more services of the communications system for which the amount of signalling is to be analyzed.

[0026] According to a fifth aspect of embodiments herein, the object is achieved by the first node, for handling the signalling. The first node is configured to operate in the communications system. The first node is configured to obtain, from the one or more network nodes configured to operate in the communications system, the one or more respective indications configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system. The first node is also configured to determine, based on the one or more respective indications configured to be obtained, whether or not a signalling storm has been detected or is predicted to occur in the communications system. The first node is further configured to send, with the proviso the result of the determining is that a signalling storm has been detected or is predicted to occur, the additional indication to the second node configured to operate in the communications system. The additional indication is configured to indicate the result of the determining.

[0027] According to a sixth aspect of embodiments herein, the object is achieved by the second node, for handling the signalling. The second node is configured to operate in the communications system. The second node is configured to configured to receive, from the first node configured to operate in the communications system, the additional indication configured to indicate the result of the determination of whether or not the signalling storm has been detected or is predicted to occur in the communications system. The determination is configured to have been performed by the first node based on the one or more respective indications configured to be obtained by the first node from the one or more network nodes configured to operate in the communications system. The one or more respective indications are configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system. The second node is also configured to perform the one or more actions based on the additional indication configured to be received.

[0028] According to a seventh aspect of embodiments herein, the object is achieved by the first core network node, for handling the signalling. The first core network node is configured to operate in the communications system. The first core network node is configured to send, to the first node configured to operate in the communications system, the one or more respective indications configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system. The first node 11 is configured to be an NWDAF. The first core network node is configured to be an NF. The sending is configured to be performed in response to the subscription to the event to receive notifications of the signalling information. The subscription is configured to indicate: i) the first identifier of the event, and one or more of: ii) the indication of the one or more reference points in the communications system wherein the amount of signalling is to be analyzed, iii) the another indication of the one or more services of the communications system for which the amount of signalling is to be analyzed, and iv) the further indication of the one or more devices configured to operate in the communications system wherein the amount of signalling is to be analyzed.

[0029] According to an eighth aspect of embodiments herein, the object is achieved by the second core network node, for handling the signalling. The second core network node is configured to operate in the communications system. The second core network node is configured to send, to the first node configured to operate in the communications system, the one or more respective indications configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system. The first node is configured to be an NWDAF, or an MDAF. The second core network node is configured to be an OAM node. The one or more respective indications configured to be sent by the second core network node are configured to comprise at least one of the one or more counters and the one or more statistics configured to indicate at least one of: i) the amount of signalling of the one or more reference points in the communications system wherein the amount of signalling is to be analyzed, and ii) the amount of signalling of the one or more services of the communications system for which the amount of signalling is to be analyzed.

[0030] According to a ninth aspect of embodiments herein, the object is achieved by the communications system, for handling the signalling. The communications system is configured to comprise one or more of: the first node, the second node, the first core network node and the second core network node.

[0031] Certain embodiments disclosed herein may provide one or more of the following technical advantage(s), which may be summarized as follows.

[0032] Embodiments herein may be understood to allow a network operator to predict, detect, prevent and mitigate network signaling storms.

[0033] Embodiments herein may be understood to also enable the network operator to detect momentary signaling anomalies and long-term signaling trend deviations or changes.

[0034] BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Examples of embodiments herein are described in more detail with reference to the accompanying drawings, according to the following description.

[0036] Figure 1 is a schematic diagram illustrating an example of a 5G Network Architecture, according to existing methods.

[0037] Figure 2 is a schematic diagram illustrating an example of a 5G reference architecture with a reference point representation, as defined by 3GPP, according to existing methods.

[0038] Figure 3 is a schematic diagram illustrating an example of Network Function and NF Service, according to existing methods.

[0039] Figure 4 is a schematic diagram illustrating an example of Network Function, NF Service and NF Service Operation, according to existing methods.

[0040] Figure 5 is a schematic diagram illustrating an example of System Procedures and NF Services, according to existing methods.

[0041] Figure 6 is a signalling diagram illustrating an example of Example showing a signaling storm, according to existing methods.

[0042] Figure 7 is a schematic diagram illustrating a non-limiting example of a communications system, according to embodiments herein. Figure 8 is a flowchart depicting embodiments of a method in a first node, according to embodiments herein.

[0043] Figure 9 is a flowchart depicting embodiments of a method in a second node, according to embodiments herein.

[0044] Figure 10 is a flowchart depicting embodiments of a method in a first core network node, according to embodiments herein.

[0045] Figure 11 is a flowchart depicting embodiments of a method in a second core network node, according to embodiments herein.

[0046] Figure 12 is a schematic diagram depicting a non-limiting example of signalling between nodes in a communications system, according to embodiments herein.

[0047] Figure 13 is a schematic block diagram illustrating two non-limiting examples, a) and b), of a first node, according to embodiments herein.

[0048] Figure 14 is a schematic block diagram illustrating two non-limiting examples, a) and b), of a second node, according to embodiments herein.

[0049] Figure 15 is a schematic block diagram illustrating two non-limiting examples, a) and b), of a first core network node, according to embodiments herein.

[0050] Figure 16 is a schematic block diagram illustrating two non-limiting examples, a) and b), of a second core network node, according to embodiments herein.

[0051] DETAILED DESCRIPTION

[0052] Certain aspects of the present disclosure and their embodiments address one or more of the challenges identified with the existing methods and provide solutions to the challenges discussed.

[0053] Embodiments herein may be understood to address the problems identified with the existing methods and may relate to network signaling storm related analytics of an MNO. More particularly, embodiments herein may be understood to relate to a mechanism which may be understood to address the problems identifier earlier, and which may be based on defining a new NWDAF analytic which may allow to predict, detect, prevent and mitigate network signaling storms, on a per global network basis, filtered, e.g., per area, Data Network Name (DNN) and / or slice, or on a per NF or NF group basis.

[0054] Additionally, the analytic output may also provide recommendations on the actions a consumer may take, such as, e.g., to remove PDll sessions on the NF / s where the predicted / detected signaling storm may have originated, to apply other mitigation actions based on existing Service Based Interface (SBI) interface load and overload procedures, to trigger a change of network slice for PDll sessions for selected UE-ID(s), to influence on NF selection for new PDll sessions, etc. The embodiments will now be described more fully hereinafter with reference to the accompanying drawings, in which examples are shown. In this section, embodiments herein are illustrated by exemplary embodiments. It should be noted that these embodiments are not mutually exclusive. Components from one embodiment or example may be tacitly assumed to be present in another embodiment or example and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. All possible combinations are not described to simplify the description.

[0055] Figure 7 depicts two non-limiting examples, in panels “a” and “b”, respectively, of a communications system 100, in which embodiments herein may be implemented. In some example implementations, such as that depicted in the non-limiting example of Figure 7a, the communications system 100 may be a computer network. In other example implementations, such as that depicted in the non-limiting example of Figure 7b, the communications system 100 may be implemented in a telecommunications system, sometimes also referred to as a telecommunications network, cellular radio system, cellular network, or wireless communications system. In some examples, the telecommunications system may comprise network nodes which may serve receiving nodes, such as wireless devices. The communications system 100 may for example be a network such as a 5G system, or a newer system supporting similar functionality. The telecommunications system may additionally support other technologies such as a for example Long-Term Evolution (LTE), e.g., LTE Frequency Division Duplex (FDD), LTE Time Division Duplex (TDD), LTE Half-Duplex Frequency Division Duplex (HD-FDD), LTE operating in an unlicensed band. The telecommunications system may also support yet other technologies, such as Wideband Code Division Multiple Access (WCDMA), Universal Mobile Telecommunications System Terrestrial Radio Access (UTRA) TDD, Global System for Mobile communications (GSM) network, GSM / Enhanced Data Rate for GSM Evolution (EDGE) Radio Access Network (GERAN) network, Ultra-Mobile Broadband (UMB), EDGE, any combination of Radio Access Technologies (RATs) such as e.g. Multi-Standard Radio (MSR) base stations, multi-RAT base stations etc., any 2rd Generation Partnership Project (3GPP) cellular network, Wireless Local Area Network / s (WLAN) or WiFi network / s, Worldwide Interoperability for Microwave Access (WiMax), IEEE 802.15.4-based low-power short-range networks such as IPv6 over Low-Power Wireless Personal Area Networks (6LowPAN), Zigbee, Z-Wave, Bluetooth Low Energy (BLE), or any cellular network or system. The telecommunications system may for example support a Low Power Wide Area Network (LPWAN). LPWAN technologies may comprise Long Range physical layer protocol (LoRa), Haystack, SigFox, LTE-M, and Narrow-Band loT (NB-loT).

[0056] The communications system 100 may comprise a plurality of nodes, and / or operate in communication with other nodes, whereof a first node 111 , a second node 112, and one or more network nodes are depicted in Figure 7. The one or more network nodes may comprise at least one of one or more core network nodes 120 and one or more radio access network nodes. The one of one or more core network nodes 120 may comprise a first core network node 121 , a second core network node 122 and a third core network node 123. The one or more network nodes may, in some embodiments, comprise one or more radio access network nodes 140. It may be understood that the communications system 100 may comprise a different number of nodes, network nodes, core network nodes and / or radio network nodes than those represented on Figure 7. Any of the first node 111 , the second node 112, the one or more network nodes 120, 140, the one or more core network nodes 120, such as the first core network node 121 , the second core network node 122, and the third core network node 123, and the one or more radio access network nodes 140 may be comprised in, or be internal to, the communications system 100.

[0057] Any of the first node 111 , the second node 112, the one or more network nodes 120, 140, the one or more core network nodes 120, such as the first core network node 121 , the second core network node 122, and the third core network node 123, and the one or more radio access network nodes 140 may be understood, respectively, as a first computer system, a second computer system, one or more third computer systems, e.g., a first third computer system, a second third computer system, and a third second computer system, and a fourth computer system, and one or more fifth computer systems. In some examples, any of the first node 111 , the second node 112, the one or more network nodes 120, the one or more core network nodes 120, such as the first core network node 121 , the second core network node 122, and the third core network node 123, may be implemented as a standalone server in e.g., a host computer in the cloud 150, as depicted in the non-limiting example depicted in panel b) of Figure 7 for the first node 111 , the second node 112, and the one or more core network nodes 120, that is, the first core network node 121 , the second core network node 122, and the third core network node 123. Any of the first node 111 , the second node 112, the one or more network nodes 120, 140, the one or more core network nodes 120, such as the first core network node 121 , the second core network node 122, and the third core network node 123, and the one or more radio access network nodes 140 may in some examples be a distributed node or distributed server, with some of their respective functions being implemented locally, e.g., by a client manager, and some of their functions implemented in the cloud 150, by e.g., a server manager. In other examples, any of the first node 111 , the second node 112, the one or more network nodes 120, the one or more core network nodes 120, such as the first core network node 121 , the second core network node 122, and the third core network node 123, may also be implemented as processing resources in a server farm.

[0058] Yet in other examples, any of the first node 111 , the second node 112, the one or more network nodes 120, the one or more core network nodes 120, such as the first core network node 121 , the second core network node 122, and the third core network node 123, may also be implemented as virtual network functions, e.g., according to a Network Functions Virtualization (NFV) Architecture.

[0059] Any of the first node 111 , the second node 112, and the one or more network nodes 120, such as the first core network node 121 , the second core network node 122, and the third core network node 123 may be co-localized. However, in typical embodiments, the first node 111 , the second node 112, the one or more network nodes 120, 140, the one or more core network nodes 120, such as the first core network node 121 , the second core network node 122, and the third core network node 123, and the one or more radio access network nodes 140 may be different nodes.

[0060] The first node 111 be understood as an operator managed network analytics logical function. That is, as a node that may have a capability to handle data collection and analysis from different sources in the communications system 100. The first node 111 may interact with different entities for different purposes, such as to data collection provided by AMF, SMF, PCF, LIDM, AF, based on event subscription, directly or via a NEF, and OAM, retrieval of information from data repositories, e.g., UDR via UDM for subscriber-related information, retrieval of information about NFs, e.g., NRF for NF-related information, and NSSF for slice- related information, on demand provision of analytics to consumers, and storage in an Analytics Data Repository Function, e.g., ADRF, for two types of data: collected Data, e.g., Event Exposure data, and Analytics reports. As depicted in Figure 7, a non-limiting example of the first node 111 , wherein the communications system 100 may be a 5G network, may be an NWDAF. Another non-limiting example of the first node 111 may be a Management Data Analytics (MDA) or Management Data Analytics Function (MDAF).

[0061] The second node 112 may be understood as a node having a capability to consume a service offered by the first node 111. In a particular non-limiting example, wherein the communications system 100 may be a 5G network, the second node 112 may, in such examples be a Consumer NF.

[0062] As stated above, the one or more network nodes 120, 140 may be understood as any of the one or more core network nodes 120 or the one or more radio network nodes 140.

[0063] Any of the one or more core network nodes 120 may be understood to be network nodes operating a core network of the communications system 100.

[0064] The first core network node 121 may be a NF in the communications system 100. For example, 5GC NFs, e.g., PCF, AMF, SMF, UPF.

[0065] The second core network node 122 may be an OAM node. That is, the second network node 122 may be understood to be a node having a capability to manage processes and functions used in provisioning and managing the communications system 100 or element within the communications system 100. The third core network node 123 may be an NRF, that is, a node having a capability to store all the functions, e.g., 5GC NFs, in the communications system 100. The third core network node 123 may allow first core network nodes 121 , e.g., 5G NFs, to register and discover each other via a standards-based API.

[0066] Any of the one or more radio network nodes 140, which are represented in Figure 7 with a single radio network node 140, may typically be RAN NFs, e.g., a base station or Transmission Point (TP), or any other network unit capable to serve a wireless device or a machine type node in the communications system 100. The radio network node 140 may be e.g., a 5G gNB, a 4G eNB, or a radio network node in an alternative 5G radio access technology, e.g., fixed or WiFi, or newer system. The radio network node 140 may be e.g., a Wide Area Base Station, Medium Range Base Station, Local Area Base Station, and Home Base Station, based on transmission power and thereby also coverage size. The radio network node 140 may be a stationary relay node or a mobile relay node. The radio network node 140 may support one or several communication technologies, and its name may depend on the technology and terminology used. The radio network node 140 may be directly connected to one or more networks and / or one or more core networks.

[0067] The communications system 100 covers a geographical area which may be divided into cell areas, wherein each cell area may be served by a radio network node, although, one radio network node may serve one or several cells.

[0068] The communications system 100 may also comprise a one or more devices 160. Any of the one or more devices 160 may be also known as a e.g., user equipment (UE), wireless device, mobile terminal, wireless terminal and / or mobile station, mobile telephone, cellular telephone, or laptop with wireless capability, an Internet of Things (loT) device, or a Customer Premises Equipment (CPE), just to mention some further examples. The device 160 in the present context may be, for example, portable, pocket-storable, hand-held, computer- comprised, or a vehicle-mounted mobile device, enabled to communicate voice and / or data, via a RAN, with another entity, such as a server, a laptop, a Personal Digital Assistant (PDA), or a tablet, a Machine-to-Machine (M2M) device, an Internet of Things (loT) device, e.g., a sensor or a camera, a device equipped with a wireless interface, such as a printer or a file storage device, modem, Laptop Embedded Equipped (LEE), Laptop Mounted Equipment (LME), USB dongles, CPE or any other radio network unit capable of communicating over a radio link in the communications system 100. Any of the one or more devices 160 may be wireless, i.e., it may be enabled to communicate wirelessly in the communications system 100 and, in some particular examples, may be able support beamforming transmission. The communication may be performed e.g., between two devices, between a device and a radio network node, and / or between a device and a server. The communication may be performed e.g., via a RAN and possibly one or more core networks, comprised, respectively, within the communications system 100. The one or more devices 160 are depicted in Figure 7 with a single device to simplify the figure. However, it may be understood that more than the one or more devices 130 depicted in Figure 7 may be comprised in the communications system 100.

[0069] The first node 111 may communicate with the second node 112 over a first link 171 , e.g., a radio link or a wired link. The first node 111 may communicate with any of the one or more network nodes 120, 140 over a respective link, as exemplified next. The first node 111 may communicate with the first core network node 121 over a second link 172, e.g., a radio link or a wired link. The first node 111 may communicate with the second core network node 122 over a third link 173, e.g., a radio link or a wired link. The first node 111 may communicate with the third core network node 123 over a fourth link 174, e.g., a radio link or a wired link. The first node 111 may communicate with any of the one or more radio access network nodes 140 over a respective fifth link 175, e.g., a radio link or a wired link. Any of the one or more radio access network nodes 140 may communicate with any of the one or more devices 160 over a respective sixth link 176, e.g., a radio link.

[0070] Any of the first link 171 , the second link 172, the third link 173, the fourth link 174, the respective fifth link 175 and / or the respective sixth link 176 may be a direct link or it may go via one or more computer systems or one or more core networks in the communications system 100, or it may go via an optional intermediate network. The intermediate network may be one of, or a combination of more than one of, a public, private, or hosted network; the intermediate network, if any, may be a backbone network or the Internet, which is not shown in Figure 7.

[0071] Although terminology from Long Term Evolution (LTE) / 5G has been used in this disclosure to exemplify the embodiments herein, this should not be seen as limiting the scope of the embodiments herein to only the aforementioned system. Other wireless systems supporting similar or equivalent functionality may also benefit from exploiting the ideas covered within this disclosure.

[0072] As depicted in the non-limiting examples of Figure 7, in some embodiments wherein the communications system 100 may be a 5G system, the first node 111 may be an NWDAF or an MDA / MDAF, the second node 112 may be a Consumer NF, the first core network node 121 may be an NF, the second core network node 122 may be an GAM, the third core network node 123 may be an NRF, and any of the one or more radio access network nodes 140 may be a base station, e.g., a gNB may be an AS / AF. Any of the one or more devices 160 may be a UE.

[0073] In future telecommunication networks, e.g., in the sixth generation (6G), the terms used herein may need to be reinterpreted in view of possible terminology changes in future technologies. In general, the usage of “first”, “second”, “third”, “fourth”, “fifth” and / or “sixth” herein may be understood to be an arbitrary way to denote different elements or entities and may be understood to not confer a cumulative or chronological character to the nouns they modify.

[0074] Some of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. Other embodiments, however, are contained within the scope of the subject matter disclosed herein, the disclosed subject matter should not be construed as limited to only the embodiments set forth herein; rather, these embodiments are provided by way of example to convey the scope of the subject matter to those skilled in the art.

[0075] Embodiments of a computer-implemented method, performed by the first node 111 , will now be described with reference to the flowchart depicted in Figure 8. The method may be understood to be for handling signalling. The first node 111 operates in the communications system 100.

[0076] In some embodiments, the communications system 100 may be a 5G network.

[0077] Several embodiments are comprised herein. In some embodiments, all the actions may be performed. In some embodiments, some of the actions may be performed. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. A non-limiting example of the method performed by the first node 111 is depicted in Figure 8.

[0078] In Figure 8, optional actions are represented with dashed lines.

[0079] Action 801

[0080] According to embodiments herein, the first node 111 may be understood to provide a new service to determine whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100.

[0081] In this Action 801 , the first node 111 may receive a first indication from the second node 112. The first indication may request that the first node 111 determine whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100.

[0082] The receiving may be performed, e.g., via the first link 171.

[0083] The second node 112 may be understood to be a consumer of the new service provided by the first node 111 according to embodiments herein. In this Action 801 , the second node 112 may be understood to subscribe to the first node 111 to receive signaling storm analytics. In some embodiments, wherein the first node 111 is an NWDAF, the first indication may be a subscription to receive NWDAF signaling storm analytics. These analytics may be identified with an identifier, e.g., Analytic-ID=SignalingStorm.

[0084] In the embodiments wherein the first node 111 is an NWDAF, the first indication may be an Nnwdaf_AnalyticsSubscription_Request.

[0085] The first indication may comprise one or more of the following. According to a first option, the first indication may comprise a second indication indicating one or more filters to be applied in determining, as will be described later in Action 803, whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100. The second indication may be, e.g., an Analytic-Filter. The one or more filters may comprise one or more of: e.g. a certain DNN, Serving Network Slice Selection Assistance Information (S-NSSAI), and / or Area, a List of NF Instance I Dentifiers (IDs), NF Set IDs or NF type. For example, the second node 112 may be interested on Signaling Storm analytics for a specific DNN, slice (S-NSSAI) and / or a specific Area.

[0086] According to a second option, the first indication may comprise a third indication indicating one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may have to be determined. The one or more entities may be understood to be an analytic target, and the third indication may be an Analytic-Target. The analytic target may typically be any UE, but it may also be a list of UE-IDs or a group of UE-IDs, e.g., UE-Group-ID. The one or more entities may comprise accordingly, in the event that the one or more devices 160 may be of interest: a List of UE-ID, UE-Group-ID, anyUE. In other examples, the one or more entities may comprise target NF(s), e.g., a specific NF instance, such as SMF instance #X, or an NF type, such as SMF, which may be understood to mean all SMFs.

[0087] According to a third option, the first indication may comprise a fourth indication indicating one or more first thresholds of signalling per time unit to be used in determining 803 whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100. The fourth indication may be, for example, SignalingStormThreshold(s). By optionally providing the fourth indication, the second node 112 may provide a threshold, or set of thresholds, that when surpassed, may indicate there may be a signaling storm. The one or more thresholds may comprise, e.g., number of signaling messages per second on a per reference point basis, e.g., N7, and / or on a per service basis, e.g., Npcf_EventExposure service. When not provided, the first node 111 may determine if there may be a signaling storm based on locally configured thresholds.

[0088] In some embodiments, one or more granularities may be requested by the second node 112 in the first indication. The one or more granularities may be those with which the first node 111 may perform the analytics. The one or more granularities may comprise at least one of: per node basis, per reference point basis, per service basis, per PDU basis and per device 160 basis.

[0089] In a particular non-limiting example, the first indication may be an Nnwdaf_AnalyticsSubscription_Request message including the following parameters: i) Analytic-ID= SignalingStorm, ii) Analytic-Target=List of UE-ID, UE-Group-ID, anyllE, ill) Analytic-Filter= DNN, S-NSSAI, Area, List of NF Instance IDs, NF Set IDs or NF type, and optionally, iv) the SignalingStormThreshold(s).

[0090] The first node 111 may answer the first indication received in this Action 801 with a successful response accepting the request.

[0091] By receiving the first indication in this Action 801 , the first node 111 may enable that the second node 112, an NF in the communications system 100 may be able to request, on demand, analytics to detect or predict a signalling storm in the communications system 100. Particularly, by the receiving the first indication in this Action 801 , the first node 111 may be enabled to trigger data collection from the one or more network nodes 120, 140, based on the analytic subscription indicated, and eventually notify the second node 112 of the analytic requested.

[0092] Action 802

[0093] After receiving the first indication, the first node 111 may start collecting data from the one or more network nodes 120, 140.

[0094] In this Action 802, the first node 111 may send, responsive to the received first indication, a respective fifth indication to the at least one of the one or more core network nodes 120 and the one or more radio access network nodes 140. The respective fifth indication may request one or more respective indications.

[0095] The one or more respective indications may be understood to indicate an amount of signalling per time unit handled by a set of resources in the communications system 100.

[0096] The sending may be performed, e.g., via any of the second link 172, the third link 173, the fourth link 174 and / or the fifth link 175.

[0097] Signalling may be understood to comprise any message or indication exchanged between entities in the communications system 100. Particularly, signalling may be understood to refer to control messages. Even further particularly, signalling may refer to control messages between NFs in a 5G core network.

[0098] The set of resources may comprise any of nodes, reference points, services, PDUs and devices.

[0099] The one or more core network nodes 120 may comprise at least one of the one or more core network nodes 120 and the one or more radio access network nodes 140. Which of the one or more network nodes the respective fifth indication may be sent to in this Action 802 may be based on the received first indication.

[0100] Particularly, in a first group of examples, which of the one of one or more core network nodes 120 and one or more radio access network nodes 140 the respective fifth indication may be sent to may be based on the received second indication indicating the one or more filters to be applied in determining whether or not the signalling storm may have been detected or may be predicted to occur. For example, with the proviso the filter indicated by the second indication may indicate the one or more services, the first node 111 may send the respective fifth indication to the core network nodes 120. If the second indication indicates the second node 112 has set a filter for an NF type corresponding to core network NFs, e.g., UPF, the first node 111 may send the respective fifth indication to one of the one of one or more core network nodes 120, particularly, the first core network node 121. In another example, if the second indication indicates the second node 112 has set a filter for, for example, the NF Type being a UPF, the first node 111 may send the respective fifth indication to one of the one of one or more core network nodes 120, particularly, the second core network node 122. The first node 111 may request data collection from the second core network node 122, e.g., relative to performance measurements (PM), counters, and / or statistics for that NF Type, in the example, UPF, that is, for every UPF instance matching the filter. For example, if the filter also includes DNN and / or S-NSSAI, the second core network node 122 may be requested to provide PM counters, and / or statistics for all the UPF instances in that DNN / S-SNSSAI. In yet another example, if the second indication indicates the second node 112 has set a filter for, for example, the NF Type being a UPF, the first node 111 may send the respective fifth indication to one of the one of one or more core network nodes 120, particularly, the third core network node 123. The first node 111 may request data collection from the third core network node 123, e.g., relative to the NF Profile, e.g., 3GPP TS 29.510, v. 18.4.0, for that NF Type, in this example, UPF, that is, for every UPF instance matching the filter. For example, if the filter also includes DNN and / or S-NSSAI, the third core network node 123 may be requested to provide the NF Profile for every single UPF instance in that DNN and / or S-SNSSAI. In an additional example if the second indication indicates the second node 112 has set a filter for an NF type corresponding to RAN NFs, e.g., gNB, the first node 111 may send the respective fifth indication to one of the one or more radio access network nodes 140.

[0101] In a second group of examples, which of the one of one or more core network nodes 120 and one or more radio access network nodes 140 the respective fifth indication may be sent to may be based on the received third indication indicating the one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may have to be determined. For example, if the third indication indicates the second node 112 has indicated the one or more entities comprise the one or more devices 160, the first node 111 may send the respective fifth indication to any of the core network node 121 or the one or more radio network nodes 140. In another example, if the third indication indicates the second node has indicated the one or more entities do not comprise the one or more devices 160 or any devices, the first node 111 may send the respective fifth indication to the second core network node 122, as an alternative to sending the respective fifth indication to the first core network node 121.

[0102] Depending on which core network node 120 or radio access network node 140 the first node 111 may send the respective fifth indication to, a content of the respective fifth indication may vary.

[0103] The one or more core network nodes 120 may comprise the first core network node 121

[0104] The first node 111 may send the respective fifth indication to the first core network node 121 , e.g., the target 5GC NFs, such as PCF, AMF, SMF, UPF, to retrieve control plane related information, specifically, signaling generated on a per node basis, e.g., SMF, and / or on a per individual reference point basis, e.g., N7 for SMF, and / or on a per individual service basis, e.g., Nsmf EventExposure for SMF, and / or on a per PDll session on a per LIE-ID basis. The latter may be understood to offer more granularity to derive which PDU sessions / UE-IDs may contribute the most to the signaling generated at the different reference points / services.

[0105] In some embodiments, the respective fifth indication sent to the first core network node 121 may be a first message. The first message may request the subscription to an event. The subscription to the event may be to receive notifications of signalling information. For example, the first message may be an Nnf_EventExposure_Subscribe request message, e.g., triggered towards the target 5GC NF by the NWDAF. The first message may comprise a first identifier of the event, such as Event-ID=Signaling.

[0106] The first message may further comprise at least one of: i) a list indicating at least one of: an indication of one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, another indication of one or more services of the communications system 100 for which the amount of signalling may have to be analyzed and a further indication of one or more devices 160 operating in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the one or more granularities.

[0107] The list may be understood to indicate for which signaling reference points, services and / or UE-IDs the data may need to be collected, e.g., N4 and N7 reference point for SMF, Nsmf EventExposure service for SMF. When not present, data from all the NF signaling reference points / services, and for all UE-IDs, may be requested.

[0108] The one or more granularities may be understood to indicate a requested granularity, per node, per reference point, per service and / or per UE-ID. This may indicate the requested granularity, e.g., per service and per UE-ID. When not present, it may be understood to refer to signaling on a per global NF basis.

[0109] In a particular non-limiting example, the first message may be an Nnf_EventExposure_Subscribe request message comprising {i) Event-ID=Signalling, ii) optionally, a List of reference points and / or services and / or UE-IDs, iii) optionally, a Requested granularity (per reference point, per service and / or per UE-ID)}.

[0110] The one or more core network nodes 120 may comprise the second core network node 122

[0111] The first node 111 may send the respective fifth indication to the second core network node 122, e.g., OAM, to retrieve Performance Measurements for the relevant NF(s), specifically, NF resource usage and / or NF reference points / services counters. The NF resource usage may comprise a usage of assigned virtual resources currently in use for specific NF instance(s), such as mean usage of virtual Central Processing Unit (CPU), memory, disk, as defined in clause 5.7 of TS 28.552, v. 18.4.0.

[0112] The NF reference points / services counters may comprise OAM counters and / or statistics relative to the amount of signaling at the different reference points and / or services on a per NF basis. This may be considered as an alternative to collecting data from the first core network node 121 , e.g., the 5GC NF, in case there may be no need of per UE-ID granularity. Additionally, this may be done via an analytic from the first core network node 121 , as an MDAF and / or MDA.

[0113] In some embodiments, the respective fifth indication sent to the second core network node 122 may be a second message comprising at least one of the following: a) the indication, b) the another indication, c) one of: the one or more granularities, and the one or more granularities, as requested by the second node 112, and d) a request for a first further additional indication indicating a first load at the one or more entities.

[0114] The one or more core network nodes 120 may comprise the third core network node 123

[0115] In some embodiments, the one of one or more core network nodes 120 may comprise the third core network node 123, wherein the third core network node 123 may be a NRF. In some of such embodiments, the respective fifth indication sent to the third core network node 123 may be a third message comprising another request for a second further additional indication indicating a second load at the one or more entities.

[0116] For example, the third message may be, e.g., an Nnrf_NFManagement_NFStatusSubscribe request message including the target NF(s), e.g., indicated with NF Instance ID.

[0117] The first node 111 may send the respective fifth indication to the third core network node 123, e.g., an NRF, to retrieve information for the NF Profile for the relevant NF(s), specifically: NFLoad and / or NFStatus. The NFLoad may comprise a load of specific NF instance(s) in their NF profile as defined per TS 29.510, v. 18.4.0. The NFStatus may comprise a status of a specific NF instance(s), registered, suspended, undiscoverable, as defined per TS 29.510, v. 18.4.0.

[0118] The one or more radio network nodes 140

[0119] The first node 111 may send the respective fifth indication to one or more radio network nodes 140, e.g., target RAN NFs, e.g., gNB, to retrieve control plane related information, specifically signaling generated on a per node basis, and / or on a per individual reference point basis, e.g., data related to N1 / N2 reference points for gNB, and / or on a per PDU session on a per UE-ID basis. The latter may be understood to offer more granularity to derive which PDU sessions / UE-IDs may contribute the most to the signaling generated at the different reference points.

[0120] Action 803

[0121] In this Action 803, the first node 111 obtains, from the one or more network nodes 120, 140 operating in the communications system 100, one or more respective indications. The one or more respective indications indicate an amount of signalling per time unit handled by a set of resources in the communications system 100.

[0122] The amount of signalling may be e.g. number of messages and / or volume.

[0123] The time unit may be e.g., per second.

[0124] The obtaining in this Action 803 may be performed, e.g., via any of the second link 172, the third link 173, the fourth link 174 and / or the fifth link 175.

[0125] The obtaining in this Action 803 of the one or more respective indications may be performed in response to the received first indication.

[0126] The obtaining in this Action 803 of the one or more respective indications may be responsive to the sent respective fifth indication in Action 802.

[0127] As stated earlier, the one or more network nodes may comprise at least one of one or more core network nodes 120 and one or more radio access network nodes 140. At least one of the following may apply.

[0128] The one or more core network nodes 120 may comprise the first core network node 121

[0129] In some embodiments, the first node 111 may be an NWDAF, the one of one or more core network nodes 120 may comprise the first core network node 121 , the first core network node 121 may be a NF, and the obtaining in this Action 803 may be performed in response to a subscription to the event to receive notifications of signalling information. The subscription may indicate: i) the first identifier of the event, and one or more of: ii) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, iii) the another indication of the one or more services of the communications system 100 for which the amount of signalling may have to be analyzed, and iv) the further indication of the one or more devices 160 operating in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0130] In some embodiments, at least one of the following options may apply. According to a first option, the respective fifth indication sent to the first core network node 121 may be a first message. The first message may request the subscription to an event. For example, the first message may be an Nnf_EventExposure_Subscribe request message, e.g., triggered towards the target 5GC NF by the NWDAF. The first message may further comprise at least one of: i) a list indicating at least one of: an indication of one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, another indication of one or more services of the communications system 100 for which the amount of signalling may have to be analyzed and a further indication of one or more devices 160 operating in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the one or more granularities.

[0131] According to a second option, the one or more respective indications obtained from the first core network node 121 may further comprise the first identifier of the event, e.g., Event- ID= Signaling.

[0132] In some examples, the one or more respective indications may be obtained in an Nnf_EventExposure_Notify request message.

[0133] In some examples of embodiments wherein the first core network node 121 may be a 5GC NF, may continue gathering data for the Event-ID= Signaling and, at some point, e.g., periodic reporting, the 5GC NF may, in accordance with Action 1003 and Action 803, report data for the Event-ID= Signaling. To do that, the first core network node 121 may notify the first node 111 , e.g., the NWDAF, by triggering an Nnf_EventExposure_Notify request message including the following parameters: Event-ID= Signaling, and Signalinginfo. This may include the amount, e.g., number of messages and / or volume, of signaling per time unit, e.g., per second, on a per NF basis, on a per reference point basis, on a per service basis and / or on a per UE-ID, e.g., PDU session, basis, depending on the requested granularity.

[0134] The one or more core network nodes 120 may comprise the second core network node 122

[0135] In some embodiments, the first node 111 may be an NWDAF, or an MDAF, the one of one or more core network nodes 120 may comprise the second core network node 122, wherein the second core network node 122 may be an GAM node, and the one or more respective indications obtained from the second core network node 122 may comprise at least one of one or more counters and one or more statistics indicating at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the amount of signalling of the one or more services of the communications system 100 for which the amount of signalling may have to be analyzed.

[0136] In some examples of embodiments wherein the first node 111 may be an NWDAF, or an MDAF, the one of one or more core network nodes 120 may comprise the second core network node 122, and the second core network node 122 may be an OAM node, the one or more respective indications obtained from the second core network node 122 may comprise performance measurements for the relevant NF(s), specifically: NF resource usage and NF reference points and / or services counters. The NF resource usage may indicate a usage of assigned virtual resources currently in use for specific NF instance(s), such as, e.g., mean usage of virtual CPU, memory, disk, as defined in clause 5.7 of TS 28.552, v. 18.4.0. The NF reference points and / or services counters may indicate OAM counters and / or stats relative to the amount of signalling at the different reference points and / or services on a per NF basis. This may be considered as an alternative to collecting data from the first core network node 121 , e.g., 5GC NF, in case there may be no need of per UE-ID granularity. Additionally, this may be done via a MDAF and / or MDA analytic.

[0137] In some embodiments, the respective fifth indication sent to the second core network node 122 may comprise the request, and the obtaining in this Action 803 may comprise obtaining the first further additional indication from the second core network node 122.

[0138] The one or more core network nodes 120 may comprise the third core network node 123 In some embodiments, the one of one or more core network nodes 120 may comprise the third core network node 123, wherein the third core network node 123 may be an NRF. In some of such embodiments, the respective fifth indication sent to the third core network node 123 may be the third message comprising the another request for the second further additional indication indicating the second load at the one or more entities. In some of such embodiments, the one or more respective indications obtained from the third core network node 123 in this Action 803 may comprise the second further additional indication indicating the second load at the one or more entities. The second load may be, e.g., 5GC NF load.

[0139] In some examples of embodiments wherein the one of one or more core network nodes 120 may comprise the third core network node 123, and the third core network node 123 may be the NRF, the respective fifth indication may comprise information for the NF Profile for the relevant NF(s), such as, e.g., NF Instance ID.

[0140] In some examples of embodiments wherein the one of one or more core network nodes 120 may comprise the third core network node 123, and the third core network node 123 may be the NRF, the one or more respective indications may be comprised in a Nnrf_NFManagement_NFStatusNotify request message whereby the NRF may report the 5GC NF load and status. The Nnrf_NFManagement_NFStatusNotify request message may include the following information for the NF Profile for the relevant NF(s), specifically: NFLoad and NFStatus. The NFLoad may indicate the load of specific NF instance(s) in their NF profile as defined per TS 29.510, v. 18.4.0. The NFStatus may indicate the status of a specific NF instance(s), registered, suspended, undiscoverable, as defined per TS 29.510, v. 18.4.0.

[0141] The one or more radio network nodes 140

[0142] In some embodiments, the one or more respective indications obtained from the one or more radio access network nodes 140 may indicate at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the amount of signalling of the one or more devices 160 operating in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0143] In any of the embodiments, at least one of the following may apply. According to a first option, which of the one of one or more core network nodes 120 and one or more radio access network nodes 140 the one or more respective indications may be obtained from may be based on the received second indication.

[0144] According to a second option, which of the one of one or more core network nodes 120 and one or more radio access network nodes 140 the one or more respective indications may be obtained from may be based on the received third indication.

[0145] According to a third option, with the proviso the one or more entities indicated by the third indication indicate the one or more devices 160, the obtaining in Action 801 may comprise obtaining the one or more respective indications from the one or more radio access network nodes 140.

[0146] According to a fourth option, with the proviso the filter indicated by the second indication may indicate the one or more services, the obtaining in Action 803 may comprise obtaining the one or more respective indications from the core network nodes 120.

[0147] Action 804

[0148] In this Action 804, the first node 111 determines, based on the obtained one or more respective indications, whether or not a signalling storm has been detected or is predicted to occur in the communications system 100.

[0149] The determining in this Action 804 may be performed by one of: i) determining whether or not the amount of signalling per time unit handled by the set of resources in the communications system 100 may exceed one or more thresholds, and ii) machine learning methods.

[0150] The first node 111 may predict / detect whether or not a network signaling storm may have been detected or may be predicted to occur as follows. The first node 111 , may aggregate data collected from the one or more core network nodes 120 comprising a plurality of one or more first core network nodes 121 , the different NFs, e.g., for all PDll sessions at each reference point and / or service, and calculate the amount, e.g., number of messages, volume, of signaling per time unit, e.g., per second, at each reference point and / or service, e.g., for each reporting period. In case there may be an increasing trend, e.g., a prediction, or the resulting figure may exceed, e.g., detection, a certain threshold, which may be locally configured at the first node 111 or provided by the second node 112 on a per global basis or on a per individual reference point and / or service basis, the first node 111 may determines there may be a potential signaling storm originated at a certain reference point and / or service and for the corresponding NFs, at each side of the reference point or the NF acting as consumer of the NF service.

[0151] In some embodiments, the respective fifth indication sent to the second core network node 122 may comprise the request, the obtaining in Action 803 may comprise obtaining the first further additional indication from the second core network node 122, and the determining in this Action 804 may be further based on a first correlation between the indicated first load and the amount of signalling at the one or more entities. That is, Additionally, the first node 111 may correlate the signaling with the NF load and status to detect momentary signaling anomalies and long-term signaling trend deviations or changes.

[0152] In some embodiments, the one of one or more core network nodes 120 may comprise the third core network node 123, wherein the third core network node 123 may be a NRF. In some of such embodiments, the respective fifth indication sent to the third core network node 123 may be the third message comprising the another request for the second further additional indication indicating the second load at the one or more entities. In some of such embodiments, the one or more respective indications obtained from the third core network node 123 in Action 803 may comprise the second further additional indication indicating the second load at the one or more entities, and the determining in this Action 804 may be further based on a second correlation between the indicated second load and the amount of signalling at the one or more entities.

[0153] The determining in this Action 804 may be performed with the one or more granularities comprising at least one of: per node basis, per reference point basis, per service basis, per Protocol Data Unit, PDU, basis and per device 160 basis. In some examples, the first node 111 may determine a List of reference points and / or services and / or NFs for which the signaling storm may have been predicted and / or detected, possibly including the originating reference point and / or service and / or NF.

[0154] In some examples, the first node 111 may determine a List of UE-IDs which may contribute the most to the predicted and / or detected signaling storm.

[0155] In some examples, the first node 111 may determine one or more of: if there may have been a detection of momentary signaling anomalies, Long-term signaling trends, if there may have been a detection of long-term trend changes, etc. Based on the above analysis, the first node 111 may also provide recommendations to the second node 112, by indicating which specific actions the second node 112 may take, e.g., to remove PDU sessions on the NF / s where the predicted and / or detected signaling storm may be originated, to apply mitigation actions based on existing Service Based Interface (SBI) interface load and overload procedures, to trigger a change of network slice for PDU sessions for selected UE-ID, to influence on NF selection for new PDU sessions, etc.

[0156] The first node 111 may generate the analytic result, including a list of predicted and / or detected network signaling storm(s). Optionally, for each of the predicted and / or detected network signaling storm(s) one or more of: a) a list of reference points and / or services and / or NFs for which the signaling storm may have been predicted and / or detected, possibly including the originating reference point and / or service and / or NF, b) a list of UE-IDs which may contribute the most to the predicted and / or detected signaling storm, c) detection of momentary signaling anomalies, d) long-term signaling trends, e) detection of long-term trend changes, and f) based on the above analysis, the first node 111 may also provide recommendations to the second node 112, by indicating which specific actions the second node 112 may take, e.g., to remove PDU sessions on the NF / s where the predicted and / or detected signaling storm may be originated, to apply mitigation actions based on existing SBI interface load and overload procedures, to trigger a change of network slice for PDU sessions for selected UE-ID, to influence on NF selection for new PDU sessions, etc.

[0157] Action 805

[0158] In this Action 805, the first node 111 sends, with the proviso a result of the determining in Action 804 is that a signalling storm has been detected or is predicted to occur, an additional indication to the second node 112 operating in the communications system 100. The additional indication indicates a result of the determining in Action 804.

[0159] The additional indication may be, for example, an Nnwdaf_AnalyticsSubscription_Notify request.

[0160] The result may be, e.g., a parameter AnalyticResult.

[0161] The additional indication may indicate the identifier of the analytic, e.g., Analytic- ID=SignalingStorm.

[0162] The additional indication may be based on the one or more granularities.

[0163] In some embodiments, the additional indication may comprise at least one of: a) a list of one or more predicted or detected signalling storms, and b) for each of the one or more predicted or detected signalling storms: i) a list of reference points, of the one or more reference points, services, of the one or more services, and / or entities, for which a signalling storm may have been predicted or detected; this may optionally further include the originating reference point / service and / or NF, ii) a list of devices, of one or more devices 160, contributing the most to the one or more predicted or detected signalling storms, iii) a detection of momentary signalling anomalies, iv) long-term signalling trends, v) long-term trend changes, and vi) a recommendation to handle the one or more predicted or detected signalling storms. The recommendation may comprise a plurality of recommendations to the second node 112, by indicating which specific actions the second node 112 may take, e.g., to remove PDU sessions on the NF / s where the predicted / detected signaling storm may be originated, to apply mitigation actions based on existing SBI interface load and overload procedures, to trigger a change of network slice for PDU sessions for selected UE-ID, to influence on NF selection for new PDU sessions, etc.

[0164] In a particular non-limiting example, the additional indication may be an Nnwdaf_AnalyticsSubscription_Notify request comprising {Analytic-ID=SignalingStorm, AnalyticResult (including list of predicted / detected signalling storms, recommendations)}.

[0165] Embodiments of a computer-implemented method performed by the second node 112, will now be described with reference to the flowchart depicted in Figure 9. The method may be understood to be for handling the signalling. The second node 112 operates in the communications system 100.

[0166] The method may comprise the following actions. Several embodiments are comprised herein. In some embodiments, the method may comprise all the actions. In some embodiments, the method may comprise some of the actions. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. It should be noted that the examples herein are not mutually exclusive. Components from one example may be tacitly assumed to be present in another example and it will be obvious to a person skilled in the art how those components may be used in the other examples. In Figure 9, optional actions are depicted with dashed lines. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 and will thus not be repeated here to simplify the description. For example, in some examples, the amount of signalling per time unit may be, e.g., number of messages and / or volume per second.

[0167] Action 901

[0168] In this Action 901 , the second node 112 may send the first indication to the first node 111. The first indication may request that the first node 111 determine whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100. The first indication may comprise one or more of: i) the second indication indicating the one or more filters to be applied in determining whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100, ii) the third indication indicating the one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may have to be determined, and iii) the fourth indication indicating the one or more first thresholds of signalling per time unit to be used in determining whether or not a signalling storm may have been detected may be predicted to occur in the communications system 100.

[0169] Action 902

[0170] In this Action 902, the second node 112 receives, from the first node 111 operating in the communications system 100, the additional indication indicating the result of the determination of whether or not a signalling storm has been detected or has predicted to occur in the communications system 100. The determination has been performed by the first node 111 based on the one or more respective indications obtained by the first node 111 from the one or more network nodes 120, 140 operating in the communications system 100. The one or more respective indications indicate the amount of signalling per time unit handled by the set of resources in the communications system 100.

[0171] In some embodiments, the determining may have been performed with the one or more granularities comprising at least one of: per node basis, per reference point basis, per service basis, per PDU basis and per device 160 basis. The additional indication may be based on the one or more granularities.

[0172] In some embodiments, the receiving in this Action 902 of the additional indication may be responsive to, and based on, the sent first indication.

[0173] The one or more network nodes 120, 140 may comprise at least one of the one or more core network nodes 120 operating in the communications system 100 and the one or more radio access network nodes 140 operating in the communications system 100, and at least one of the following options may apply

[0174] According to a first option, the first node 111 may be an NWDAF, the one of one or more core network nodes 120 may comprise the first core network node 121 , and the first core network node 121 may be an NF. The receiving may be performed in response to the subscription to the event to receive notifications of signalling information. The subscription may indicates: i) the first identifier of the event, and one or more of: ii) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, iii) the another indication of the one or more services of the communications system 100 for which the amount of signalling may have to be analyzed, and iv) the further indication of the one or more devices 160 operating in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0175] According to a second option, the first node 111 may be an NWDAF, or an MDAF, the one of one or more core network nodes 120 may comprise the second core network node 122, the second core network node 122 may be an OAM node, and the one or more respective indications obtained from the second core network node 122 may comprise at least one of the one or more counters and the one or more statistics indicating at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the amount of signalling of the one or more services of the communications system 100 for which the amount of signalling may have to be analyzed.

[0176] According to a third option, the one or more respective indications obtained from the one or more radio access network nodes 140 may indicate at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the amount of signalling of the one or more devices 160 operating in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0177] In some embodiments, the additional indication may be further based on the first correlation between the first load and the amount of signalling at the one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may have been determined.

[0178] In some embodiments, the one of one or more core network nodes 120 may comprise the third core network node 123, and the third core network node 123 may be an NRF. The one or more respective indications obtained from the third core network node 123 may comprise the second further additional indication indicating the second load at the one or more entities. The additional indication may be further based on the second correlation between the indicated second load and the amount of signalling at the one or more entities.

[0179] In some embodiments, the additional indication may comprise at least one of: a) the list of the one or more predicted or detected signalling storms, b) for each of the one or more predicted or detected signalling storms: i) the list of reference points, of the one or more reference points, services, of the one or more services, and / or entities, for which a signalling storm may have been predicted or detected, ii) the list of devices, of the one or more devices 160, contributing the most to the one or more predicted or detected signalling storms, iii) the detection of momentary signalling anomalies, iv) the long-term signalling trends, v) the longterm trend changes, and vi) the recommendation to handle the one or more predicted or detected signalling storms. Action 903

[0180] In this Action 903, the second node 112 performs, e.g., applies, one or more actions based on the received additional indication, e.g., based on the Analytic-Result. The one or more actions may comprise, e.g., to remove PDll sessions on the NF(s) where the predicted and / or detected signaling storm may have originated, to apply other mitigation actions based on existing SBI interface load and overload procedures, to trigger a change of network slice for PDll sessions for selected UE-ID(s), e.g., the ones which may contribute the most to the signaling storm, to influence on NF selection for new PDU sessions, etc.

[0181] Embodiments of a computer-implemented method performed by the first core network node 121 , will now be described with reference to the flowchart depicted in Figure 10. The method may be understood to be for handling the signalling. The first core network node 121 is operating in the communications system 100.

[0182] The method may comprise the following actions. Several embodiments are comprised herein. In some embodiments, the method may comprise all the actions. In other embodiments, the method may comprise one or more actions. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. It should be noted that the examples herein are not mutually exclusive. Components from one example may be tacitly assumed to be present in another example and it will be obvious to a person skilled in the art how those components may be used in the other examples. In Figure 10, optional actions are depicted with dashed lines.

[0183] The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 and will thus not be repeated here to simplify the description. For example, in some examples, the amount of signalling per time unit may be, e.g., number of messages and / or volume per second.

[0184] Action 1001

[0185] In this Action 1001 , the first core network node 121 may receive the respective fifth indication from the first node 111. The respective fifth indication may request the one or more respective indications.

[0186] The respective fifth indication may be the subscription to the event to receive notifications of signalling information. The subscription may indicate: i) the first identifier of the event, and the one or more of: ii) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, iii) the another indication of one or more services of the communications system 100 for which the amount of signalling may have to be analyzed, and iv) the further indication of the one or more devices 160 operating in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0187] Action 1002

[0188] The first core network node 121 , in this Action 1002, may collect, responsive to the received respective fifth indication, first information indicating the amount of signalling per time unit handled by the set of resources in the communications system 100. In this Action 1002, in response to receiving the respective fifth indication, the first core network node 121 , e.g., the 5GC NF, may collect the first information as data based on the requested event. It may be noted that this data, that is, the first information, may include the amount, e.g., number of messages / volume, of signaling per time unit, e.g., per second, on a per NF basis, on a per reference point basis, on a per service basis and / or on a per UE-ID, e.g., PDU session, basis.

[0189] Action 1003

[0190] In this Action 1003, the first core network node 121 sends, to the first node 11 1 operating in the communications system 100, the one or more respective indications indicating the amount of signalling per time unit handled by the set of resources in the communications system 100. The first node 11 1 is an NWDAF, the first core network node 121 is an NF, and the sending in this Action 1003 is performed in response to the subscription to the event to receive notifications of signalling information. The subscription indicates: i) the first identifier of the event, and the one or more of: ii) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling is to be analyzed, iii) the another indication of one or more services of the communications system 100 for which the amount of signalling is to be analyzed, and iv) the further indication of the one or more devices 160 operating in the communications system 100 wherein the amount of signalling is to be analyzed.

[0191] The sent one or more respective indications are based on the collected first information in Action 1002.

[0192] The sending in this Action 1003 of the one or more respective indications may be responsive to the received respective fifth indication.

[0193] In some embodiments, at least one of the following may apply: a) the respective fifth indication received from the first node 11 1 may be the first message requesting the subscription to the event, wherein the first message may further comprise at least one of: i) the list indicating at least one of: the indication, the another indication and the further indication, and ii) the one or more granularities, and b) the one or more respective indications sent to the first node 1 11 may further comprise the first identifier. In some embodiments, the subscription to the event may indicate the one or more granularities comprising at least one of: per node basis, per reference point basis, per service basis, per PDU basis and per device 160 basis, and the one or more respective indications is further may be based on the one or more granularities.

[0194] Embodiments of a computer-implemented method performed by the second core network node 122, will now be described with reference to the flowchart depicted in Figure 11 . The method may be understood to be for handling the signalling. The second core network node 122 is operating in the communications system 110.

[0195] The method may comprise the following actions. Several embodiments are comprised herein. In some embodiments, the method may comprise all the actions. In other embodiments, the method may comprise one or more actions. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. It should be noted that the examples herein are not mutually exclusive. Components from one example may be tacitly assumed to be present in another example and it will be obvious to a person skilled in the art how those components may be used in the other examples. In Figure 11 , optional actions are depicted with dashed lines. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 and will thus not be repeated here to simplify the description. For example, in some examples, the amount of signalling per time unit may be, e.g., number of messages and / or volume per second.

[0196] Action 1101

[0197] In this Action 1101 , the second core network node 122 may receive the respective fifth indication from the first node 111. The respective fifth indication may request the one or more respective indications.

[0198] The respective fifth indication may be the second message comprising the at least one of: a) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, b) the another indication of the one or more services of the communications system 100 for which the amount of signalling may have to be analyzed, c) the one or more granularities, and d) the request for the first further additional indication indicating the first load at the one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may have to be determined. Action 1102

[0199] The second core network node 122, in this Action 1102, may collect, responsive to the received respective fifth indication, second information indicating the amount of signalling per time unit handled by the set of resources in the communications system 100.

[0200] The second information may comprise performance measurements for the relevant NF(s), specifically: NF resource usage and NF reference points and / or services counters. The NF resource usage may indicate a usage of assigned virtual resources currently in use for specific NF instance(s), such as, e.g., mean usage of virtual CPU, memory, disk, as defined in clause 5.7 of TS 28.552. The NF reference points and / or services counters may indicate OAM counters and / or stats relative to the amount of signalling at the different reference points and / or services on a per NF basis. This may be considered as an alternative to collecting data from the first core network node 121 , e.g., 5GC NF, in case there may be no need of per UE- ID granularity. Additionally, this may be done via a MDAF and / or MDA analytic.

[0201] Action 1103

[0202] In this Action 1103, the second core network node 122 sends, to the first node 111 operating in the communications system 100, the one or more respective indications indicating the amount of signalling per time unit handled by the set of resources in the communications system 100. The first node 111 is an NWDAF, or an MDAF, the second core network node 122 is an OAM node. The one or more respective indications sent by the second core network node 122 comprise at least the one of one or more counters and the one or more statistics indicating the at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling is to be analyzed, and ii) the amount of signalling of the one or more services of the communications system 100 for which the amount of signalling is to be analyzed.

[0203] The sent one or more respective indications may be based on the collected second information. The sending in this Action 1102 of the one or more respective indications may be responsive to the received respective fifth indication.

[0204] In some embodiments, the respective fifth indication may comprise the request, and the sending in this Action 1102 may comprise sending the first further additional indication.

[0205] In some embodiments, one or more respective indications may be based on and further indicate the one or more granularities comprising the at least one of: per node basis, per reference point basis, per service basis, per PDU basis and per device 160 basis.

[0206] Figure 12 is a schematic diagram depicting a non-limiting example of signalling between nodes in the communications system 100, according to embodiments herein. In Figure 12, the communications system 100 is a 5G network, the first node 111 is an NWDAF, the second node 112 is a Consumer NF, the first core network node 121 is a 5GC NF, the second core network node 122 is an OAM node and the third core network node 123 is an NRF. It may be therefore understood that any reference to the NWDAF in the description of Figure 12 may equally apply to the first node 111 , any reference to the consumer in the description of Figure 12 may equally apply to the second node 112, any reference to the 5GC NF in the description of Figure 12 may equally apply to the first core network node 121 , any reference to the OAM in the description of Figure 12 may equally apply to the second core network node 122, and any reference to the NRF in the description of Figure 12 may equally apply to the third core network node 123. Starting in panel a), in Steps 1 and 2), the second node 112, a consumer, subscribes, in accordance with Action 801 and Action 701 , to an NWDAF Signaling storm analytics (Analytic-ID=SignalingStorm), including as filter e.g., a certain DNN, S-NSSAI and / or Area, and the target NF(s), e.g., a specific NF instance, e.g., SMF instance #X, or an NF type, e.g., SMF, which may be understood to mean all UPFs. The analytic target may typically be any UE, but it may also be a list of UE-IDs or a group of UE-IDs, e.g., UE-Group- ID. For this, the consumer may trigger a Nnwdaf_AnalyticsSubscription_Request message including the following parameters: i) Analytic-ID= SignalingStorm, ii) Analytic-Target=List of LIE-ID, UE-Group-ID, anyllE, ill) Analytic-Filter= DNN, S-NSSAI, Area, List of NF Instance IDs, NF Set IDs or NF type; For example, the consumer may be interested on Signaling Storm analytics for a specific DNN, slice (S-NSSAI) and / or a specific Area, and iv) optionally, SignalingStormThreshold(s). The consumer may provide a threshold, or set of thresholds, that when surpassed, may indicate there may be a signaling storm, e.g., a number of signaling messages per second on a per reference point basis, e.g., N7, and / or on a per service basis, e.g., Npcf_EventExposure service. When not provided, the NWDAF may determine if there may be a signaling storm based on locally configured thresholds. In Step 3) the NWDAF may answer the request message in Step 2 with a successful response, accepting the request. In Steps 4 and 5), the NWDAF, in accordance with Action 702 and Action 901 , may trigger data collection from a plurality of first core network nodes 121 , the target 5GC NFs, e.g., PCF, AMF, SMF, UPF, depicted in Figure 12 as a single 5GC NF, to retrieve signaling related information, specifically, signaling generated on a per node basis, e.g., SMF, and / or on a per individual reference point basis, e.g., N7 for SMF, and / or on a per individual service basis, e.g., Nsmf EventExposure for SMF, and / or on a per PDll session on a per LIE-ID basis. The latter may be understood to offer more granularity to derive which PDU sessions / UE-IDs may contribute the most to the signaling generated at the different reference points / services. To do this, the NWDAF may trigger towards the target 5GC NF an Nnf_EventExposure_Subscribe request message, as respective fifth indication, including the following parameters: the first identifier of the event as Event-ID=Signaling, optionally, the indication of the one or more reference points, the another indication of the one or more services, and / or the further indication of one or more devices 160, as a List of reference points and / or services and / or UE-IDs. This may be understood to indicate, for which signaling reference points, services and / or UE-IDs, the data may need to be collected, e.g., N4 and N7 reference point for SMF, Nsmf EventExposure service for SMF. When not present, data from all the NF signaling reference points / services (and for all UE-IDs) may be requested. The respective fifth indication may optionally indicate the one or more granularities as a requested granularity, per node, per reference point, per service and / or per UE-ID. This may be understood to indicate the requested granularity, e.g., per service and per UE-ID. When not present, it may refer to signaling on a per global NF basis. Not shown in the example sequence diagram in Figure 12, but, optionally, the NWDAF may also trigger data collection from the one or more radio access network nodes 140, that is, the target RAN NFs, e.g., gNB, to, for example, retrieve data related to N1 / N2 reference points for the gNB. In Step 6), the 5GC NF, in accordance with Action 1002, may collect data based on the requested event. It may be noted that this data may include the amount, e.g., number of messages / volume, of signaling per time unit, e.g., per second, on a per NF basis, on a per reference point basis, on a per service basis and / or on a per UE-ID, e.g., PDU session, basis. In Step 7), the 5GC NF answers the request message in Step 5 with a successful response, accepting the request. In Step 8), the NWDAF, in accordance with Action 802 and Action 1101 , may trigger data collection from the GAM to retrieve, in accordance with Action 803, Action 1102 and Action 1103, the one or more respective indications comprising the second information. The second information may comprise performance measurements for the relevant NF(s), specifically: NF resource usage and NF reference points and / or services counters. The NF resource usage may indicate a usage of assigned virtual resources currently in use for specific NF instance(s), such as, e.g., mean usage of virtual CPU, memory, disk, as defined in clause 5.7 of TS 28.552, v. 18.4.0. The NF reference points and / or services counters may indicate GAM counters and / or stats relative to the amount of signalling at the different reference points and / or services on a per NF basis. This may be considered as an alternative to collecting data from the first core network node 121 , e.g., 5GC NF, in case there may be no need of per UE- ID granularity. Additionally, this may be done via a MDAF and / or MDA analytic. Continuing in panel b), in Steps 9 to 11), the NWDAF, in accordance with Action 802, may trigger data collection from the NRF, to retrieve the one or more respective indications as information for the NF Profile for the relevant NF(s) by triggering a Nnrf_NFManagement_NFStatusSubscribe request message including the target NF(s). In Steps 12 and 13), the first core network node 121 , that is, the 5GC NF, may continue gathering data for the Event-ID= Signaling and, at some point, e.g., periodic reporting, the 5GC NF may, in accordance with Action 1003 and Action 803, report data for the Event-ID= Signaling. To do that, the 5GC NF may notify the NWDAF by triggering an Nnf_EventExposure_ Notify request message including the following parameters: Event-ID= Signaling, and Signalinginfo. This may include the amount, e.g., number of messages and / or volume, of signaling per time unit, e.g., per second, on a per NF basis, on a per reference point basis, on a per service basis and / or on a per UE-ID, e.g., PDU session, basis, depending on the requested granularity. In Step 14), the NWDAF may answer the request message in Step 13 with a successful response, accepting the request. In Steps 15 and 16), the NRF, in accordance with Action 803, may report the 5GC NF load and status by triggering an Nnrf_NFManagement_NFStatusNotify request message including the following information for the NF Profile for the relevant NF(s), specifically: NFLoad and NFStatus. The NFLoad may indicate the load of specific NF instance(s) in their NF profile as defined per TS 29.510, v. 18.4.0. The NFStatus may indicate the status of a specific NF instance(s), registered, suspended, undiscoverable, as defined per TS 29.510, v. 18.4.0. Continuing in panel c), in Step 17), the NWDAF may answer the request message in Step 16 with a successful response, accepting the request. In Step 18), the NWDAF, in accordance with Action 804, based on the collected data, may run analytic processes, which may include the following. The NWDAF may predict / detect whether or not a network signaling storm may have been detected or may be predicted to occur as follows. The NWDAF, may aggregate data collected from the one or more core network nodes 120 comprising a plurality of one or more first core network nodes 121 , the different NFs, e.g., for all PDU sessions at each reference point and / or service, and calculate the amount, e.g., number of messages, volume, of signaling per time unit, e.g., per second, at each reference point and / or service, e.g., for each reporting period. In case there may be an increasing trend, e.g., a prediction, or the resulting figure may exceed, e.g., detection, a certain threshold, which may be locally configured at the NWDAF or provided by the second node 112 on a per global basis or on a per individual reference point and / or service basis, the NWDAF may determines there may be a potential signaling storm originated at a certain reference point and / or service and for the corresponding NFs, at each side of the reference point or the NF acting as consumer of the NF service. Additionally, the NWDAF may correlate the signaling with the NF load and status to detect momentary signaling anomalies and long-term signaling trend deviations or changes. In some examples, the NWDAF may determine a List of reference points and / or services and / or NFs for which the signaling storm may have been predicted and / or detected, possibly including the originating reference point and / or service and / or NF. In some examples, the NWDAF may determine a List of UE-IDs which may contribute the most to the predicted and / or detected signaling storm. In some examples, the NWDAF may determine one or more of: if there may have been a detection of momentary signaling anomalies, Longterm signaling trends, if there may have been a detection of long-term trend changes, etc. Based on the above analysis, the NWDAF may also provide recommendations to the consumer, by indicating which specific actions the consumer may take, e.g., to remove PDU sessions on the NF / s where the predicted and / or detected signaling storm may be originated, to apply mitigation actions based on existing Service Based Interface (SBI) interface load and overload procedures, to trigger a change of network slice for PDU sessions for selected LIE-ID, to influence on NF selection for new PDU sessions, etc. The NWDAF may generate the analytic result, including a list of predicted and / or detected network signaling storm(s). Optionally, for each of the predicted and / or detected network signaling storm(s) one or more of: a) a list of reference points and / or services and / or NFs for which the signaling storm may have been predicted and / or detected, possibly including the originating reference point and / or service and / or NF, b) a list of UE-IDs which may contribute the most to the predicted and / or detected signaling storm, c) detection of momentary signaling anomalies, d) long-term signaling trends, e) detection of long-term trend changes, and f) based on the above analysis, the NWDAF may also provide recommendations to the consumer, by indicating which specific actions the consumer may take, e.g., to remove PDU sessions on the NF / s where the predicted and / or detected signaling storm may be originated, to apply mitigation actions based on existing SBI interface load and overload procedures, to trigger a change of network slice for PDU sessions for selected UE-ID, to influence on NF selection for new PDU sessions, etc. In Step 19) Based on the above, the NWDAF, in accordance with Action 805 and Action 902, may notify the consumer by triggering a Nnwdaf_AnalyticsSubscription_Notify request message including the following parameters: a) Analytic-ID= SignalingStorm, and b) AnalyticResult. This may include, one or more of at least, the following information, which may have been stored in Step 18 above: a) a list of predicted and / or detected network signaling storm(s), and b) for each of the predicted and / or detected network signaling storm(s): the list of reference points and / or services and / or NFs for which the signaling storm has predicted / detected, possibly including the originating reference point and / or service and / or NF, the list of UE-IDs which contribute the most to the predicted and / or detected signaling storm, the detection of momentary signaling anomalies, the long-term signaling trends, the detection of long-term trend changes, and the recommendations. Based on the above analysis, the NWDAF may also provide recommendations to the consumer, by indicating which specific actions the consumer may take, e.g., to remove PDU sessions on the NF / s where the predicted and / or detected signaling storm may be originated, to apply mitigation actions based on existing SBI interface load and overload procedures, to trigger a change of network slice for PDU sessions for selected UE-ID, to influence on NF selection for new PDU sessions, etc. In Step 20), the consumer may answer the message in Step 19 with a successful response. In Step 21), in accordance with Action 903, based on the Analytic-Result, the consumer may apply the corresponding actions, e.g., to remove PDU sessions on the NF(s) where the predicted and / or detected signaling storm may have originated, to apply other mitigation actions based on existing SBI interface load and overload procedures, to trigger a change of network slice for PDll sessions for selected UE-ID(s), e.g., the ones which may contribute the most to the signaling storm, to influence on NF selection for new PDll sessions, etc.

[0207] As a summarized overview of the foregoing, embodiments herein may be understood to provide a process to predict, detect, prevent and mitigate network signaling storms this on a per global network basis, filtered, e.g., per area, DNN and / or slice, or on a per NF or NF group basis. The process may be based on defining a new NWDAF analytic. The NWDAF analytic may comprise both statistics and predictions.

[0208] Certain embodiments disclosed herein may provide one or more of the following technical advantage(s), which may be summarized as follows.

[0209] Embodiments herein may be understood to allow a network operator to predict, detect, prevent and mitigate network signaling storms.

[0210] Embodiments herein may be understood to also enable the network operator to detect momentary signaling anomalies and long-term signaling trend deviations or changes.

[0211] Figure 13 depicts an example of the arrangement that the first node 111 may comprise to perform the method described in Figure 8 and / or Figure 12. The first node 111 may be understood to be for handling the signalling. The first node 111 is configured to operate in the communications system 100.

[0212] Several embodiments are comprised herein. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 and will thus not be repeated here. For example, in some examples, the amount of signalling per time unit may be configured to be, e.g., number of messages and / or volume per second.

[0213] The first node 111 is configured to obtain, from the one or more network nodes 120, 140 configured to operate in the communications system 100, the one or more respective indications configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system 100. The first node 111 is also configured to determine, based on the one or more respective indications configured to be obtained, whether or not a signalling storm has been detected or is predicted to occur in the communications system 100.

[0214] The first node 111 is further configured to send, with the proviso the result of the determining is that a signalling storm has been detected or is predicted to occur, the additional indication to the second node 112 configured to operate in the communications system 100. The additional indication is configured to indicate the result of the determining.

[0215] In some embodiments, the determining may be configured to be performed: a) by one of: i) determining whether or not the amount of signalling per time unit handled by the set of resources in the communications system 100 exceeds the one or more thresholds, and ii) machine learning methods, and b) with the one or more granularities configured to comprise at least one of: per node basis, per reference point basis, per service basis, per PDU basis and per device 160 basis.

[0216] In some embodiments, the first node 111 may be further configured to receive the first indication from the second node 112. The first indication may be configured to request that the first node 111 determine whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100. The first indication may be configured to comprise one or more of: i) the second indication configured to indicate the one or more filters to be applied in determining whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100, ii) the third indication configured to indicate the one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may have to be determined, and iii) the fourth indication configured to indicate the one or more first thresholds of signalling per time unit to be used in determining whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100. The obtaining of the one or more respective indications may be configured to be performed in response to the first indication configured to be received.

[0217] In some embodiments, at least one of may be configured to apply: a) the additional indication may be configured to be based on the one or more granularities, and b) the one or more granularities may be configured to be requested by the second node 112 in the first indication.

[0218] In some embodiments, the one or more network nodes 120, 140 may be configured to comprise at least one of one or more core network nodes 120 and the one or more radio access network nodes 140 and at least one of the following options may apply. According to a first option, the first node 111 may be configured to be an NWDAF, the one of one or more core network nodes 120 may be configured to comprise the first core network node 121 , the first core network node 121 may be configured to be an NF, and the obtaining may be configured to be performed in response to the subscription to the event to receive notifications of signalling information. The subscription may be configured to indicate: i) the first identifier of the event, and one or more of: ii) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, iii) the another indication of one or more services of the communications system 100 for which the amount of signalling may have to be analyzed, and iv) the further indication of the one or more devices 160 configured to operate in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0219] According to a second option, the first node 111 may be configured to be an NWDAF, or an MDAF, the one of one or more core network nodes 120 may be configured to comprise a second core network node 122, the second core network node 122 may be configured to be an OAM node, and the one or more respective indications configured to be obtained from the second core network node 122 may be configured to comprise at least one of the one or more counters and the one or more statistics configured to indicate at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the amount of signalling of the one or more services of the communications system 100 for which the amount of signalling may have to be analyzed.

[0220] According to a third option, the one or more respective indications configured to be obtained from the one or more radio access network nodes 140 may be configured to indicate at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the amount of signalling of the one or more devices 160 configured to operate in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0221] In some embodiments, at least one of the following may apply: a) which of the one of the one or more core network nodes 120 and the one or more radio access network nodes 140 the one or more respective indications may be configured to be obtained from may be configured to be based on the second indication configured to be received, b) which of the one of the one or more core network nodes 120 and the one or more radio access network nodes 140 the one or more respective indications may be configured to be obtained from may be configured to be based on the third indication configured to be received, c) with the proviso the one or more entities configured to be indicated by the third indication may be configured to indicate the one or more devices 160, the obtaining may be configured to comprise obtaining the one or more respective indications from the one or more radio access network nodes 140, and d) with the proviso the filter configured to be indicated by the second indication may be configured to indicate the one or more services, the obtaining may be configured to comprise obtaining the one or more respective indications from the core network nodes 120. In some embodiments, the first node 111 may be further configured to send, responsive to the first indication configured to be received, the respective fifth indication to the at least one of the one or more core network nodes 120 and the one or more radio access network nodes 140. The respective fifth indication may be configured to request the one or more respective indications, and the obtaining of the one or more respective indications may be configured to be responsive to the respective fifth indication configured to be sent.

[0222] In some embodiments, at least one of the following may apply: a) the respective fifth indication configured to be sent to the first core network node 121 may be configured to be the first message configured to request the subscription to the event; the first message may be further configured to comprise at least one of: i) the list configured to indicate at least one of: the indication, the another indication and the further indication, and ii) the one or more granularities, and b) the one or more respective indications configured to be obtained from the first core network node 121 may be further configured to comprise the first identifier.

[0223] In some embodiments, the respective fifth indication configured to be sent to the second core network node 122 may be configured to be the second message configured to comprise at least one of: a) the indication, b) the another indication, c) the one of: i) the one or more granularities, and ii) the one or more granularities, as configured to be requested by the second node 112, and d) the request for the first further additional indication configured to indicate the first load at the one or more entities.

[0224] In some embodiments, the respective fifth indication configured to be sent to the second core network node 122 may be configured to comprise the request, the obtaining may be configured to comprise obtaining the first further additional indication from the second core network node 122, and the determining may be further configured to be based on the first correlation between the first load configured to be indicated and the amount of signalling at the one or more entities.

[0225] In some embodiments, the one of one or more core network nodes 120 may be configured to comprise the third core network node 123, the third core network node 123 may be configured to be an NRF, the respective fifth indication configured to be sent to the third core network node 123 may be configured to be the third message configured to comprise the another request for the second further additional indication configured to indicate the second load at the one or more entities. The one or more respective indications configured to be obtained from the third core network node 123 may be configured to comprise the second further additional indication configured to indicate the second load at the one or more entities, and the determining may be further configured to be based on the second correlation between the second load configured to be indicated and the amount of signalling at the one or more entities. In some embodiments, the additional indication may be configured to comprise at least one of: a) the list of one or more predicted or detected signalling storms, and b) for each of the one or more predicted or detected signalling storms: i) the list of reference points, of the one or more reference points, services, of the one or more services, and / or entities, for which a signalling storm may have been predicted or detected, ii) the list of devices, of the one or more devices 160, contributing the most to the one or more predicted or detected signalling storms, iii) the detection of momentary signalling anomalies, iv) the long-term signalling trends, v) the long-term trend changes, and vi) the recommendation to handle the one or more predicted or detected signalling storms.

[0226] The embodiments herein in the first node 111 may be implemented through one or more processors, such as a processing circuitry 1301 in the first node 111 depicted in Figure 13, together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the first node 111. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the first node 111.

[0227] The first node 111 may further comprise a memory 1302 comprising one or more memory units. The memory 1302 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the first node 111.

[0228] In some embodiments, the first node 111 may receive information from, e.g., the second node 112, the one or more network nodes 120, 140, the one or more core network nodes 120, the first core network node 121 , the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100, through a receiving port 1303. In some embodiments, the receiving port 1303 may be, for example, connected to one or more antennas in first node 111. In other embodiments, the first node 111 may receive information from another structure in the communications system 100 through the receiving port 1303. Since the receiving port 1303 may be in communication with the processing circuitry 1301 , the receiving port 1303 may then send the received information to the processing circuitry 1301 . The receiving port 1303 may also be configured to receive other information.

[0229] The processing circuitry 1301 in the first node 111 may be further configured to transmit or send information to e.g., the second node 112, the one or more network nodes 120, 140, the one or more core network nodes 120, the first core network node 121 , the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100, through a sending port 1304, which may be in communication with the processing circuitry 1301 , and the memory 1302.

[0230] Those skilled in the art will also appreciate that the units comprised within the first node 111 described above as being configured to perform different actions, may refer to a combination of analog and digital circuits, and / or one or more processors configured with software and / or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processing circuitry 1301 , perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC).

[0231] The first node 111 may be configured to perform any of the Actions described in relation to Figure 8 and / or Figure 12, e.g., by means of the processing circuitry 1301 within the first node 111 , configured to perform any of such actions.

[0232] Also, in some embodiments, different units comprised within the first node 111 may be configured to perform the different actions described above, implemented as one or more applications running on one or more processors such as the processing circuitry 1301.

[0233] Thus, the methods according to the embodiments described herein for the first node 111 may be respectively implemented by means of a computer program 1305 product, comprising instructions, i.e., software code portions, which, when executed on at least one processing circuitry 1301 , cause the at least one processing circuitry 1301 to carry out the actions described herein, as performed by the first node 111. The computer program 1305 product may be stored on a computer-readable storage medium 1306. The computer- readable storage medium 1306, having stored thereon the computer program 1305, may comprise instructions which, when executed on at least one processing circuitry 1301 , cause the at least one processing circuitry 1301 to carry out the actions described herein, as performed by the first node 111. In some embodiments, the computer-readable storage medium 1306 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 1305 product may be stored on a carrier containing the computer program 1305 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer-readable storage medium 1306, as described above.

[0234] The first node 111 may comprise a communication interface configured to facilitate, or an interface unit to facilitate, communications between the first node 111 and other nodes or devices, e.g., the second node 112, the one or more network nodes 120, 140, the one or more core network nodes 120, the first core network node 121 , the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100. The interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

[0235] In other embodiments, the first node 111 may comprise a radio circuitry 1307, which may comprise e.g., the receiving port 1303 and the sending port 1304.

[0236] The radio circuitry 1307 may be configured to set up and maintain at least a wireless connection with the second node 112, the one or more network nodes 120, 140, the one or more core network nodes 120, the first core network node 121 , the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100. Circuitry may be understood herein as a hardware component.

[0237] Hence, embodiments herein also relate to the first node 111 operative to operate in the communications system 100. The first node 111 may comprise the processing circuitry 1301 and the memory 1302, said memory 1302 containing instructions executable by said processing circuitry 1301 , whereby the first node 111 is further operative to perform the actions described herein in relation to the first node 111 , e.g., in Figure 8 and / or Figure 12.

[0238] Figure 14 depicts an example of the arrangement that the second node 112 may comprise to perform the method described in Figure 9 and / or Figure 12. The second node 112 may be understood to be for handling the signalling. The second node 112 is configured to operate in the communications system 100.

[0239] Several embodiments are comprised herein. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the second node 111 and will thus not be repeated here. For example, in some examples, the amount of signalling per time unit may be configured to be, e.g., number of messages and / or volume per second.

[0240] The second node 112 is configured to receive, from the first node 111 configured to operate in the communications system 100, the additional indication configured to indicate the result of the determination of whether or not the signalling storm has been detected or is predicted to occur in the communications system 100. The determination is configured to have been performed by the first node 111 based on the one or more respective indications configured to be obtained by the first node 111 from the one or more network nodes 120, 140 configured to operate in the communications system 100. The one or more respective indications are configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system 100.

[0241] The second node 112 is also configured to perform the one or more actions based on the additional indication configured to be received.

[0242] In some embodiments, the determining may be configured to have been performed with the one or more granularities configured to comprise at least one of: per node basis, per reference point basis, per service basis, per PDU basis and per device 160 basis, and the additional indication may be configured to be based on the one or more granularities.

[0243] The second node 112 may be additionally configured to send the first indication to the first node 111. The first indication may be configured to request that the first node 111 determine whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100. The first indication may be configured to comprise one or more of: i) the second indication configured to indicate the one or more filters to be applied in determining whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100, ii) the third indication configured to indicate the one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may have to be determined, and iii) the fourth indication configured to indicate the one or more first thresholds of signalling per time unit to be used in determining whether or not a signalling storm may have been detected or may be predicted to occur in the communications system 100. The receiving of the additional indication may be configured to be responsive to, and based on, the first indication configured to be sent.

[0244] In some embodiments, the additional indication may be further configured to be based on the first correlation between the first load and the amount of signalling at the one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may be configured to have been determined.

[0245] In some embodiments, the one or more network nodes 120, 140 may be configured to comprise at least one of one or more core network nodes 120 configured to operate in the communications system 100 and the one or more radio access network nodes 140 configured to operate in the communications system 100 and at least one of the following options may apply. According to a first option, the first node 111 may be configured to be an NWDAF, the one of one or more core network nodes 120 may be configured to comprise the first core network node 121 , the first core network node 121 may be configured to be an NF, and the receiving may be configured to be performed in response to the subscription to the event to receive notifications of signalling information. The subscription may be configured to indicate: i) the first identifier of the event, and one or more of: ii) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, iii) the another indication of one or more services of the communications system 100 for which the amount of signalling may have to be analyzed, and iv) the further indication of the one or more devices 160 configured to operate in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0246] According to a second option, the first node 111 may be configured to be an NWDAF, or an MDAF, the one of one or more core network nodes 120 may be configured to comprise the second core network node 122, the second core network node 122 may be configured to be an OAM node, and the one or more respective indications configured to be obtained from the second core network node 122 may be configured to comprise at least one of the one or more counters and the one or more statistics configured to indicate at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the amount of signalling of the one or more services of the communications system 100 for which the amount of signalling may have to be analyzed.

[0247] According to a third option, the one or more respective indications configured to be obtained from the one or more radio access network nodes 140 may be configured to indicate at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, and ii) the amount of signalling of the one or more devices 160 configured to operate in the communications system 100 wherein the amount of signalling may have to be analyzed.

[0248] In some embodiments, the one of one or more core network nodes 120 may be configured to comprise the third core network node 123, the third core network node 123 may be configured to be an NRF. The one or more respective indications configured to be obtained from the third core network node 123 may be configured to comprise the second further additional indication configured to indicate the second load at the one or more entities, and the additional indication may be further configured to be based on the second correlation between the second load configured to be indicated and the amount of signalling at the one or more entities.

[0249] In some embodiments, the additional indication may be configured to comprise at least one of: a) the list of one or more predicted or detected signalling storms, and b) for each of the one or more predicted or detected signalling storms: i) the list of reference points, of the one or more reference points, services, of the one or more services, and / or entities, for which a signalling storm may have been predicted or detected, ii) the list of devices, of the one or more devices 160, contributing the most to the one or more predicted or detected signalling storms, iii) the detection of momentary signalling anomalies, iv) the long-term signalling trends, v) the long-term trend changes, and vi) the recommendation to handle the one or more predicted or detected signalling storms.

[0250] The embodiments herein in the second node 112 may be implemented through one or more processors, such as a processing circuitry 1401 in the second node 112 depicted in Figure 14, together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the second node 112. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the second node 112.

[0251] The second node 112 may further comprise a memory 1402 comprising one or more memory units. The memory 1402 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the second node 112.

[0252] In some embodiments, the second node 112 may receive information from, e.g., the first node 111 , the one or more network nodes 120, 140, the one or more core network nodes 120, the first core network node 121 , the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100, through a receiving port 1403. In some embodiments, the receiving port 1403 may be, for example, connected to one or more antennas in second node 112. In other embodiments, the second node 112 may receive information from another structure in the communications system 100 through the receiving port 1403. Since the receiving port 1403 may be in communication with the processing circuitry 1401 , the receiving port 1403 may then send the received information to the processing circuitry 1401 . The receiving port 1403 may also be configured to receive other information.

[0253] The processing circuitry 1401 in the second node 112 may be further configured to transmit or send information to e.g., the first node 111 , the one or more network nodes 120, 140, the one or more core network nodes 120, the first core network node 121 , the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100, through a sending port 1404, which may be in communication with the processing circuitry 1401 , and the memory 1402. Those skilled in the art will also appreciate that the units comprised within the second node 112 described above as being configured to perform different actions, may refer to a combination of analog and digital circuits, and / or one or more processors configured with software and / or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processing circuitry 1401 , perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC).

[0254] The second node 112 may be configured to perform any of the Actions described in relation to Figure 9 and / or Figure 12, e.g., by means of the processing circuitry 1401 within the second node 112, configured to perform any of such actions.

[0255] Also, in some embodiments, different units comprised within the second node 112 may be configured to perform different actions described above, implemented as one or more applications running on one or more processors such as the processing circuitry 1401.

[0256] Thus, the methods according to the embodiments described herein for the second node 112 may be respectively implemented by means of a computer program 1405 product, comprising instructions, i.e., software code portions, which, when executed on at least one processing circuitry 1401 , cause the at least one processing circuitry 1401 to carry out the actions described herein, as performed by the second node 112. The computer program 1405 product may be stored on a computer-readable storage medium 1406. The computer- readable storage medium 1406, having stored thereon the computer program 1405, may comprise instructions which, when executed on at least one processing circuitry 1401 , cause the at least one processing circuitry 1401 to carry out the actions described herein, as performed by the second node 112. In some embodiments, the computer-readable storage medium 1406 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 1405 product may be stored on a carrier containing the computer program 1405 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer-readable storage medium 1406, as described above.

[0257] The second node 112 may comprise a communication interface configured to facilitate, or an interface unit to facilitate, communications between the second node 112 and other nodes or devices, e.g., the first node 111 , the one or more network nodes 120, 140, the one or more core network nodes 120, the first core network node 121 , the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100. The interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

[0258] In other embodiments, the second node 112 may comprise a radio circuitry 1407, which may comprise e.g., the receiving port 1403 and the sending port 1404.

[0259] The radio circuitry 1407 may be configured to set up and maintain at least a wireless connection with the first node 111 , the one or more network nodes 120, 140, the one or more core network nodes 120, the first core network node 121 , the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100. Circuitry may be understood herein as a hardware component.

[0260] Hence, embodiments herein also relate to the second node 112, operative to operate in the communications system 100. The second node 112 may comprise the processing circuitry 1401 and the memory 1402, said memory 1402 containing instructions executable by said processing circuitry 1401 , whereby the second node 112 is further operative to perform the actions described herein in relation to the second node 112, e.g., in Figure 9 and / or Figure 12.

[0261] Figure 15 depicts an example of the arrangement that the first core network node 121 may comprise to perform the method described in Figure 10 and / or Figure 12. The first core network node 121 may be understood to be for handling the signalling. The first core network node 121 is configured to operate in the communications system 100.

[0262] Several embodiments are comprised herein. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the second node 111 and will thus not be repeated here. For example, in some examples, the amount of signalling per time unit may be configured to be, e.g., number of messages and / or volume per second.

[0263] The first core network node 121 is configured to send, to the first node 111 configured to operate in the communications system 100, the one or more respective indications configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system 100. The first node 111 is configured to be an NWDAF, the first core network node 121 is configured to be an NF, and the sending is configured to be performed in response to the subscription to the event to receive notifications of the signalling information. The subscription is configured to indicate: i) the first identifier of the event, and one or more of: ii) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling is to be analyzed, iii) the another indication of the one or more services of the communications system 100 for which the amount of signalling is to be analyzed, and iv) the further indication of the one or more devices 160 configured to operate in the communications system 100 wherein the amount of signalling is to be analyzed.

[0264] In some embodiments, the subscription to the event may be configured to indicate the one or more granularities comprising at least one of: per node basis, per reference point basis, per service basis, per PDU basis and per device 160 basis, and the one or more respective indications may be further configured to be based on the one or more granularities.

[0265] The first core network node 121 may be additionally configured with the two following configurations.

[0266] The first core network node 121 may be also configured to receive the respective fifth indication from the first node 111. The respective fifth indication may be configured to request the one or more respective indications. The sending of the one or more respective indications may be configured to be responsive to the respective fifth indication configured to be received.

[0267] The first core network node 121 may be additionally configured to collect, responsive to the respective fifth indication configured to be received, the first information configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system 100. The one or more respective indications configured to be sent may be configured to be based on the first information configured to be collected.

[0268] In some embodiments, at least one of the following may apply: a) the respective fifth indication configured to be received from the first node 111 may be configured to be the first message configured to request the subscription to the event, and the first message may be further configured to comprise at least one of: i) the list configured to indicate at least one of: the indication, the another indication and the further indication, and ii) the one or more granularities, and b) the one or more respective indications configured to be sent to the first node 111 may be further configured to comprise the first identifier.

[0269] The embodiments herein in the first core network node 121 may be implemented through one or more processors, such as a processing circuitry 1501 in the first core network node 121 depicted in Figure 15, together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the first core network node 121 . One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the first core network node 121 .

[0270] The first core network node 121 may further comprise a memory 1502 comprising one or more memory units. The memory 1502 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the first core network node 121 .

[0271] In some embodiments, the first core network node 121 may receive information from, e.g., the first node 111 , the second node 112, the one or more network nodes 120, 150, the one or more core network nodes 120, the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100, through a receiving port 1503. In some embodiments, the receiving port 1503 may be, for example, connected to one or more antennas in first core network node 121 . In other embodiments, the first core network node 121 may receive information from another structure in the communications system 100 through the receiving port 1503. Since the receiving port 1503 may be in communication with the processing circuitry 1501 , the receiving port 1503 may then send the received information to the processing circuitry 1501. The receiving port 1503 may also be configured to receive other information.

[0272] The processing circuitry 1501 in the first core network node 121 may be further configured to transmit or send information to e.g., the first node 111 , the second node 112, the one or more network nodes 120, 150, the one or more core network nodes 120, the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100, through a sending port 1504, which may be in communication with the processing circuitry 1501 , and the memory 1502.

[0273] Those skilled in the art will also appreciate that the units comprised within the first core network node 121 described above as being configured to perform different actions, may refer to a combination of analog and digital circuits, and / or one or more processors configured with software and / or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processing circuitry 1501 , perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC).

[0274] The first core network node 121 may be configured to perform any of the Actions described in relation to Figure 10 and / or Figure 12, e.g., by means of the processing circuitry 1501 within the first core network node 121 , configured to perform any of such actions. Also, in some embodiments, different units comprised within the first core network node 121 may be configured to perform different actions described above, implemented as one or more applications running on one or more processors such as the processing circuitry 1501.

[0275] Thus, the methods according to the embodiments described herein for the first core network node 121 may be respectively implemented by means of a computer program 1505 product, comprising instructions, i.e., software code portions, which, when executed on at least one processing circuitry 1501 , cause the at least one processing circuitry 1501 to carry out the actions described herein, as performed by the first core network node 121 . The computer program 1505 product may be stored on a computer-readable storage medium 1506. The computer-readable storage medium 1506, having stored thereon the computer program 1505, may comprise instructions which, when executed on at least one processing circuitry 1501 , cause the at least one processing circuitry 1501 to carry out the actions described herein, as performed by the first core network node 121 . In some embodiments, the computer-readable storage medium 1506 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 1505 product may be stored on a carrier containing the computer program 1505 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer-readable storage medium 1506, as described above.

[0276] The first core network node 121 may comprise a communication interface configured to facilitate, or an interface unit to facilitate, communications between the first core network node 121 and other nodes or devices, e.g., the first node 111 , the second node 112, the one or more network nodes 120, 150, the one or more core network nodes 120, the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100. The interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

[0277] In other embodiments, the first core network node 121 may comprise a radio circuitry 1507, which may comprise e.g., the receiving port 1503 and the sending port 1504.

[0278] The radio circuitry 1507 may be configured to set up and maintain at least a wireless connection with the first node 111 , the second node 112, the one or more network nodes 120, 150, the one or more core network nodes 120, the second core network node 122, third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100. Circuitry may be understood herein as a hardware component.

[0279] Hence, embodiments herein also relate to the first core network node 121 , operative to operate in the communications system 100. The first core network node 121 may comprise the processing circuitry 1501 and the memory 1502, said memory 1502 containing instructions executable by said processing circuitry 1501 , whereby the first core network node 121 is further operative to perform the actions described herein in relation to the first core network node 121 , e.g., in Figure 10 and / or Figure 12.

[0280] Figure 16 depicts an example of the arrangement that the second core network node 122 may comprise to perform the method described in Figure 11 and / or Figure 12. The second core network node 122 may be understood to be for handling the signalling. The second core network node 122 is configured to operate in the communications system 100.

[0281] Several embodiments are comprised herein. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the second node 111 and will thus not be repeated here. For example, in some examples, the amount of signalling per time unit may be configured to be, e.g., number of messages and / or volume per second.

[0282] The second core network node 122 is configured to send, to the first node 111 configured to operate in the communications system 100, the one or more respective indications configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system 100. The first node 111 is configured to be an NWDAF, or an MDAF, the second core network node 122 is configured to be an OAM node, and the one or more respective indications configured to be sent by the second core network node 122 are configured to comprise at least one of the one or more counters and the one or more statistics configured to indicate at least one of: i) the amount of signalling of the one or more reference points in the communications system 100 wherein the amount of signalling is to be analyzed, and ii) the amount of signalling of the one or more services of the communications system 100 for which the amount of signalling is to be analyzed.

[0283] In some embodiments, the one or more respective indications may be configured to be based on and may be further configured to indicate the one or more granularities configured to comprise at least one of: per node basis, per reference point basis, per service basis, per PDU basis and per device 160 basis.

[0284] The second core network node 122 may be additionally configured with the two following configurations. The second core network node 122 may be also configured to receive the respective fifth indication from the first node 111. The respective fifth indication may be configured to request the one or more respective indications. The sending of the one or more respective indications may be configured to be responsive to the respective fifth indication configured to be received.

[0285] The second core network node 122 may be additionally configured to collect, responsive to the respective fifth indication configured to be received, the second information configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system 100. The one or more respective indications configured to be sent may be configured to be based on the second information configured to be collected.

[0286] In some embodiments, the respective fifth indication may be configured to be the second message configured to comprise at least one of: a) the indication of the one or more reference points in the communications system 100 wherein the amount of signalling may have to be analyzed, b) the another indication of one or more services of the communications system 100 for which the amount of signalling may have to be analyzed, c) the one or more granularities, and d) the request for the first further additional indication configured to indicate the first load at the one or more entities wherein whether or not the signalling storm may have been detected or may be predicted to occur may have to be determined.

[0287] In some embodiments, the respective fifth indication may be configured to comprise the request, and the sending may be configured to comprise sending the first further additional indication.

[0288] The embodiments herein in the second core network node 122 may be implemented through one or more processors, such as a processing circuitry 1601 in the second core network node 122 depicted in Figure 16, together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the second core network node 122. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the second core network node 122.

[0289] The second core network node 122 may further comprise a memory 1602 comprising one or more memory units. The memory 1602 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the second core network node 122.

[0290] In some embodiments, the second core network node 122 may receive information from, e.g., the first node 111 , the second node 112, the one or more network nodes 120, 160, the one or more core network nodes 120, the first core network node 121 , third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100, through a receiving port 1603. In some embodiments, the receiving port 1603 may be, for example, connected to one or more antennas in second core network node 122. In other embodiments, the second core network node 122 may receive information from another structure in the communications system 100 through the receiving port 1603. Since the receiving port 1603 may be in communication with the processing circuitry 1601 , the receiving port 1603 may then send the received information to the processing circuitry 1601. The receiving port 1603 may also be configured to receive other information.

[0291] The processing circuitry 1601 in the second core network node 122 may be further configured to transmit or send information to e.g., the first node 111 , the second node 112, the one or more network nodes 120, 160, the one or more core network nodes 120, the first core network node 121 , third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100, through a sending port 1604, which may be in communication with the processing circuitry 1601 , and the memory 1602.

[0292] Those skilled in the art will also appreciate that the units comprised within the second core network node 122 described above as being configured to perform different actions, may refer to a combination of analog and digital circuits, and / or one or more processors configured with software and / or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processing circuitry 1601 , perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC).

[0293] The second core network node 122 may be configured to perform any of the Actions described in relation to Figure 11 and / or Figure 12, e.g., by means of the processing circuitry 1601 within the second core network node 122, configured to perform any of such actions.

[0294] Also, in some embodiments, different units comprised within the second core network node 122 may be configured to perform different actions described above, implemented as one or more applications running on one or more processors such as the processing circuitry 1601.

[0295] Thus, the methods according to the embodiments described herein for the second core network node 122 may be respectively implemented by means of a computer program 1605 product, comprising instructions, i.e., software code portions, which, when executed on at least one processing circuitry 1601 , cause the at least one processing circuitry 1601 to carry out the actions described herein, as performed by the second core network node 122. The computer program 1605 product may be stored on a computer-readable storage medium 1606. The computer-readable storage medium 1606, having stored thereon the computer program 1605, may comprise instructions which, when executed on at least one processing circuitry 1601 , cause the at least one processing circuitry 1601 to carry out the actions described herein, as performed by the second core network node 122. In some embodiments, the computer- readable storage medium 1606 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 1605 product may be stored on a carrier containing the computer program 1605 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer-readable storage medium 1606, as described above.

[0296] The second core network node 122 may comprise a communication interface configured to facilitate, or an interface unit to facilitate, communications between the second core network node 122 and other nodes or devices, e.g., the first node 111 , the second node 112, the one or more network nodes 120, 160, the one or more core network nodes 120, the first core network node 121 , third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100. The interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

[0297] In other embodiments, the second core network node 122 may comprise a radio circuitry 1607, which may comprise e.g., the receiving port 1603 and the sending port 1604.

[0298] The radio circuitry 1607 may be configured to set up and maintain at least a wireless connection with the first node 111 , the second node 112, the one or more network nodes 120, 160, the one or more core network nodes 120, the first core network node 121 , third core network node 123, the one or more radio access network nodes 140, the one or more devices 160, another node or user equipment, and / or another structure in the communications system 100. Circuitry may be understood herein as a hardware component.

[0299] Hence, embodiments herein also relate to the second core network node 122, operative to operate in the communications system 100. The second core network node 122 may comprise the processing circuitry 1601 and the memory 1602, said memory 1602 containing instructions executable by said processing circuitry 1601 , whereby the second core network node 122 is further operative to perform the actions described herein in relation to the second core network node 122, e.g., in Figure 11 and / or Figure 12.

[0300] Embodiments herein may also comprise the communications system 100 comprising one or more of: the first node 111 configured as described in relation to Figure 13, the second node 112 configured as described in relation to Figure 14, the first core network node 121 configured as described in relation to Figure 15 and the second core network node 122 configured as described in relation to Figure 16.

[0301] When using the word "comprise" or “comprising”, it shall be interpreted as non- limiting, i.e., meaning "consist at least of".

[0302] The embodiments herein are not limited to the above-described preferred embodiments. Various alternatives, modifications and equivalents may be used. Therefore, the above embodiments should not be taken as limiting the scope of the invention.

[0303] Generally, all terms used herein are to be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is clearly given and / or is implied from the context in which it is used. All references to a / an / the element, apparatus, component, means, step, etc. are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless a step is explicitly described as following or preceding another step and / or where it is implicit that a step must follow or precede another step. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, wherever appropriate. Likewise, any advantage of any of the embodiments may apply to any other embodiments, and vice versa. Other objectives, features and advantages of the enclosed embodiments will be apparent from the following description.

[0304] As used herein, the expression “at least one of:” followed by a list of alternatives separated by commas, and wherein the last alternative is preceded by the “and” term, may be understood to mean that only one of the list of alternatives may apply, more than one of the list of alternatives may apply or all of the list of alternatives may apply. This expression may be understood to be equivalent to the expression “at least one of:” followed by a list of alternatives separated by commas, and wherein the last alternative is preceded by the “or” term.

[0305] Any of the terms processor and circuitry may be understood herein as a hardware component.

[0306] As used herein, the expression “in some embodiments” has been used to indicate that the features of the embodiment described may be combined with any other embodiment or example disclosed herein.

[0307] As used herein, the expression “in some examples” has been used to indicate that the features of the example described may be combined with any other embodiment or example disclosed herein. REFERENCES

[0308] 1 . 3GPP TS 23.501 v18.3.0 (Sept 2023): System architecture for the 5G System (5GS).

[0309] 2. 3GPP TS 23.288 v18.3.0 (Sept 2023): Architecture enhancements for 5G System (5GS) to support network data analytics services. 3. 3GPP Rel19 SID on Artificial Intelligence (AI)ZMachine Learning (ML) for 5GS Service to enable 5GC and Air interface Intelligence (Sept 2023).

Claims

CLAIMS:1 . A computer-implemented method, performed by a first node (1 11 ), for handling signalling, the first node (11 1 ) operating in a communications system (100), the method comprising:- obtaining (803), from one or more network nodes (120, 140) operating in the communications system (100), one or more respective indications indicating an amount of signalling per time unit handled by a set of resources in the communications system (100),- determining (804), based on the obtained one or more respective indications, whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), and- sending (805), with the proviso a result of the determining (804) is that a signalling storm has been detected or is predicted to occur, an additional indication to a second node (112) operating in the communications system (100), the additional indication indicating a result of the determining (804).

2. The method according to claim 1 , wherein the determining (804) is performed: a. by one of: i. determining whether or not the amount of signalling per time unit handled by the set of resources in the communications system (100) exceeds one or more thresholds, and ii. machine learning methods, and b. with one or more granularities comprising at least one of: per node basis, per reference point basis, per service basis, per Protocol Data Unit, PDU, basis and per device (160) basis.

3. The method according to any of claims 1 -2, further comprising:- receiving (801 ) a first indication from a second node (1 12), the first indication requesting that the first node (11 1 ) determine whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), wherein the first indication comprises one or more of: i. a second indication indicating one or more filters to be applied in determining (803) whether or not a signalling storm has been detected or is predicted to occur in the communications system (100),ii. a third indication indicating one or more entities wherein whether or not the signalling storm has been detected or is predicted to occur is to be determined, and ill. a fourth indication indicating one or more first thresholds of signalling per time unit to be used in determining (803) whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), and wherein the obtaining (803) of the one or more respective indications is performed in response to the received first indication.

4. The method according to claims 2 and 3, wherein at least one of: a. the additional indication is based on the one or more granularities, and b. the one or more granularities are requested by the second node (112) in the first indication.

5. The method according to any of claims 1 -4, wherein the one or more network nodes (120, 140) comprise at least one of one or more core network nodes (120) and one or more radio access network nodes (140) and wherein at least one of: ii. the first node (111) is a Network Data Analytics Function, NWDAF, the one of one or more core network nodes (120) comprise a first core network node (121 ), wherein the first core network node (121 ) is a Network Function, NF, and wherein the obtaining (803) is performed in response to a subscription to an event to receive notifications of signalling information, and wherein the subscription indicates: i. a first identifier of the event, and one or more of: ii. an indication of one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, ill. another indication of one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. a further indication of one or more devices (160) operating in the communications system (100) wherein the amount of signalling is to be analyzed, and ill. the first node (111) is an NWDAF, or a Management Data Analytics Function, MDAF, the one of one or more core network nodes (120) comprise a second core network node (122), wherein the second core network node (122) is an Operations and Management, OAM, node, and wherein one or more respective indications obtained from the second core network node (122)comprise at least one of one or more counters and one or more statistics indicating at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of the one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. the one or more respective indications obtained from the one or more radio access network nodes (140) indicate at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of one or more devices (160) operating in the communications system (100) wherein the amount of signalling is to be analyzed.

6. The method according to claim 5, wherein at least one of: a. which of the one of one or more core network nodes (120) and one or more radio access network nodes (140) the one or more respective indications are obtained from is based on the received second indication, b. which of the one of one or more core network nodes (120) and one or more radio access network nodes (140) the one or more respective indications are obtained from is based on the received third indication, c. with the proviso the one or more entities indicated by the third indication indicate the one or more devices (160), the obtaining (801 ) comprises obtaining the one or more respective indications from the one or more radio access network nodes (140), and d. with the proviso the filter indicated by the second indication indicates the one or more services, the obtaining (803) comprises obtaining the one or more respective indications from the core network nodes (120).

7. The method according to any of claims 3 or 4 and 5 or 6, further comprising:- sending (802), responsive to the received first indication, a respective fifth indication to the at least one of the one or more core network nodes (120) and the one or more radio access network nodes (140), the respective fifth indication requesting one or more respective indications, and wherein the obtaining (803) ofthe one or more respective indications is responsive to the sent respective fifth indication.

8. The method according to claims 2, 5 or 6 and claim 7, wherein at least one of: a. the respective fifth indication sent to the first core network node (121 ) is a first message requesting the subscription to the event, the first message further comprising at least one of: i. a list indicating at least one of: the indication, the another indication and the further indication, and ii. the one or more granularities, and b. the one or more respective indications obtained from the first core network node (121) further comprise the first identifier.

9. The method according to claims 2, 5 or 6 and claim 7 or 8, wherein the respective fifth indication sent to the second core network node (122) is a second message comprising at least one of: a. the indication, b. the another indication, c. one of: i. the one or more granularities, and ii. the one or more granularities, as requested by the second node (112), and d. a request for a first further additional indication indicating a first load at the one or more entities.

10. The method according to claim 9, wherein the respective fifth indication sent to the second core network node (122) comprises the request, the obtaining (803) comprises obtaining the first further additional indication from the second core network node (122), and wherein the determining (804) is further based on a first correlation between the indicated first load and the amount of signalling at the one or more entities.11 . The method according to claims 2 and 5 or 6 and claim 7-10, wherein the one of one or more core network nodes (120) comprise a third core network node (123), wherein the third core network node (123) is a Network Resource Function, NRF, wherein the respective fifth indication sent to the third core network node (123) is a third message comprising another request for a second further additional indication indicating a second load at the one or more entities, wherein the one or more respective indicationsobtained from the third core network node (123) comprise the second further additional indication indicating the second load at the one or more entities, and wherein the determining (804) is further based on a second correlation between the indicated second load and the amount of signalling at the one or more entities.

12. The method according to any of claims 5-11 , wherein the additional indication comprises at least one of: a. a list of one or more predicted or detected signalling storms, and b. for each of the one or more predicted or detected signalling storms: i. a list of reference points, of the one or more reference points, services, of the one or more services, and / or entities, for which a signalling storm has been predicted or detected, ii. a list of devices, of one or more devices (160), contributing the most to the one or more predicted or detected signalling storms, ill. a detection of momentary signalling anomalies, iv. long-term signalling trends, v. long-term trend changes, and vi. a recommendation to handle the one or more predicted or detected signalling storms.

13. A computer-implemented method, performed by a second node (112), for handling signalling, the second node (112) operating in a communications system (100), the method comprising:- receiving (902), from a first node (111) operating in the communications system (100), an additional indication indicating a result of a determination of whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), the determination having been performed by the first node (111 ) based on one or more respective indications obtained by the first node (111) from one or more network nodes (120, 140) operating in the communications system (100), wherein the one or more respective indications indicate an amount of signalling per time unit handled by a set of resources in the communications system (100), and- performing (903) one or more actions based on the received additional indication.

14. The method according to claim 13, wherein the determining has been performed with one or more granularities comprising at least one of: per node basis, per reference pointbasis, per service basis, per Protocol Data Unit, PDU, basis and per device (160) basis, and wherein the additional indication is based on the one or more granularities.

15. The method according to any of claims 13-14, further comprising:- sending (901 ) a first indication to the first node (111 ), the first indication requesting that the first node (11 1 ) determine whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), wherein the first indication comprises one or more of: i. a second indication indicating one or more filters to be applied in determining whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), ii. a third indication indicating one or more entities wherein whether or not the signalling storm has been detected or is predicted to occur is to be determined, and ill. a fourth indication indicating one or more first thresholds of signalling per time unit to be used in determining whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), and wherein the receiving (902) of the additional indication is responsive to, and based on, the sent first indication.

16. The method according to claim 15, wherein the additional indication is further based on a first correlation between a first load and the amount of signalling at the one or more entities wherein whether or not the signalling storm has been detected or is predicted to occur has been determined.

17. The method according to any of claims 13-16, wherein the one or more network nodes (120, 140) comprise at least one of one or more core network nodes (120) operating in the communications system (100) and one or more radio access network nodes (140) operating in the communications system (100), and wherein at least one of: ii. the first node (11 1 ) is a Network Data Analytics Function, NWDAF, the one of one or more core network nodes (120) comprise a first core network node (121 ), wherein the first core network node (121 ) is a Network Function, NF, and wherein the receiving is performed in response to a subscription to an event to receive notifications of signalling information, and wherein the subscription indicates: i. a first identifier of the event, and one or more of:ii. an indication of one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, ill. another indication of one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. a further indication of one or more devices (160) operating in the communications system (100) wherein the amount of signalling is to be analyzed, ill. the first node (111) is an NWDAF, or a Management Data Analytics Function, MDAF, the one of one or more core network nodes (120) comprise a second core network node (122), wherein the second core network node (122) is an Operations and Management, OAM, node, and wherein one or more respective indications obtained from the second core network node (122) comprise at least one of one or more counters and one or more statistics indicating at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of the one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. the one or more respective indications obtained from the one or more radio access network nodes (140) indicate at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of one or more devices (160) operating in the communications system (100) wherein the amount of signalling is to be analyzed.

18. The method according to claim 17, wherein the one of one or more core network nodes (120) comprise a third core network node (123), wherein the third core network node (123) is a Network Resource Function, NRF, wherein the one or more respective indications obtained from the third core network node (123) comprise a second further additional indication indicating a second load at the one or more entities, and wherein the additional indication is further based on a second correlation between the indicated second load and the amount of signalling at the one or more entities.

19. The method according to any of claims 13-16 and any of claims 17-18, wherein the additional indication comprises at least one of: a. a list of one or more predicted or detected signalling storms, and b. for each of the one or more predicted or detected signalling storms: i. a list of reference points, of the one or more reference points, services, of the one or more services, and / or entities, for which a signalling storm has been predicted or detected, ii. a list of devices, of the one or more devices (160), contributing the most to the one or more predicted or detected signalling storms, ill. a detection of momentary signalling anomalies, iv. long-term signalling trends, v. long-term trend changes, and vi. a recommendation to handle the one or more predicted or detected signalling storms.

20. A computer-implemented method, performed by a first core network node (121), for handling signalling, the first core network node (121 ) operating in a communications system (100), the method comprising:- sending (1003), to a first node (111) operating in the communications system (100), one or more respective indications indicating an amount of signalling per time unit handled by a set of resources in the communications system (100), wherein the first node (111 ) is a Network Data Analytics Function, NWDAF, the first core network node (121 ) is a Network Function, NF, and wherein the sending (1003) is performed in response to a subscription to an event to receive notifications of signalling information, and wherein the subscription indicates: i. a first identifier of the event, and one or more of: ii. an indication of one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, ill. another indication of one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. a further indication of one or more devices (160) operating in the communications system (100) wherein the amount of signalling is to be analyzed.21 . The method according to claim 20, wherein the subscription to the event indicates one or more granularities comprising at least one of: per node basis, per reference point basis, per service basis, per Protocol Data Unit, PDU, basis and per device (160) basis,and wherein the one or more respective indications are further based on the one or more granularities.

22. The method according to any of claims 20-21 , further comprising:- receiving (1001) a respective fifth indication from the first node (111), the respective fifth indication requesting the one or more respective indications, and wherein the sending (1003) of the one or more respective indications is responsive to the received respective fifth indication, and- collecting (1002), responsive to the received respective fifth indication, first information indicating the amount of signalling per time unit handled by the set of resources in the communications system (100), and wherein the sent one or more respective indications are based on the collected first information.

23. The method according to claim 22, wherein at least one of: a. the respective fifth indication received from the first node (111) is a first message requesting the subscription to the event, the first message further comprising at least one of: i. a list indicating at least one of: the indication, the another indication and the further indication, and ii. the one or more granularities, and b. the one or more respective indications sent to the first node (111) further comprise the first identifier.

24. A computer-implemented method, performed by a second core network node (122), for handling signalling, the second core network node (122) operating in a communications system (100), the method comprising:- sending (1103), to a first node (111) operating in the communications system (100), one or more respective indications indicating an amount of signalling per time unit handled by a set of resources in the communications system (100), wherein the first node (111 ) is an NWDAF, or a Management Data Analytics Function, MDAF, the second core network node (122) is an Operations and Management, OAM, node, and wherein one or more respective indications sent by the second core network node (122) comprise at least one of one or more counters and one or more statistics indicating at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, andii. the amount of signalling of the one or more services of the communications system (100) for which the amount of signalling is to be analyzed.

25. The method according to claim 24, wherein one or more respective indications are based on and further indicate one or more granularities comprising at least one of: per node basis, per reference point basis, per service basis, per Protocol Data Unit, PDU, basis and per device (160) basis.

26. The method according to any of claims 24-25, further comprising:- receiving (1101) a respective fifth indication from the first node (111), the respective fifth indication requesting the one or more respective indications, and wherein the sending (1103) of the one or more respective indications is responsive to the received respective fifth indication, and- collecting (1102), responsive to the received respective fifth indication, second information indicating the amount of signalling per time unit handled by the set of resources in the communications system (100), and wherein the sent one or more respective indications are based on the collected second information.

27. The method according to claims 25 and 26, wherein the respective fifth indication is a second message comprising at least one of: a. an indication of one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, b. another indication of one or more services of the communications system (100) for which the amount of signalling is to be analyzed, c. the one or more granularities, and d. a request for a first further additional indication indicating a first load at one or more entities wherein whether or not the signalling storm has been detected or is predicted to occur is to be determined.

28. The method according to claim 27, wherein the respective fifth indication comprises the request, and wherein the sending (1103) comprises sending the first further additional indication.

29. A first node (111), for handling signalling, the first node (111) being configured to operate in a communications system (100), the first node (111) being further configured to:- obtain, from one or more network nodes (120, 140) configured to operate in the communications system (100), one or more respective indications configured to indicate an amount of signalling per time unit handled by a set of resources in the communications system (100),- determine, based on the one or more respective indications configured to be obtained, whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), and- send, with the proviso a result of the determining is that a signalling storm has been detected or is predicted to occur, an additional indication to a second node (112) configured to operate in the communications system (100), the additional indication being configured to indicate a result of the determining.

30. The first node (111 ) according to claim 29, wherein the determining is configured to be performed: a. by one of: i. determining whether or not the amount of signalling per time unit handled by the set of resources in the communications system (100) exceeds one or more thresholds, and ii. machine learning methods, and b. with one or more granularities configured to comprise at least one of: per node basis, per reference point basis, per service basis, per Protocol Data Unit, PDU, basis and per device (160) basis.31 . The first node (111 ) according to any of claims 29-30, being further configured to:- receive a first indication from a second node (112), the first indication being configured to request that the first node (111) determine whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), wherein the first indication is configured to comprise one or more of: i. a second indication configured to indicate one or more filters to be applied in determining whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), ii. a third indication configured to indicate one or more entities wherein whether or not the signalling storm has been detected or is predicted to occur is to be determined, and ill. a fourth indication configured to indicate one or more first thresholds of signalling per time unit to be used in determining whether or not asignalling storm has been detected or is predicted to occur in the communications system (100), and wherein the obtaining of the one or more respective indications is configured to be performed in response to the first indication configured to be received.

32. The first node (111 ) according to claims 30 and 31 , wherein at least one of: a. the additional indication is configured to be based on the one or more granularities, and b. the one or more granularities are configured to be requested by the second node (112) in the first indication.

33. The first node (111 ) according to any of claims 29-32, wherein the one or more network nodes (120, 140) are configured to comprise at least one of one or more core network nodes (120) and one or more radio access network nodes (140) and wherein at least one of: ii. the first node (111 ) is configured to be a Network Data Analytics Function, NWDAF, the one of one or more core network nodes (120) being configured to comprise a first core network node (121), wherein the first core network node (121 ) is configured to be a Network Function, NF, and wherein the obtaining is configured to be performed in response to a subscription to an event to receive notifications of signalling information, and wherein the subscription is configured to indicate: i. a first identifier of the event, and one or more of: ii. an indication of one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, ill. another indication of one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. a further indication of one or more devices (160) configured to operate in the communications system (100) wherein the amount of signalling is to be analyzed, and ill. the first node (111) is configured to be an NWDAF, or a Management Data Analytics Function, MDAF, the one of one or more core network nodes (120) are configured to comprise a second core network node (122), wherein the second core network node (122) is configured to be an Operations and Management, OAM, node, and wherein one or more respective indications configured to be obtained from the second core network node (122) areconfigured to comprise at least one of one or more counters and one or more statistics configured to indicate at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of the one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. the one or more respective indications configured to be obtained from the one or more radio access network nodes (140) are configured to indicate at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of one or more devices (160) configured to operate in the communications system (100) wherein the amount of signalling is to be analyzed.

34. The first node (111 ) according to claim 33, wherein at least one of: a. which of the one of one or more core network nodes (120) and one or more radio access network nodes (140) the one or more respective indications are configured to be obtained from is configured to be based on the second indication configured to be received, b. which of the one of one or more core network nodes (120) and one or more radio access network nodes (140) the one or more respective indications are configured to be obtained from is configured to be based on the third indication configured to be received, c. with the proviso the one or more entities configured to be indicated by the third indication are configured to indicate the one or more devices (160), the obtaining is configured to comprise obtaining the one or more respective indications from the one or more radio access network nodes (140), and d. with the proviso the filter configured to be indicated by the second indication is configured to indicate the one or more services, the obtaining is configured to comprise obtaining the one or more respective indications from the core network nodes (120).

35. The first node (111 ) according to any of claims 31 or 32 and 33 or 34, being further configured to:- send, responsive to the first indication configured to be received, a respective fifth indication to the at least one of the one or more core network nodes (120) and the one or more radio access network nodes (140), the respective fifth indication being configured to request one or more respective indications, and wherein the obtaining of the one or more respective indications is configured to be responsive to the respective fifth indication configured to be sent.

36. The first node (111 ) according to claims 30, 33 or 34 and claim 35, wherein at least one of: a. the respective fifth indication configured to be sent to the first core network node (121) is configured to be a first message configured to request the subscription to the event, the first message being further configured to comprise at least one of: i. a list configured to indicate at least one of: the indication, the another indication and the further indication, and ii. the one or more granularities, and b. the one or more respective indications configured to be obtained from the first core network node (121 ) are further configured to comprise the first identifier.

37. The first node (111 ) according to claims 30, 33 or 34 and claim 35 or 36, wherein the respective fifth indication configured to be sent to the second core network node (122) is configured to be a second message configured to comprise at least one of: a. the indication, b. the another indication, c. one of: i. the one or more granularities, and ii. the one or more granularities, as configured to be requested by the second node (112), and d. a request for a first further additional indication configured to indicate a first load at the one or more entities.

38. The first node (111 ) according to claim 37, wherein the respective fifth indication configured to be sent to the second core network node (122) is configured to comprise the request, the obtaining is configured to comprise obtaining the first further additional indication from the second core network node (122), and wherein the determining isfurther configured to be based on a first correlation between the first load configured to be indicated and the amount of signalling at the one or more entities.

39. The first node (111 ) according to claims 30 and 33 or 34 and claim 35-38, wherein the one of one or more core network nodes (120) are configured to comprise a third core network node (123), wherein the third core network node (123) is configured to be a Network Resource Function, NRF, wherein the respective fifth indication configured to be sent to the third core network node (123) is configured to be a third message configured to comprise another request for a second further additional indication configured to indicate a second load at the one or more entities, wherein the one or more respective indications configured to be obtained from the third core network node (123) are configured to comprise the second further additional indication configured to indicate the second load at the one or more entities, and wherein the determining is further configured to be based on a second correlation between the second load configured to be indicated and the amount of signalling at the one or more entities.

40. The first node (111 ) according to any of claims 33-39, wherein the additional indication is configured to comprise at least one of: a. a list of one or more predicted or detected signalling storms, and b. for each of the one or more predicted or detected signalling storms: i. a list of reference points, of the one or more reference points, services, of the one or more services, and / or entities, for which a signalling storm has been predicted or detected, ii. a list of devices, of one or more devices (160), contributing the most to the one or more predicted or detected signalling storms, ill. a detection of momentary signalling anomalies, iv. long-term signalling trends, v. long-term trend changes, and vi. a recommendation to handle the one or more predicted or detected signalling storms.41 . A second node (1 12), for handling signalling, the second node (1 12) being configured to operate in a communications system (100), the second node (1 12) being further configured to:- receive, from a first node (1 11 ) configured to operate in the communications system (100), an additional indication configured to indicate a result of a determination of whether or not a signalling storm has been detected or ispredicted to occur in the communications system (100), the determination being configured to have been performed by the first node (111) based on one or more respective indications configured to be obtained by the first node (111) from one or more network nodes (120, 140) configured to operate in the communications system (100), wherein the one or more respective indications are configured to indicate an amount of signalling per time unit handled by a set of resources in the communications system (100), and- perform one or more actions based on the additional indication configured to be received.

42. The second node (112) according to claim 41 , wherein the determining is configured to have been performed with one or more granularities configured to comprise at least one of: per node basis, per reference point basis, per service basis, per Protocol Data Unit, PDU, basis and per device (160) basis, and wherein the additional indication is configured to be based on the one or more granularities.

43. The second node (112) according to any of claims 41 -42, being further configured to:- Send a first indication to the first node (111), the first indication being configured to request that the first node (111) determine whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), wherein the first indication is configured to comprise one or more of: i. a second indication configured to indicate one or more filters to be applied in determining whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), ii. a third indication configured to indicate one or more entities wherein whether or not the signalling storm has been detected or is predicted to occur is to be determined, and ill. a fourth indication configured to indicate one or more first thresholds of signalling per time unit to be used in determining whether or not a signalling storm has been detected or is predicted to occur in the communications system (100), and wherein the receiving of the additional indication is configured to be responsive to, and based on, the first indication configured to be sent.

44. The second node (112) according to claim 43, wherein the additional indication is further configured to be based on a first correlation between a first load and the amountof signalling at the one or more entities wherein whether or not the signalling storm has been detected or is predicted to occur is configured to have been determined.

45. The second node (1 12) according to any of claims 41 -44, wherein the one or more network nodes (120, 140) are configured to comprise at least one of one or more core network nodes (120) configured to operate in the communications system (100) and one or more radio access network nodes (140) configured to operate in the communications system (100), and wherein at least one of: ii. the first node (11 1 ) is configured to be a Network Data Analytics Function, NWDAF, the one of one or more core network nodes (120) are configured to comprise a first core network node (121 ), wherein the first core network node (121 ) is configured to be a Network Function, NF, and wherein the receiving is configured to be performed in response to a subscription to an event to receive notifications of signalling information, and wherein the subscription is configured to indicate: i. a first identifier of the event, and one or more of: ii. an indication of one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, ill. another indication of one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. a further indication of one or more devices (160) configured to operate in the communications system (100) wherein the amount of signalling is to be analyzed, ill. the first node (11 1 ) is configured to be an NWDAF, or a Management Data Analytics Function, MDAF, the one of one or more core network nodes (120) are configured to comprise a second core network node (122), wherein the second core network node (122) is configured to be an Operations and Management, OAM, node, and wherein one or more respective indications configured to be obtained from the second core network node (122) are configured to comprise at least one of one or more counters and one or more statistics configured to indicate at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of the one or more services of the communications system (100) for which the amount of signalling is to be analyzed, andiv. the one or more respective indications configured to be obtained from the one or more radio access network nodes (140) are configured to indicate at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of one or more devices (160) configured to operate in the communications system (100) wherein the amount of signalling is to be analyzed.

46. The second node (1 12) according to claim 45, wherein the one of one or more core network nodes (120) are configured to comprise a third core network node (123), wherein the third core network node (123) is configured to be a Network Resource Function, NRF, wherein the one or more respective indications configured to be obtained from the third core network node (123) are configured to comprise a second further additional indication configured to indicate a second load at the one or more entities, and wherein the additional indication is further configured to be based on a second correlation between the second load configured to be indicated and the amount of signalling at the one or more entities.

47. The second node (1 12) according to any of claims 41 -44 and any of claims 45-46, wherein the additional indication is configured to comprise at least one of: a. a list of one or more predicted or detected signalling storms, and b. for each of the one or more predicted or detected signalling storms: i. a list of reference points, of the one or more reference points, services, of the one or more services, and / or entities, for which a signalling storm has been predicted or detected, ii. a list of devices, of the one or more devices (160), contributing the most to the one or more predicted or detected signalling storms, ill. a detection of momentary signalling anomalies, iv. long-term signalling trends, v. long-term trend changes, and vi. a recommendation to handle the one or more predicted or detected signalling storms.

48. A first core network node (121), for handling signalling, the first core network node (121 ) being configured to operate in a communications system (100), the first core network node (121) being further configured to:- send, to a first node (111) configured to operate in the communications system (100), one or more respective indications configured to indicate an amount of signalling per time unit handled by a set of resources in the communications system (100), wherein the first node (111 ) is configured to be a Network Data Analytics Function, NWDAF, the first core network node (121 ) is configured to be a Network Function, NF, and wherein the sending is configured to be performed in response to a subscription to an event to receive notifications of signalling information, and wherein the subscription is configured to indicate: i. a first identifier of the event, and one or more of: ii. an indication of one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, ill. another indication of one or more services of the communications system (100) for which the amount of signalling is to be analyzed, and iv. a further indication of one or more devices (160) configured to operate in the communications system (100) wherein the amount of signalling is to be analyzed.

49. The first core network node (121) according to claim 48, wherein the subscription to the event is configured to indicate one or more granularities comprising at least one of: per node basis, per reference point basis, per service basis, per Protocol Data Unit, PDU, basis and per device (160) basis, and wherein the one or more respective indications are further configured to be based on the one or more granularities.

50. The first core network node (121) according to any of claims 48-49, being further configured to:- receive a respective fifth indication from the first node (111), the respective fifth indication being configured to request the one or more respective indications, and wherein the sending of the one or more respective indications is configured to be responsive to the respective fifth indication configured to be received, and- collect, responsive to the respective fifth indication configured to be received, first information configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system (100), and wherein the one or more respective indications configured to be sent are configured to be based on the first information configured to be collected.51 . The first core network node (121) according to claim 50, wherein at least one of: a. the respective fifth indication configured to be received from the first node (111) is configured to be a first message configured to request the subscription to the event, the first message being further configured to comprise at least one of: i. a list configured to indicate at least one of: the indication, the another indication and the further indication, and ii. the one or more granularities, and b. the one or more respective indications configured to be sent to the first node (111) are further configured to comprise the first identifier.

52. A second core network node (122), for handling signalling, the second core network node (122) being configured to operate in a communications system (100), the second core network node (122) being further configured to:- send, to a first node (111) configured to operate in the communications system (100), one or more respective indications configured to indicate an amount of signalling per time unit handled by a set of resources in the communications system (100), wherein the first node (111 ) is configured to be an NWDAF, or a Management Data Analytics Function, MDAF, the second core network node (122) is configured to be an Operations and Management, OAM, node, and wherein one or more respective indications configured to be sent by the second core network node (122) are configured to comprise at least one of one or more counters and one or more statistics configured to indicate at least one of: i. the amount of signalling of the one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, and ii. the amount of signalling of the one or more services of the communications system (100) for which the amount of signalling is to be analyzed.

53. The second core network node (122) according to claim 52, wherein the one or more respective indications are configured to be based on and are further configured to indicate one or more granularities configured to comprise at least one of: per node basis, per reference point basis, per service basis, per Protocol Data Unit, PDU, basis and per device (160) basis.

54. The second core network node (122) according to any of claims 52-53, being further configured to:- receive a respective fifth indication from the first node (111), the respective fifth indication being configured to request the one or more respective indications, and wherein the sending of the one or more respective indications is configured to be responsive to the respective fifth indication configured to be received, and- collect, responsive to the respective fifth indication configured to be received, second information configured to indicate the amount of signalling per time unit handled by the set of resources in the communications system (100), and wherein the one or more respective indications configured to be sent are configured to be based on the second information configured to be collected.

55. The second core network node (122) according to claims 53 and 54, wherein the respective fifth indication is configured to be a second message configured to comprise at least one of: a. an indication of one or more reference points in the communications system (100) wherein the amount of signalling is to be analyzed, b. another indication of one or more services of the communications system (100) for which the amount of signalling is to be analyzed, c. the one or more granularities, and d. a request for a first further additional indication configured to indicate a first load at one or more entities wherein whether or not the signalling storm has been detected or is predicted to occur is to be determined.

56. The second core network node (122) according to claim 55, wherein the respective fifth indication is configured to comprise the request, and wherein the sending is configured to comprise sending the first further additional indication.

57. A communications system (100) comprising one or more of: a first node (111 ) according to any of the claims 29-40, a second node (112) according to any of the claims 41 -47, a first core network node 121 (121 ) according to any of the claims 48-51 , and a second core network node (122) according to any of the claims 52-56.

Images