Methods and apparatus for explainability-based artificial intelligence or machine learning in a mobile communication system

Abstract

Methods, apparatus and computer-readable medium are disclosed for explainability-based AI or ML in a mobile communication network A method performed in a mobile communication network comprises receiveing training data to perform security analytics with artificial intelligence or machine learning; determining a first set of features relevant to a model training for the security analytics based on an explainability technique to be used for the model training; and performing the security analytics with a subset of the training data for the first set of features.

Description

[0001] METHODS AND APPARATUS FOR EXPLAINABILITY-BASED ARTIFICIAL INTELLIGENCE OR MACHINE LEARNING IN A MOBILE COMMUNICATION SYSTEM

[0002] TECHNICAL FIELD

[0003] [1] Various example embodiments relate generally to artificial intelligence (Al) or machine learning (ML) in a wireless communication network, and more particularly, to methods and apparatus for explainability-based Al or ML in a mobile communication network.

[0004] BACKGROUND

[0005] [2] With the development of communication technology, applying Al and ML in a mobile communication in networks is becoming increasingly widespread. The 3rd Generation Partnership Project (3GPP) has introduced Al into the existing framework of the 5thgeneration (5G) and 6thgeneration (6G). Al or ML can be used for core network and radio access network (RAN) to achieve intelligent network operations. For example, use cases of Al or ML in a mobile communication network may include using intelligent 5G network management (such as enhanced mobility management, user behavior and demand prediction, radio resource scheduling, congestion control and routing, traffic and mobility prediction), radio access network (RAN) enhancement (such as network energy saving, load prediction or balancing, mobility optimization), core network enhancement (such as Al assisted network slicing), enhanced security (such as attach detection), and the like.

[0006] [3] In a case of applying Al or ML, a model training is usually performed either centralized or via a distributed mechanism. In the case of centralized learning, huge training data is transferred from user equipment (UE) to a network node or amongst network nodes, or from UE (via radio access network) to a network node. Similarly in the case of distributed learning, the end clients would consume a lot of processing power to perform the model training locally.

[0007] [4] Furthermore, in the case of attack detection (for example, anomaly detection or poisoning detection) with Al or ML, a network entity responsible for attack detection (for example, model training logical function (MTLF) or analytics logical function (AnLF) of a network data analytics function (NWDAF),) or responsible for creating an ML model which will assist in attack detection, is required to analyze a huge amount of training data in order to generate this ML model or detect abnormalities in the training data pertaining to tampering.

[0008] [5] It would be advantageous to solve the above problems. SUMMARY

[0009] [6] This summary is provided to introduce simplified concepts of the present disclosure. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0010] [7] According to a first aspect of the disclosure, there is provided an apparatus operating in a mobile communication network. The apparatus comprises at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to transmit to a first network node of the mobile communication network, a first indication indicating a capability of the apparatus to support one or more explainability techniques in artificial intelligence or machine learning within the mobile communication network; receive a second indication indicating a policy defining how at least one explainability technique of the one or more explainability techniques is to be applied; and perform the artificial intelligence or machine learning based on the policy. According to some embodiments, the apparatus may be a user equipment or a network function entity.

[0011] [8] According to some embodiments, the policy may indicate at least one of: a condition under which the at least one explainability technique is to be applied; or a threshold for a similarity between explainability of model parameters from a current round of model training for a model and explainability of model parameters from a previous round of model training for the model.

[0012] [9] According to some embodiments, the apparatus may be further caused to receive a message to start a model training for a model based on the policy.

[0013]

[0010] According to some embodiments, the apparatus may be further caused to determine explainability of model parameters for the model by applying the at least one explainability technique; determine a similarity between the determined explainability of model parameters from a current round of the model training and explainability of model parameters from a previous round of the model training; skip the current round of the model training and parameter sharing for the current round, in case that the determined similarity is equal to or greater than the threshold; and continue the current round of the model training and parameter sharing for the current round, in case that the determined similarity is less than the threshold.

[0014]

[0011] According to some embodiments, the apparatus may be further caused to select a first set of features which impact an output of the model according to the determined explainability of model parameters, wherein the determined explainability of model parameters indicates impacts of respective input features of a model on an output of the model; and perform model training for the model with training data for the first set of features.

[0012] According to some embodiments, the apparatus may be further caused to transmit model parameters of the model trained with the training data for the first set of features, together with the first set of features.

[0015]

[0013] According to some embodiments, the apparatus may be further caused to determine a second set of features needed for a model training for a model based on the policy; and transmit training data for the second set of features to a second network node for performing a model training for the model.

[0016]

[0014] According to some embodiments, the apparatus may be further caused to transmit a set of sample training data to a second network node for performing a model training for a model; receive from the second network node, a third set of features which impact an output of the model trained with the set of sample training data; and transmit training data for the third set of features to the second network node for performing a model training for the model.

[0017]

[0015] According to some embodiments, the apparatus may be further caused to transmit to the second network node, an indication of the at least one explainability technique to be applied for the model training with the set of sample training data.

[0018]

[0016] According to some embodiments, the apparatus may be further caused to receive from the second network node, model parameters of the model trained with the training data for the second or third set of features, together with a fourth set of features which impact an output of the trained model.

[0019]

[0017] According to some embodiments, the at least one explainability technique may comprise at least one of SHapley Additive exPlanations (SHAP) technique; Local Interpretable Modelagnostic Explanations (LIME) technique; Itegrated Gradients (IG) technique; or DeepLIFT technique.

[0020]

[0018] According to a second aspect of the disclosure, there is provided an apparatus operating in a mobile communication network. The apparatus comprises at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to store a policy defining how at least one explainability technique is to be applied in artificial intelligence or machine learning within the mobile communication network; and transmit the policy to a first node according to a capability of the first node to support the at least one explainability technique. According to some embodiments, the apparatus may be a policy control function entity.

[0021]

[0019] According to some embodiments, the policy may indicate at least one of: a condition under which the at least one explainability technique is to be applied; or a threshold for a similarity between explainability of model parameters from a current round of model training for a model and explainability of model parameters from a previous round of model training for the model.

[0022]

[0020] According to a third aspect of the disclosure, there is provided an apparatus operating in a mobile communication network. The apparatus comprises at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to transmit to a network node of the mobile communication network, a third indication indicating a capability to support one or more explainability techniques in artificial intelligence or machine learning within the mobile communication network; receive from the network node, a first indication indicating a capability of another network node to support at least one explainability technique of the one or more explainability techniques; and transmit a message to said another network node, to start a model training for a model based on a policy defining how the at least one explainability technique is to be applied for the model training.

[0023]

[0021] According to a fourth aspect of the disclosure, there is provided an apparatus operating in a mobile communication network. The apparatus comprises at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to receive a set of sample training data from a first node; perform a model training for a model with the set of sample training data by applying at least one explainability technique; determine a third set of features which impact an output of the model according to explainability of model parameters for the model, wherein the explainability of model parameters indicates impacts of respective input features of the model on an output of the model; and transmit the third set of features to the first node. According to some embodiments, the apparatus may be a network data analytics function entity.

[0024]

[0022] According to some embodiments, the apparatus may be further caused to receive from the first node or another network node, an indication of the at least one explainability technique to be applied for the model training.

[0025]

[0023] According to some embodiments, the apparatus may be further caused to receive from the first node, training data for the third set of features for performing model training for the model; and perform model training for the model with the training data for the third set of features by applying at least one explainability technique.

[0026]

[0024] According to some embodiments, the apparatus may be further caused to transmit to the first node, model parameters of the model trained with the training data for the third set of features, together with a fourth set of features which impact an output of the trained model.

[0027]

[0025] According to a fifth aspect of the disclosure, there is provided an apparatus operating in a mobile communication network. The apparatus comprises at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to receive training data to perform security analytics with artificial intelligence or machine learning; determine a first set of features relevant to a model training for the security analytics based on an explainability technique to be used for the model training; and perform the security analytics with a subset of the training data for the first set of features. According to some embodiments, the apparatus may be a network data analytics function entity.

[0028]

[0026] According to some embodiments, the apparatus may be further caused to receive information related to configuration for one or more security analytics with artificial intelligence or machine learning, wherein the information comprises indications of respective explainability techniques to be used in model trainings for each of the one or more security analytics.

[0029]

[0027] According to some embodiments, the information related to the configuration may be received from a policy control function entity.

[0030]

[0028] According to some embodiments, the apparatus may be further caused to determine respective sets of features relevant to model trainings for each of the one or more security analytics based on the respective explainability techniques; and create a mapping table for each of the one or more security analytics and the respective sets of features relevant to model trainings for each of the one or more security analytics.

[0031]

[0029] According to some embodiments, the apparatus may be further caused to retrieve the first set of features based on the mapping table.

[0032]

[0030] According to some embodiments, the apparatus may be further caused to perform model training for a model for the security analytics with the subset of training data for the first set of features.

[0033]

[0031] According to some embodiments, the apparatus may be further caused to determine explainability of model parameters for the model by applying the explainability technique; determine a second set of features which impact an output of the model according to the determined explainability of model parameters; and transmit model parameters of the trained model, together with the second set of features. The determined explainability of model parameters indicates impacts of respective input features of the model on an output of the model.

[0034]

[0032] According to a sixth aspect of the disclosure, there is provided a method performed in a first node operating in a mobile communication network. The method comprises transmitting to a first network node of the mobile communication network, a first indication indicating a capability of the first node to support one or more explainability techniques in artificial intelligence or machine learning within the mobile communication network; receiving a second indication indicating a policy defining how at least one explainability technique of the one or more explainability techniques is to be applied; and performing the artificial intelligence or machine learning based on the policy.

[0035]

[0033] According to some embodiments, the policy may indicate at least one of: a condition under which the at least one explainability technique is to be applied; or a threshold for a similarity between explainability of model parameters from a current round of model training for a model and explainability of model parameters from a previous round of model training for the model.

[0036]

[0034] According to some embodiments, the method may further comprise receiving a message to start a model training for a model based on the policy.

[0037]

[0035] According to some embodiments, the method may further comprise determining explainability of model parameters for the model by applying the at least one explainability technique; determining a similarity between the determined explainability of model parameters from a current round of the model training and explainability of model parameters from a previous round of the model training; skipping the current round of the model training and parameter sharing for the current round, in case that the determined similarity is equal to or greater than the threshold; and continuing the current round of the model training and parameter sharing for the current round, in case that the determined similarity is less than the threshold.

[0038]

[0036] According to some embodiments, the method may further comprise selecting a first set of features which impact an output of the model according to the determined explainability of model parameters, wherein the determined explainability of model parameters indicates impacts of respective input features of a model on an output of the model; and performing model training for the model with training data for the first set of features.

[0039]

[0037] According to some embodiments, the method may further comprise transmitting model parameters of the model trained with the training data for the first set of features, together with the first set of features.

[0040]

[0038] According to some embodiments, the method may further comprise determining a second set of features needed for a model training for a model based on the policy; and transmitting training data for the second set of features to a second network node for performing a model training for the model.

[0041]

[0039] According to some embodiments, the method may further comprise transmitting a set of sample training data to a second network node for performing a model training for a model; receiving from the second network node, a third set of features which impact an output of the model trained with the set of sample training data; and transmitting training data for the third set of features to the second network node for performing a model training for the model.

[0040] According to some embodiments, the method may further comprise transmitting to the second network node, an indication of the at least one explainability technique to be applied for the model training with the set of sample training data.

[0042]

[0041] According to some embodiments, the method may further comprise receiving from the second network node, model parameters of the model trained with the training data for the second or third set of features, together with a fourth set of features which impact an output of the trained model.

[0043]

[0042] According to some embodiments, the first node is a user equipment or a network function entity.

[0044]

[0043] According to some embodiments, the at least one explainability technique comprises at least one of, SHapley Additive exPlanations (SHAP) technique; Local Interpretable Modelagnostic Explanations (LIME) technique; Itegrated Gradients (IG) technique; or DeepLIFT technique.

[0045]

[0044] According to a seventh aspect of the disclosure, there is provided a method performed in a third network node operating in a mobile communication network. The method comprises storing a policy defining how at least one explainability technique is to be applied in artificial intelligence or machine learning within the mobile communication network; and transmitting the policy to a first node according to a capability of the first node to support the at least one explainability technique.

[0046]

[0045] According to some embodiments, the policy may indicate at least one of: a condition under which the at least one explainability technique is to be applied; or a threshold for a similarity between explainability of model parameters from a current round of model training for a model and explainability of model parameters from a previous round of model training for the model.

[0047]

[0046] According to some embodiments, the third network node may be a policy control function entity.

[0048]

[0047] According to an eighth aspect of the disclosure, there is provided a method performed in a fourth network node operating in a mobile communication network. The method comprises transmitting to a fifth network node of the mobile communication network, a third indication indicating a capability of the third node to support one or more explainability techniques in artificial intelligence or machine learning within the mobile communication network; receiving from the fifth network node, a first indication indicating a capability of the first node to support at least one explainability technique of the one or more explainability techniques; and transmitting a message to the first node, to start a model training for a model based on a policy defining how the at least one explainability technique is to be applied for the model training.

[0048] According to some embodiments, the policy may indicate at least one of: a condition under which the at least one explainability technique is to be applied; or a threshold for a similarity between explainability of model parameters from a current round of model training for a model and explainability of model parameters from a previous round of model training for the model.

[0049]

[0049] According to a ninth aspect of the disclosure, there is provided a method performed in a second network node operating in a mobile communication network. The method comprises receiving a set of sample training data from a first node; performing a model training for a model with the set of sample training data by applying at least one explainability technique; determining a third set of features which impact an output of the model according to the determined explainability of model parameters for the model; and transmitting the third set of features to the first node. The explainability of model parameters indicates impacts of respective input features of a model on an output of the model.

[0050]

[0050] According to some embodiments, the method may further comprise receiving from the first node or another network node, an indication of the at least one explainability technique to be applied for the model training.

[0051]

[0051] According to some embodiments, the method may further comprise receiving from the first node, training data for the third set of features for performing model training for the model; and performing model training for the model with the training data for the third set of features by applying at least one explainability technique.

[0052]

[0052] According to some embodiments, the method may further comprise transmitting to the first node, model parameters of the model trained with the training data for the third set of features, together with a fourth set of features which impact an output of the trained model.

[0053]

[0053] According to some embodiments, the second network node may be a network data analytics function (NWDAF) entity.

[0054]

[0054] According to a tenth aspect of the disclosure, there is provided a method performed in a second network node operating in a mobile communication network. The method comprises receiving training data to perform security analytics with artificial intelligence or machine learning; determining a first set of features relevant to a model training for the security analytics based on an explainability technique to be used for the model training; and performing the security analytics with a subset of the training data for the first set of features.

[0055]

[0055] According to some embodiments, the method may further comprise receive information related to configuration for one or more security analytics with artificial intelligence or machine learning, wherein the information comprises indications of respective explainability techniques to be used in model trainings for each of the one or more security analytics. According to some embodiments, the information related to the configuration may be received from a policy control entity.

[0056]

[0056] According to some embodiments, the method may further comprise determining respective sets of features relevant to model trainings for each of the one or more security analytics based on the respective explainability techniques; and creating a mapping table for each of the one or more security analytics and the respective sets of features relevant to model trainings for each of the one or more security analytics.

[0057]

[0057] According to some embodiments, the method may further comprise retrieving the first set of features based on the mapping table.

[0058]

[0058] According to some embodiments, the method may further comprise performing a model training for a model for the security analytics with the subset of training data for the first set of features.

[0059]

[0059] According to some embodiments, the method may further comprise determining explainability of model parameters for the model by applying the explainability technique; determining a second set of features which impact an output of the model according to the determined explainability of model parameters; and transmitting model parameters of the trained model, together with the second set of features. The determined explainability of model parameters indicates impacts of respective input features of the model on an output of the model.

[0060]

[0060] According to some embodiments, the second network node may a network data analytics function (NWDAF) entity

[0061]

[0061] According to a eleventh aspect of the disclosure, there is provided a computer-readable medium having computer program codes embodied thereon which, when executed by a processor, cause the processor to perform any of the methods according to the sixth, seventh, eighth, ninth and tenth aspects of the disclosure.

[0062]

[0062] According to an eighth aspect of the disclosure, there is provided a computer program product comprising computer programs or instructions which, when executed by a processor, cause the processor to perform any of the methods according to the sixth, seventh, eighth, ninth and tenth of the disclosure.

[0063]

[0063] It is to be understood that the summary section is not intended to identify key or essential features of embodiments of the present disclosure, nor is it intended to be used to limit the scope of the present disclosure. Other features of the present disclosure will become easily comprehensible through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0064]

[0064] Some example embodiments will now be described with reference to the accompanying drawings in which:

[0065]

[0065] FIG. 1 shows an example of a mobile communication network to which examples disclosed herein may be applied;

[0066]

[0066] FIG. 2 illustrates a first exemplary procedure according to embodiments of the present disclosure;

[0067]

[0067] FIG. 3 illustrates a second exemplary procedure according to embodiments of the present disclosure;

[0068]

[0068] FIG. 4 illustrates a third exemplary procedure according to an embodiment of the present disclosure;

[0069]

[0069] FIG. 5 illustrates a fourth exemplary procedure according to an embodiment of the present disclosure;

[0070]

[0070] FIG. 6 is a flow chart depicting a method performed at a first node according to embodiments of the present disclosure;

[0071]

[0071] FIG. 7 is a flow chart depicting another method performed at a first node according to embodiments of the present disclosure;

[0072]

[0072] FIG. 8 is a flow chart depicting yet another method performed at a first node according to embodiments of the present disclosure;

[0073]

[0073] FIG. 9 is a flow chart depicting yet another method performed at a first node according to embodiments of the present disclosure;

[0074]

[0074] FIG. 10 is a flow chart depicting yet another method performed at a first node according to embodiments of the present disclosure;

[0075]

[0075] FIG. 11 is a flow chart depicting a method performed at a second node according to embodiments of the present disclosure;

[0076]

[0076] FIG. 12 is a flow chart depicting another method performed at a second node according to embodiments of the present disclosure;

[0077]

[0077] FIG. 13 is a flow chart depicting yet another method performed at a second node according to embodiments of the present disclosure;

[0078] FIG. 14 is a flow chart depicting a method performed at a third node according to embodiments of the present disclosure;

[0078]

[0079] FIG. 15 is a flow chart depicting a method performed at a fourth node according to embodiments of the present disclosure; and

[0079]

[0080] FIG. 16 is a block diagram showing an apparatus suitable for practicing some embodiments of the disclosure.

[0080] DETAILED DESCRIPTION

[0081]

[0081] The following embodiments are exemplary. Although the specification may refer to “an”, “one”, or “some” embodiment(s) in several locations of the text, this does not necessarily mean that each reference is made to the same embodiment(s), or that a particular feature only applies to a single embodiment. Single features of different embodiments may also be combined to provide other embodiments. Further, when a particular feature, structure, or characteristic is de-scribed in connection of an embodiment, it is within the knowledge of one skilled in the art to apply such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

[0082]

[0082] For the purposes of the present disclosure, the phrases “at least one of A or B”, “at least one of A and B”, and “A and / or B” means (A), (B), or (A and B). For the purposes of the present disclosure, the phrase “A, B, and / or C” means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C).

[0083]

[0083] Embodiments described may be implemented in a mobile communication network, such as any of the following radio access technologies (RATs): Universal Mobile Telecommunication System (UMTS, 3G) based on basic wideband-code division multiple access (W-CDMA), highspeed packet access (HSPA), Long Term Evolution (LTE), LTE-Advanced, and enhanced LTE (eLTE), 5G (also called NR), or any future RAT such as 6G.

[0084]

[0084] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skills in the art to which this disclosure belongs.

[0085]

[0085] As used herein, the term “network device” or “network node” refers to a node in a radio access network via which user equipment may access the radio access network and / or a node in a core network which is capable of controlling communication and managing communication resources within a mobile communication network.

[0086] The term “terminal device” or user equipment (UE) refers to any end device that may be capable of wireless communication. By way of example, a terminal device may be referred to as a communication device, a Subscriber Station (SS), or a Mobile Station (MS). The terminal device may include a mobile phone, a cellular phone, a smart phone, voice over IP (VoIP) phones, wireless local loop phones a tablet, a wearable terminal device, a personal digital assistant (PDA), portable computers, desktop computer, image capture terminal devices such as digital cameras, gaming terminal devices, music storage and playback appliances, vehicle-mounted wireless terminal devices, USB dongles, an Internet of Things (loT) device, a watch or other wearable, a head-mounted display (HMD), a vehicle, a drone, a medical device and applications (e.g., remote surgery), an industrial device and applications (e.g., a robot and / or other wireless devices operating in an industrial and / or an automated processing chain contexts), a consumer electronics device, a device operating on commercial and / or industrial wireless net-works, and the like.

[0086]

[0087] As defined herein, a “computer-readable storage medium,” which refers to a non-transitory physical storage medium (e.g., volatile or non-volatile memory device), may be differentiated from a “computer-readable transmission medium,” which refers to an electromagnetic signal. Such a medium may take many forms, including, but not limited to a non-transitory computer-readable storage medium (e.g., non-volatile media, volatile media), and transmission media. Transmission media include, for example, coaxial cables, copper wire, fiber optic cables, and carrier waves that travel through space without wires or cables, such as acoustic waves and electromagnetic waves, including radio, optical and infrared waves. Signals include man-made transient variations in amplitude, frequency, phase, polarization or other physical properties transmitted through the transmission media. Examples of non-transitory computer-readable media include a magnetic computer readable medium (e.g., a floppy disk, hard disk, magnetic tape, any other magnetic medium), an optical computer readable medium (e.g., a compact disc read only memory (CD- ROM), a digital versatile disc (DVD), a Blu-Ray disc, or the like), a random access memory (RAM), a programmable read only memory (PROM), an erasable programmable read only memory (EPROM), a FLASH-EPROM, or any other non-transitory medium from which a computer may read. The term computer-readable storage medium is used herein to refer to any computer-readable medium except transmission media. However, it will be appreciated that where embodiments are described to use a computer-readable storage medium, other types of computer- readable mediums may be substituted for or used in addition to the computer-readable storage medium in alternative embodiments.

[0087]

[0088] FIG. 1 illustrates an example of a communication network to which examples disclosed herein may be applied. The communication network or a cellular communication network may comprise a network node 110 providing one or more cells, such as cell 100, and a network node 112 providing one or more other cells, such as cell 102. Each cell may be, e.g., a macro cell, a micro cell, femto, or a pico cell, for example. The cell may define a coverage area or a service area of the corresponding access node.

[0088]

[0089] The network node 110 may provide a user equipment (UE) 120 (one or more UEs) with wireless access to the communication network. The wireless access may comprise downlink (DL) communication from the network node to the UE 120 and uplink (UL) communication from the UE 120 to the network node. Examples of uplink channels comprise physical uplink control channel (PUCCH) for transmitting control information and physical uplink shared channel (PUSCH) for transmitting data towards the network. Examples of downlink channels comprise physical downlink control channel (PDCCH) for transmitting control information and physical downlink shared channel (PDSCH) for transmitting data towards the user equipment.

[0089]

[0090] There may be a plurality of UEs 120, 122 in the system. Each of them may be served by the same or by different network nodes 110, 112. UE may be configured with dual connectivity (DC), wherein the UE, e.g. UE 120, may be connected to multiple network nodes 110, 112. The UEs 120, 122 may communicate with each other, in case device-to-device (D2D) communication interface is established between them via a so-called sidelink (SL). Such D2D communications may be referred to as machine-to-machine, peer-to-peer (P2P) communications, or vehicle-to- vehicle (V2V), for example.

[0090]

[0091] In the case of multiple network nodes in the communication network, the network nodes may be connected to each other via an interface. LTE specifications call such an interface as X2 interface. An interface between an LTE node and a 5G node, or between two 5G nodes may be called Xn interface.

[0091]

[0092] The network nodes 110 and 112 may be further connected via another interface to a core network 116 of the communication network. The LTE specifications specify the core network as an evolved packet core (EPC), and the core network may comprise e.g. a mobility management entity (MME) and a gateway node. The MME may handle mobility of terminal devices in a tracking area encompassing a plurality of cells and handle signaling connections between the terminal devices and the core network. The gateway node may handle data routing in the core network and to / from the terminal devices. The 5G specifications specify the core network as a 5G core (5GC). The 5G core may comprise e.g. an access and mobility management function (AMF) and a user plane function / gateway (UPF), policy control function (PCF) and other functions. The AMF may handle termination of non-access stratum (NAS) signaling, NAS ciphering and integrity protection, registration management, connection management, mobility management, access authentication and authorization, security context management. The UPF node may support packet routing and forwarding, packet inspection and quality of service (QoS) handling, for example. The PCF provides policy rules for controlling plane functions. The 5G core may further comprise a network data analysis function (NWDAF) for providing data analysis services to network functions (NF).

[0092]

[0093] Artificial intelligence (Al) can be broadly defined as getting computers to perform tasks mimicking human brain. Machine learning (ML) is one category of Al techniques: computer algorithms able to automatically improve their performance without explicit programming. Al algorithms were first conceived in the 1950’ s but only in recent years AI / MLML has become useful in vast area of real-world applications, partly due to advancements in computational power and in providing storage capacity for data.

[0093]

[0094] AI / ML can help adjust and optimize radio access network (RAN) parameters and settings using (real-time) monitoring and prediction of network performance, quality, and demand. Additionally, AI / ML can identify and diagnose degradation in network performance, as well as provide protection from cyberattacks. AI / ML is usable in energy saving, load balancing, mobility optimization, link adaptation and security just to mention but a few.

[0094]

[0095] It is envisioned that AI / ML will enable real-time analysis as well as auto-mated operation and control in 5G and beyond RAN. This requires the availability of data streamed from wireless devices in a timely manner, especially in extremely time-critical applications such as real-time video monitoring and extended reality (XR). This may be reflected in network architecture, such as by placing and moving ML agents to the required locations in the network, for example for data collection. User devices (mobile devices) may assist network in decision-making in resource management, thus a user device may act as an infrastructure resource.

[0095]

[0096] As the network evolves to programmable and flexible cloud native implementation, AI / ML-based network automation will be used to simplify network management and optimization. It is expected that parts of the air interface, in particular signal processing algorithms, are supported and eventually even replaced with ma-chine learning models. Thus, a 6G wireless communication standard will natively sup-port an Al-based air interface.

[0096]

[0097] Machine learning algorithms are usually classified into four different types: supervised learning, unsupervised learning, semi- supervised learning and reinforcement learning.

[0097]

[0098] In supervised learning the algorithm learns from labelled data. For training, the algorithm receives input data and corresponding correct output labels. The algorithm is trained to predict accurate labels for new data.

[0098]

[0099] In unsupervised learning the algorithm analyses unlabelled data. The aim is to discover patterns, relationships, or structures within the data, for example, un-supervised learning algorithms make groups of similar data points.

[0100] Semi- supervised learning is a hybrid machine learning approach that combines labelled and unlabelled data for training. A limited amount of labelled data and a larger set of unlabelled data is used to improve training. This approach is useful when acquiring labelled data is expensive or time-consuming as is the case in many real- world applications. Semi-supervised learning techniques can be applied to various tasks, such as classification, regression, and anomaly detection, allowing models to make more accurate predictions and generalize better in real- world scenarios.

[0099]

[0101] Reinforcement learning is a machine learning algorithm which learns from trial and error. An ML agent interacts with environment and learns from experience aiming to maximize cumulative rewards. The ML agent receives feedback through rewards or penalties based on its actions. The agent learns to take actions that lead to the most favourable outcomes over time. The algorithm adapts to changing environments, and achieve long-term goals through a sequence of actions.

[0100]

[0102] An example of an ML algorithm found applicable to adjust and optimize the radio access network (RAN) parameters and settings is deep learning. Deep learning is a subset of machine learning algorithms using a neural network. Neural net-works are also known as artificial neural networks (ANNs) or simulated neural net-works (SNNs). Deep learning can be based on supervised, semi-supervised or unsupervised learning.

[0101]

[0103] Artificial neural networks (ANNs) are comprised of an input layer, one or more hidden layers, and an output layer. Each node of a layer, or an artificial neuron, connects to another one and has an associated weight as well as a threshold value. If the output of an individual node is above the threshold value specified to this node, the node is activated and sending or passing data to the next layer of the neural net- work.

[0102]

[0104] In the case the supervised learning is applied in the training of a neural network, the training is carried out by using examples, each of which contains a known "input" and "result", forming probability-weighted associations between them. The training comprises determining the difference between the output of the neural network (a prediction) for an input and a target output for the same input. The difference is called an error value. The neural network then adjusts its weighted associations according to a learning rule and using this error value. Successive adjustments makes the neural network produce output that is approaching the target out-put. After a sufficient number of these adjustments, the training can be terminated based on a certain criteria.

[0103]

[0105] As introduced above, in a case of applying Al or ML in a mobile communication, data transfer for huge training data, a lot of processing power for local model training, and a burden for analyzing a huge amount of training data become challenge problems. For example, for Federated learning (FL) use cases in telecommunications, high-frequency model updates across heterogeneous devices and network functions are common.

[0104]

[0106] The present disclosure aims at solving the above problems, for example, by reducing the model training required in Al or ML training process (e.g. FL), decreasing data transfer in the case of centralized learning, and / or optimizing and increasing the speed of detection of attacks, by means of incorporating explainability into Al or ML systems, especially for model training and inference, and devising a standardized mechanism for the same.

[0105]

[0107] An explainability-based optimization for Al or ML process (such as a use case of FL) could revolutionize how models are trained and updated. For example, by embedding explainability into a data transfer process, FL setups can achieve both data efficiency and interpretability, addressing core requirements in 3GPP standards and paving the way for scalable, explainable Al or ML solutions in networked environments.

[0106]

[0108] Explainability matrices are quantitative methods or techniques that help interpret and understand machine learning models by attributing importance scores to inputs, features, or model parameters. In the disclosure here, explainability matrices and explainability techniques can be used interchangeablely. These matrices offer insights into how and why a model makes specific predictions, enhancing transparency and trust. There are several types of explainability matrics. Some of them are listed below.

[0107]

[0109] 1. SHapley Additive exPlanations (SHAP):

[0108]

[0110] Grounded in cooperative game theory, it provides both local and global explanations by calculating a contribution of each feature to a specific prediction by evaluating the difference between predictions when each feature is included or excluded. SHAP is computed intensive and can be difficult to understand in case of complex models.

[0109]

[0111] SHAP values provide a fair and consistent measure of feature importance for individual predictions by considering all possible combinations of features. For example, an explanation generated with SHAP for a model may indicate that Feature A contributed significantly to a prediction output of the model, followed by Feature B.

[0110]

[0112] SHAP offers a consistent interpretation across models and allows feature importance analysis for both individual and global predictions. SHAP is widely applicable to a variety of models, from simple linear models to deep neural networks.

[0111]

[0113] 2. Local Interpretable Model-agnostic Explanations (LIME):

[0114] LIME focuses on explaining a specific prediction by perturbing instances around original input and approximating the model locally with a simpler interpretable model. But it does not provide global insights or patterns into model behavior.

[0112]

[0115] For example, an explanation generated with LIME for a model may indicate that the model’ s prediction / inference output was influenced primarily by Feature A and Feature C. Feature A had the highest positive impact while Feature C had the negative impact.

[0113]

[0116] 3. Integrated Gradients (IG)

[0114]

[0117] IG computes feature attributions by integrating gradients along a path from a baseline input to the actual input. This explainability technique quantifies impact of each feature on the output.

[0115]

[0118] 4. DeepLIFT

[0116]

[0119] DeepLIFT assigns importance scores to input features by comparing activation differences to a reference state. It backpropagates contributions through each layer to identify influential inputs.

[0117]

[0120] By applying an explainability matrix or technique into Al or ML, especial in model training setups, input features which impact output of a trained model (also referred to as impactful features) may be determined from explanation results (also referred to as explainability of model parameters in the present disclosure) generated from the explainability matrix or technique. For example, a feature with a high SHAP value (not considering positive and negative signs of the SHAP value) has high impact than a feature with a low SHAP value. Thus, the feature with a high SHAP value may be determined as an impactful feature. The feature with a highest SHAP value may be determined as a most impactful feature which has a highest impact on the output among all features of training data used for the training. In an example, the impactful feature may be determined as features which have a SHAP value (not considering positive and negative signs) equal to or above a threshold. In another example, the impactful feature may be determined as features ranked in the top n according to their respective SHAP values. The value of the threshold and the value of n is configurable.

[0118]

[0121] The model parameters of a model represent the learned weights or coefficients that the model uses to make decisions. For example, in a use case of Al or ML for network selection, model parameters may be derived from features that influence network selection and are updated during the model training process. For example, the model may be trained to generate a score used to make decisions according to the following equation:

[0119]

[0122] score= wl-Signal Strength+w2-Latency+w3-Congestion+...+b

[0123] The coefficients wl, w2, w3,..., b are model parameters of the model. For example, the model parameter w / =0.8 is a weight for a feature “signal strength”. By using the model, the network with the highest score would be selected. The model parameters (wl, w2, w3,..., b) are continuously updated based on training to optimize the network selection process.

[0120]

[0124] “Signal Strength.” is the value of current signal strength for a network. It is an input of the model. For example, a training data for the current signal strength may be a value of -95 dBm.

[0121]

[0125] A SHAP value may be calculated from a SHAP algorithm for features in the model. A SHAP value quantifies the contribution of a specific feature (e.g., signal strength) to the model's prediction for a particular instance. It explains how much the feature increased or decreased the predicted output compared to the average prediction. For example, a SHAP value for signal strength may be +0.2, indicating that the signal strength positively influenced the network selection decision.

[0122]

[0126] According to explainability of model parameters generated by an explainability matrix or technique, Al or ML systems (such as FL systems) can selectively filter and prioritize only impactful (e.g., the most impactful) model parameters or features for data transfer and data processing (such as model training and inference), so as to significantly reduce communication load and processing load without compromising model accuracy.

[0123]

[0127] In some embodiments, Al or ML model training process can be efficiently optimized according to explainability generated with an explainability matrix or technique in the following two aspects:

[0124] Selective Parameter Sharing with an explainability matrix (e.g. SHAP): only training data corresponding to impactful features (e.g., the most impactful features as indicated by topest SHAP values) are transferred and used for model training. Other training data (which do not correspond to impactful features) would be filtered out and would not be transferred and used for model training. Accordingly, unnecessary data transfer can be minimized, with focusing data transmission and model training on a subset of training data for impactful features or attributes that contribute most to model performance. This allows the wireless communication network to dynamically adjust transfer volume based on unique data relevance of training data from each client device (e.g., FL client device) in Al or ML system.

[0125] Threshold-Based Parameter Sharing: This aspect involves a comparison of explainability (e.g., SHAP values) across training rounds. If explainability of model parameters for the current training round is similar as that for the previous training round, the current training round may be skipped, because it is considered as an unnecessary training round. In other words, if impact of new model parameters (e.g. as indicated by SHAP values of features corresponding to new model parameters) for a current training round remains below a defined threshold when compared to a previous training round, these updates with new model parameters may be omitted. This aspect reduces an overall compute consumption at nodes performing model training, and optimizes an update frequency in Al or ML model training (e.g., for FL cycle) based on meaningful model evolution, also preserving bandwidth without sacrificing model quality.

[0126]

[0128] These embodiments could serve as efficient data-reduction mechanisms in a 3GPP context, where high-volume data transfer between nodes and network functions is a critical concern. FIGs. 2-5 illustrate some exemplary procedures according to embodiments of the present disclosure. These embodiments illustrate multiple implementation scenarios based upon different use-cases being envisioned for explainability based sustainable Al or ML. In all the below embodiments, the explainability matrix generation can be either done by 6G policy control network function (PC NF) or by a dedicated Al native NF (such as NWDAF).

[0127]

[0129] FIG. 2 illustrates an exemplary scenario of UE-to-network Al or ML solution (e.g., federated learning (FL) solution) according to an embodiment of the present disclosure. In this scenario, UE conducts model training locally, and shares the trained model with network nodes.

[0128]

[0130] At step 210, a UE 201 registers with a mobile communication network and indicates its capability to support one or more explainability techniques, such as SHAP, LIME, IG, DeepLIFT, and the like. In an example, the UE 201 transmits a non-access stratum (NAS) registration request to a network node 203, e.g., an AMF or a mobility management entity (e.g., 6G-MM). The request includes an indication of explainability techniques supported by the UE, e.g., a list of explainability matrices comprising: i) SHAP, ii) LIME, ... This step 210 initiates communication with the network regarding the UE's capability to implement explainability-based policies for a use case of Al or ML, such as federated learning.

[0129]

[0131] At step 215, the network node 202 returns an acknowledgement for the request.

[0130]

[0132] At step 220, the network node 202 may retrieve an explainability policy according to the one or more explainability techniques supported by the UE, from another network node 203 such as policy control function (PCF) or policy control network function (such as 6G PC NF). The explainability policy defines how at least one of the one or more explainability techniques should be applied in Al or ML. In an example, the explainability policy may include a condition under which an explainability technique is to be used in a use case of Al or ML. The condition indicates contexts of use cases applying respective explainability techniques. For example, the condition may indicate that SHAP is to be selected in use cases for a specific network slice (e.g., denoted as slice-x), a specific public land mobile network (PLMN) (e.g., denoted as PLMN-y), a specific radio access technology (RAT), or a specific Al or ML model. The explainability policy may include another condition under which another explainability technique is to be used. For example, the another condition may indicate that LIME is to be selected in use cases for another specific network slice (e.g., denoted as slice-x’), another specific public land mobile network (PLMN) (e.g., denoted as PLMN-y’), another specific radio access technology (RAT), or another specific Al or ML model.

[0131]

[0133] Alternatively or additionally, the explainability policy may include a threshold-based policy. In this regard, the explainability policy may indicate a threshold to a similarity between explainability of model parameters from a current training round and explainability of model parameters from a previous training round, to do selective round model training. Basically, if the difference in explainability of the model parameters from the previous round is not significant, this means no value addition in model training and sharing model parameters would results from the current training round, then the model training and sharing model parameters of the current training round can be skipped without sacrificing model quality.

[0132]

[0134] For example, the threshold may be set to 90%. The threshold-based policy may be configured so that if a similarity between explainability of model parameters from a current round of model training and explainability of model parameters from a previous round of model training is equal to or greater than 90%, the current round of model training may be skipped, without further performing model training and sharing model parameters for the current round. Through this threshold-based policy, model training in a training round (such as FL round training) and transmission of model parameters may be proceeded only when substantial changes occur in model parameters. The explainability of model parameters may be determined according to SHAP values of respective features of the model parameters, in case that SHAP is applied as the explainability technique in the model training.

[0133]

[0135] It should be noted that the threshold to the similarity between the current round and the previous round can vary, and is configurable by an operator. As introduced later, a UE can detect the similarity based upon its intelligence and may decide whether to skip a model training round, e.g. for FL.

[0134]

[0136] At step 225, the explainability policy retrieved from the network node 203 may be forwarded to the UE 201. For example, the explainability policy may be delivered to the UE 201 via a message for NAS-UE route selection policy (URSP). Then, the UE 201 may perform Al or ML based on the received explainability policy. The explainability policy may be applied in model training for related use cases and in analytics or inference for which the mode training is performed. The step 225 ensures that explainability techniques are contextually tailored to specific use cases, optimizing the sustainable Al or ML strategy accordingly.

[0137] In some embodiments, the UE 201 may receive a message from the network node 202, specifying a task or a model for which an explainability policy received in step 225 should be applied, as shown at step 230. This explainability policy can also be applied to analytics or inference for which the UE 202 is performing model training or FL. In response to the message, the UE 201 may start a model training for a model (e.g., for FL) by applying a corresponding explainability technique according to the explainability policy received in step 225. The UE 201 may select the corresponding explainability technique according to the conditions specified in the explainability policy. The following steps would be described with reference to an exemplary case where SHAP is selected to be applied for the model training. However, it can be understood that embodiments of these steps are also applicable to other cases where any of other explainability techniques (e.g., LIME, IG, DeepLIFT) are selected to be applied.

[0135]

[0138] At step 235, the UE 201 performs model training of the model with applying the explainability technique specified in the policy. In an example, the explainability policy can be a textual definition, e.g., “Apply SHAP analysis to evaluate feature importance for network decisions. Use selective sharing of parameters influenced by top-5 features”. The UE 201 may processes model parameters by computing SHAP values, which assess impact of respective SHAP features corresponding to each model parameter. Then, the UE 201 checks SHAP values to determine top-5 SHAP features based on respective SHAP values. The top-5 SHAP features with high SHAP values may be considered as impactful features, and may consist of a filtered subset of SHAP features for the trained model. The UE 201 may check a similarity between explainability of model parameters from the current round of model training and explainability of model parameters from the previous round based on the SHAP values. In this example, the UE 201 may compare only the SHAP values for top-5 SHAP features from the current round with SHAP values for top-5 SHAP features from the previous round. A similarity between the current round and the previous round can be determined or computed based on SHAP values for respective top-5 SHAP features of the current round and the previous round.

[0136]

[0139] If the similarity is equal to or greater than the threshold (e.g., 90%) specified in the explainability policy, the UE 201 may refrain from training the model for the current round (e.g., FL round), and refrain from sending redundant model parameters to the network, because the high similarity indicates that the model training of the current round may not add any significant value. In an example, the model trained for the current round may be discarded, and then, the UE 201 may skip the model training and parameter sharing with network for the current round, as shown at step 240a.

[0137]

[0140] If the similarity is less than the threshold (e.g., 90%) specified in the explainability policy, it indicates that the current round of model training can obtain new or significantly changed information. Thus, the UE 201 may continue the model training for the current round, as shown at step 240b. In an example, the UE 201 may prepare more training data for local FL training.

[0138]

[0141] In some embodiments, after computing SHAP values and checking similarity against the threshold in steps 235 and 240b, a filtering process can be added. As shown at step 245, the UE 201 could only filter out training data for SHAP features with low SHAP values, by selecting only training data for the top-ranked SHAP features based on their SHAP values (i.e., SHAP features with high, especially highest, impact on output of the trained model). Then, the UE 201 may continue to train the model only with the selected training data, as shown at step 250. In this way, the processing burden on the UE 201 may be reduced without sacrificing model quality.

[0139]

[0142] The UE 201 may share model parameters of the trained model with network nodes, e.g., the 6G-MM or AMF 202 or user plane function (UPF) 204, for example for FL. In some embodiments, instead of transmitting the entire set of model parameters of the trained model, the UE 201 may transmit to the network nodes at step 255, a part of model parameters corresponding to a filtered subset of features, i.e., the impactful SHAP features determined at step 235. The SHAP values of the impactful SHAP features may also be transmitted to the network nodes together with the model parameters. This change ensures that only significant updates of the model are communicated, based on both the threshold for the similarity and the filtering criteria based on SHAP values.

[0140]

[0143] FIG. 3 illustrates an exemplary scenario of NF-to-NF Al or ML solution (e.g., FL solution) according to an embodiment of the present disclosure. In this scenario, a NF (e.g., acting as an FL client) conducts model training with local training data, and shares the trained model with other NFs (e.g., acting as an FL server).

[0141]

[0144] At step 310, a network node 301 (denoted as NF1 server), which acts as a FL server or coordinator, registers itself with network, indicating its capability to support explainability matrices or techniques for ensuring sustainability in a FL process. In an example, the network node 301 transmits a Nnrf_NFManagement_Registration message to a network node 302, e.g., a network repository function (NRF). The message includes an indication of FL capability, which indicating explainability techniques supported by the network node 301, e.g., a list of explainability matrices comprising: i) SHAP, ii) LIME, ...

[0142]

[0145] At step 315, the network node 302 returns an acknowledgement for the message.

[0143]

[0146] At step 320, another network node 303 (denoted as NF2 client), which acts as a FL client, registers itself with the network, similarly indicating its capability to support explainability matrices or techniques, such as SHAP, LIME, IG, DeepLIFT, and the like. In an example, the network node 301 transmits a Nnrf_NFManagement_Registration message to a network node 302, e.g., a network repository function (NRF). The message includes an indication of FL capability, which indicating explainability techniques supported by the network node 301, e.g., a list of explainability matrices comprising: i) SHAP, ii) LIME, ... At step 325, the network node 302 returns an acknowledgement for the message. The steps 320 and 325 set up the NF1 Client to participate in explainability -based selective local model training round during the FL process.

[0144]

[0147] At step 330, the network node 301 which is now in a coordinating role for FL, may discover the network node 302 as a client ready to participate in FL. In this discover procedure, the network node 302 (e.g., NRF) may share NFl’s capability of supporting explainability with the network node 301. For example, Nfprofile of the NF2 with FL capability of explainability may be transmitted from the NRF to the NF1 server.

[0145]

[0148] At step 340, the network node 301 may send a request to the network node 303, to start a model training (e.g., for FL). The request may comprise an explainability policy to be applied in the model training. The explainability policy defines how at least one explainability technique supported by both NF1 server and NF2 client should be applied in the model training. Similar as the explainability policy described with reference to FIG.2, in an example, the explainability policy may include a condition under which an explainability technique is to be used. Alternatively or additionally, the explainability policy may include a threshold-based policy, which indicates a threshold to a similarity between explainability of model parameters from a current training round and explainability of model parameters from a previous training round, to do selective round model training. For example, the explainability policy may indicate using SHAP values and a specific threshold (e.g., 90%) to do selective FL round model training based upon deviation of local training data used in previous training round.

[0146]

[0149] At step 340, the network node 303 returns an acknowledgement for the request to the network node 301.

[0147]

[0150] At step 345, the network node 303 performs model training of a model with applying the explainability technique specified in the policy. For example, the network node 303 may process model parameters of the model by computing SHAP values for corresponding features, which assess the impact of each feature on output of the model. Then, the network node 303 checks SHAP values to determine impactful SHAP features based on respective SHAP values. The network node 303 may check a similarity between explainability of model parameters from the current round of model training and explainability of model parameters from the previous round based on the SHAP values. In this example, the network node 303 may compare only the SHAP values for impactful SHAP features from the current round with SHAP values for impactful features from the previous round.

[0151] If the similarity is equal to or greater than the threshold (e.g., 90%) specified in the explainability policy received at step 335, the network node 303 may refrain from doing the model training on redundant data, and refrain from sending redundant model parameters to the network node 301. In an example, the network node 303 may skip the model training and parameter sharing with the network node 301 for the current round, as shown at step 350a.

[0148]

[0152] If the similarity is less than the threshold (e.g., 90%) specified in the explainability policy received at step 335, it indicates new or significantly changed information for the model training, and thus the network node 303 may continue the model training for the current round, as shown at step 350b.

[0149]

[0153] Then, the network node 303 may prepare model parameters of the trained model for transfer, as these model parameters represent meaningful updates of the model. In some embodiments, as shown at step 355, the network node 303 may transmit only the relevant model parameters, instead of the entire set of model parameters of the trained model. In this regard, the network node 303 may transmit to the network node 301, a part of model parameters of the model corresponding to the impactful features (i.e., the SHAP features determined at step 345). The SHAP values of these impactful SHAP features may also transmitted to the network node 301 together with the relevant model parameters. This transfer may further reduce data load on the network while maintaining model relevance.

[0150]

[0154] FIG. 4 illustrates another exemplary scenario of UE-to-NF Al or ML solution according to an embodiment of the present disclosure. In this scenario, Al or ML model training is conducted by a network node on behalf of UE. The network node may be model training logical function (MTLE) of NWDAE or over-the-top (OTT) server.

[0151]

[0155] The steps 410, 415, 420 and 425 of EIG. 4 are similar as steps 210, 215, 220 and 225 of EIG. 2. Repetition for steps 410, 415, 420 and 425 is omitted here for reasons of clarity and ease of understanding. Instead, reference may be made to the above explanations for steps 210, 215, 220 and 225. Here only the steps different from the scenario shown in EIG.2 are described below.

[0152]

[0156] At step 430, UE 401 requests a network node 404 (e.g., a NF such as NWDAF MTLF or external over-the-top (OTT) server) to perform Al or ML model training on behalf of the UE 401.

[0153]

[0157] In some embodiments, in the case the UE 401 has enough resources and can support Al functionality of model training as well, the UE 401 may analyze a model or task of the model training, to determine relevant features (e.g., the most important) needed for the model training at step 435a, based upon an explainability matrix received in step 425. In an example, the relevant features may be determined from a baseline model or a pre-training model for the model training. In another example, the relevant features may be determined from a model trained in past rounds (e.g., the last round) of model training. In another example, the UE 401 may perform a model training with a small amount of training data collected in the UE 401 with applying the explainability matrix. The relevant features may be determined from explainability of model parameters generated by the explainability matrix.

[0154]

[0158] Then the UE 401 may filter the complete training data collected at the UE 401 based upon the determined relevant features, and prepares an optimized slim version of the training data which consists of the training data for these relevant features, as shown at step 440a. Compared to the complete training data, the slim version of the training data comprises less data.

[0155]

[0159] The UE 401 may transmit the slim version of the training data to the network node 404 (e.g., NWDAF MTLF or OTT server) for ML model training, as shown at step 455. This can indeed provide a major bandwidth advantage, since the training data for the most relevant features can sometimes be as less as 25% of the complete training data.

[0156]

[0160] In some embodiments, the UE 401 is not resource intensive and does not have Al or ML model training capabilities, since for the calculation of the most relevant features using explainability matrix, an end device still needs to have Al or ML capabilities and adequate resources. In this case, the UE 401 does not have enough resources and cannot support Al functionality of model training. As shown at step 435b, the UE 401 may send a complete sample training data to the network node 404 which has Al or ML function, such as Al native NF (e.g. NWDAF MTLF) or an external OTT server, for requesting a model training for a model.

[0157]

[0161] In an example, the UE 401 may transmit a message or a request specifying a model or a task (e.g., a task of data analytics) for which the sample training data is to be training. In another example, the analytics is already known to the NWDAF MTLF, and then this request is not necessary. In some embodiments, the UE 401 may also transmit to the network node 404, a request for relevant features (e.g., most relevant features) for the corresponding sample training data. The request may be send together with the sample training data and / or the message.

[0158]

[0162] Then, at step 440b, the network node 404 (e.g. NWDAF MTLF or OTT server) may perform model training with the received sample training data, in which an explainability matrix may be used to determine the relevant features in the sample training data for the model traning. In this regard, the network node 404 can request another NF (such as a 6G PC NF or an 0AM, or another NWDAF) to provide this explainability matrix corresponding to the model training or analytics requested by the UE 401. It is understood that there can be different explainability matrix for different analytics / model. Alternatively, the UE 401 can provide this explainability matrix at step 435b.

[0163] For example, in an example where SHAP is used to calculate the relevant features, the network node 404 may calculate SHAP values of input features for the model trained with the sample training data. Then, impactful features (e.g., top-ranked features) which have impact on the output of the model trained with the sample training data can be found based on the calculated SHAP values. These impactful features may be determined as relevant features for the sample training data.

[0159]

[0164] Then, at step 445b, the network node 404 transmits the relevant features for the sample training data back to the UE 401. These relevant features are substantially the most important features needed for the model training. Accordingly, the UE 401 may filter the complete training data collected at the UE 401 based upon the received relevant features, and prepares an optimized slim version of the training data which consists of the training data for the relevant features, as shown at step 450b.

[0160]

[0165] Then the UE 401 may transmit the slim version of the training data which is filtered at step 450b to the network node 404 (e.g., NWDAF MTLF or OTT server) for model training, as shown at step 455. This can also reduce unnecessary data transfer, preserving bandwidth without sacrificing model quality.

[0161]

[0166] In some embodiments, after performing model training with the slim version of the training data, the network node 404 may transmit a trained model to the UE 401. In this regard, model parameters for the trained model may be transmitted to the UE 401, together with impactful features using which the trained model was trained. These impactful features may be used to update the relevant features for the model, so as to aid faster local inference or subsequent model trainings for the model. In some cases, for example if the model and data behaviour do not changed drastically, these impactful features may overlap with the relevant features determined at step 435b or the relevant features determined at step 440b.

[0162]

[0167] FIG. 5 illustrates an exemplary scenario of optimized and sustainable security analytics using explainability matrix according to an embodiment of the present disclosure. In this scenario, explainability matrix or techniques are utilized for security analytics, for example, for detecting abnormalities in training data from a data producer, e.g., a UE or a NF. The security analytics is generated and provided to the data producer or 0AM, by an analytics function entity such as NWDAF.

[0163]

[0168] At step 510, an 0AM 501 configures a network node 502 (for instance a NWDAF) which is responsible for Al or ML security analytics, such as anomaly detection or detection of poisoning attacks. The network node 502 (e.g., NWDAF) may receive information of the configuration, including one or more explainability matrix to be used for the security analytics, from a network node 504 for policy control (e.g. 6G PC NF or PCF).

[0169] At step 515, the network node 502 (e.g., NWDAF) determines relevant features for each analytics, which are susceptible to poisoning attack and can be used in a system wide anomaly detection. An analytics identity (ID) is used to identify the type of supported analytics that the network node 502 (e.g., NWDAF) can generate. The relevant features for an analytics ID may be determined based on one of the received explainability matrix to be used for analytics identified by the analytics ID and training data used for past model trainings of a model for the analytics. In an example, the relevant features may be determined from a model trained in past rounds (e.g., the last round) of model training for the model for the analytics. In another example, the network node 502 may perform a model training with the training data used for past model trainings for the model with applying the explainability matrix. The relevant features may be determined from explainability of model parameters generated by the explainability matrix. For example, as indicated by the explainability of model parameters of the model, features impacting the output of the model (e.g., as indicated by SHAP values) may be selected as the relevant features.

[0164]

[0170] At step 520, the network node 502 (e.g., NWDAF) may further generate a mapping table for each analytics ID and corresponding relevant features. In an example, the mapping table may consist of analytics IDs, corresponding explainability matrix used for each analytics ID, corresponding sets of relevant features for each analytics ID, IDs of corresponding sets of training data (if present) used for each analytic ID, information of source data producers which provided corresponding training data. A set of relevant features corresponding to an analytics ID is based upon the explainability matrix used for the analytic ID, and it also serves as an indication which features (of input training data) were used majorly when generating the analytics of the analytics ID or training the model for the analytics.

[0165]

[0171] At step 525, a data producer 503 (e.g., a UE or a NF) which produce or collect training data, sends the training data to the network node 502 for request security analytics, e.g., for anomaly detection or detection of poisoning attack. In the case, the security analytics is based on a centralized learning or model training service.

[0166]

[0172] At step 530, the network node 502 (e.g., NWDAF) will just utilize the relevant features for the requested security analytics to detect if there is any poisoning or anomaly present in the received training data or not. In this regard, the network node 502 (e.g., NWDAF) will not be required to analyze all of the received training data. It can analyze a part of training data for only the relevant features. In the case of a detection of poisoning attack, the network node 502 (e.g., NWDAF) only checks if there is any indication of data tampering amongst the part of training data for the relevant features. This will increase the detection speed substantially, and also decrease the compute resources needed at the network node 502 to aid proactive detection.

[0173] In the case that the network node 502 (e.g., NWDAF) already has the relevant features and / or a mapping table created as shown at steps 515 and 520, the network node 502 (e.g., NWDAF) may check the mapping table to determine the relevant features for the requested security analytics. In the case that there is no existing relevant feature for the requested security analytics at the network node 502, it can determine a new set of relevant features for the requested security analytics in a similar way as depicted at step 515.

[0167]

[0174] At step 535, the network node 502 (e.g., NWDAF) may further use the training data newly received at step 525 to perform model training, so as to optimize (e.g., fine-tune model parameters) an existing model or create a new model for the request security analytics (e.g., anomaly detection). The explainability matrix provided earlier (at step 510) may be used to selectively train the model for better resource utilization. In an example, the network node 502 may filter the received training data with selecting only training data for the top-ranked features based on their SHAP values, i.e., selecting training data for impactful features, and then train the model only on that selected training data. The impactful features which impact the model training may be obtained using the explainability matrix.

[0168]

[0175] Then, at step 540, the network node 502 (e.g., NWDAF) may share this optimized or newly created model for the request security analytics (e.g., anomaly detection) to consumers of the security analytics, such as the data producer 503 or other UEs or NFs. The impactful features for the optimized or newly created model may be also shared for local inference. In the case that abnormalities or poisoning attack in the training data, or a malicious entity is detected, the network node 502 (e.g., NWDAF) may inform a detection result to the 0AM 501.

[0169]

[0176] FIG. 6 is a flow chart depicting a method 600 performed at a first node (e.g., at a UE or a NF) according to embodiments of the present disclosure. In an example, the method may be performed by a terminal device (e.g., UE shown as 201, 401 in FIGs. 2 and 4), or an apparatus for use in a terminal device. In another example, the method may be performed by a network node (e.g., NF2 shown as 303 in FIG. 3), or an apparatus for use in a network node.

[0170]

[0177] At block 610, the first node transmits to a first network node (such as a PCF), a first indication indicating a capability of the first node to support one or more explainability techniques in artificial intelligence or machine learning within a mobile communication network. The one or more explainability techniques may comprise at least one of SHAP, LIME, IG, DeepLIFT.

[0171]

[0178] At block 620, the first node receives a second indication indicating a policy defining how at least one explainability technique of the one or more explainability techniques is to be applied. The policy may indicate at least one of: a condition under which the at least one explainability technique is to be applied; or a threshold for a similarity between explainability of model parameters from a current round of model training for a model and explainability of model parameters from a previous round of model training for the model.

[0172]

[0179] At block 630, the first node performs the artificial intelligence or machine learning based on the policy. In some embodiments, the first node receives a message to start a model training for a model based on the policy.

[0173]

[0180] FIG. 7 is a flow chart depicting a method 700 performed at the first node for model training based on the policy according to an embodiment of the present disclosure. Blocks 710 to 740 may be implemented as or comprised in block 630 of FIG. 6. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity.

[0174]

[0181] At block 710, the first node determines explainability of model parameters for a model by applying at least one explainability technique according to the policy in data training of the model.

[0175]

[0182] At block 720, the first node determines a similarity between the determined explainability of model parameters from a current round of the model training and explainability of model parameters from a previous round of the model training.

[0176]

[0183] A selective model training may be performed based on a comparison of the determined similarity with a threshold defined in the policy. At block 730, in case that the determined similarity is equal to or greater than the threshold, the first node skips the current round of the model training and parameter sharing for the current round. At block 740, in case that the determined similarity is less than the threshold, the first node continues the current round of the model training and parameter sharing for the current round.

[0177]

[0184] FIG. 8 is a flow chart depicting a method 800 performed at the first node for model training based on the policy according to an embodiment of the present disclosure. Blocks 810 to 830 may be implemented as or comprised in block 630 of FIG. 6. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity.

[0178]

[0185] At block 810, the first node selects a first set of features which impact an output of a model according to the explainability of model parameters for the model. The explainability of model parameters is determined by applying at least one explainability technique according to the policy in data training of the model. The determined explainability of model parameters indicates impacts of respective input features of the model on an output of the model. A subset of these features (e.g., top-ranked features, the most impactful features) may be selected to consist of the first set of features. For example, these features may be ranked according to their SHAP values in an example SHAP is applied to the model training.

[0186] At block 820, the first node performs model training for the model with training data for the first set of features. In this regard, the first node may filter the complete training data, to select the training data for the first set of features which may be a subset of complete training data.

[0179]

[0187] In some embodiments, the first node may further transmit model parameters of the model trained with the training data for the first set of features together with the first set of features, as shown at block 830. In this regard, the first node may share the model parameters and the first set of features with a network node for federated learning.

[0180]

[0188] FIG. 9 is a flow chart depicting a method 900 performed at the first node for model training based on the policy according to an embodiment of the present disclosure. Blocks 910 and 930 may be implemented as or comprised in block 630 of FIG. 6. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity.

[0181]

[0189] At block 910, the first node determines a second set of features relevant to a model training for a model based on the policy. For example, the second set of features may be determined based on at least one explainability technique to be used in the model training, as described with reference to step 435a of FIG. 4.

[0182]

[0190] At block 920, the first node transmits training data for the second set of features to a second network node (such as a NWDAF) for performing model training for the model. In this regard, the first node may filter the complete training data to select the training data for the second set of features which may be a subset of complete training data.

[0183]

[0191] In some embodiments, the first node may receive from the second network node, model parameters of the model trained with the training data for the second set of features, together with a fourth set of features which impact an output of the trained model, as show at block 930. The fourth set of features may not be always completely different from the second set of features. For example, if the trained model and behavior of training data do not changed drastically, these sets of features may mutual overlap each other.

[0184]

[0192] FIG. 10 is a flow chart depicting a method 1000 performed at the first node for model training based on the policy according to an embodiment of the present disclosure. Blocks 1010 to 1040 may be implemented as or comprised in block 630 of FIG. 6. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity.

[0185]

[0193] At block 1010, the first node transmits a set of sample training data to a second network node (such as a NWDAF) for performing model training for a model. At least one explainability technique to be used in the model training may be also transmitted to the second network node.

[0194] At block 1020, the first node receives from the second network node, a third set of features which impact an output of the model trained with the set of sample training data. In this regard, the third set of features may be selected according to explainability of model parameters for the model trained with the set of sample training data by applying the at least one explainability technique.

[0186]

[0195] At block 1030, the first node transmits training data for the third set of features to the second network node for performing model training for the model. In this regard, the first node may filter the complete training data to select the training data for the third set of features which may be a subset of complete training data.

[0187]

[0196] In some embodiments, the first node may receive from the second network node, model parameters of the model trained with the training data for the third set of features, together with a fourth set of features which impact an output of the trained model, as show at block 1040. The fourth set of features may not be always completely different from the third set of features. For example, if the trained model and behavior of training data do not changed drastically, these sets of features may mutual overlap each other.

[0188]

[0197] FIG. 11 is a flow chart depicting a method 1100 performed at a second node according to an embodiment of the present disclosure. In an example, the method may be performed by a network node which can perform Al or ML model training (e.g., MTLF of NWDAF shown as 404 in FIG. 4), or an apparatus for use in the network node.

[0189]

[0198] At block 1110, the second node (such as NWDAF) receives a set of sample training data from a first node (such as a UE or NF). The set of sample training data may comprise a small amount of training data as compared with the complete set of training data produced or collected at the first node for model training.

[0190]

[0199] At block 1120, the second node (such as NWDAF) performs model training for a model with the set of sample training data by applying at least one explainability technique. The at least one explainability technique to be applied may be notified or retrieved from the first node or another network node (such as 6G PC NF, another NWDAF), or 0AM.

[0191]

[0200] At block 1130, the second node (such as NWDAF) determines a third set of features which impact an output of the model according to explainability of model parameters for the model trained with the set of sample training data. The explainability of model parameters indicates impacts of respective input features of the model on an output of the model. The explainability of model parameters for the model is generated by applying the at least one explainability technique in the model training on the set of sample training data.

[0201] At block 1140, the second node (such as NWDAF) transmits the third set of features to the first node.

[0192]

[0202] FIG. 12 is a flow chart depicting a method 1200 performed at a second node according to another embodiment of the present disclosure. In an example, the method may be performed by a network node which can perform Al or ML model training (e.g., MTLF of NWDAF shown as 404 in FIG. 4), or an apparatus for use in the network node.

[0193]

[0203] At block 1210, the second node (such as NWDAF) receives from a first node (such as a UE or NF), training data for a set of features for performing model training for a model. The set of features are those assessed to be relevant to the model training for the model. In an example, it may be the third set of features determined as shown at block 1130. In another example, it may be the second set of features determined as shown at block 910.

[0194]

[0204] At block 1220, the second node (such as NWDAF) performs model training for the model with the received training data by applying at least one explainability technique. The at least one explainability technique to be applied may be notified or retrieved from the first node or another network node (such as 6G PC NF, another NWDAF), or 0AM.

[0195]

[0205] In some embodiments, the second node (such as NWDAF) may further transmit to the first node, model parameters of the model trained with the received training data, together with a fourth set of features which impact an output of the trained model, at block 1230. In this regard, the fourth set of features may be determined according to the explainability of model parameters, which is generated by applying the at least one explainability technique in the model training of block 1220. The fourth set of features may not be always completely different from the second and third set of features. For example, if the trained model and behaviour of training data do not changed drastically, these sets of features may mutual overlap each other.

[0196]

[0206] FIG. 13 is a flow chart depicting a method 1300 performed at a second node according to yet another embodiment of the present disclosure. In an example, the method may be performed by a network node which can perform Al or ML model training (e.g., MTLF of NWDAF shown as 502 in FIG. 5), or an apparatus for use in the network node.

[0197]

[0207] At block 1310, the second node (such as NWDAF) receives from a first node (such as data producer, e.g., a UE or NE), training data to perform security analytics with artificial intelligence or machine learning.

[0198]

[0208] At block 1320, the second node (such as NWDAF) determines a first set of features relevant to a model training for the security analytics based on an explainability technique to be used for the model training. The explainability technique to be used in the model trainings may be determined based on configuration information for the second node’ s responsibility for the security analytics.

[0199]

[0209] In some embodiments, the second node may receive the configuration information from a network node for policy control (such as a 6G PC NF or PCF shown as 504 in FIG. 5). The configuration information may comprise indications of respective explainability techniques to be used in model trainings for each of one or more security analytics.

[0200]

[0210] In some embodiments, the second node may determine respective sets of features relevant to model trainings for each of the one or more security analytics based on the respective explainability techniques. Then, the second node may create a mapping table for each of the one or more security analytics and the respective sets of features relevant to model trainings for each of the one or more security analytics. The first set of features may be retrieved from the mapping table.

[0201]

[0211] At block 1330, the second node (such as NWDAF) performs the security analytics with a subset of the training data for the first set of features. In this regard, the second node may detect if there is any poisoning or anomaly present in the subset of the training data.

[0202]

[0212] In some embodiments, the second node (such as NWDAF) may perform model training with the subset of training data for the first set of features, to create or optimize a model for the security analytics.

[0203]

[0213] The determined explainability technique may be used in the model training. In this regard, the second node may determine explainability of model parameters for the model by applying the explainability technique, and determine a second set of features which impact an output of the model according to the determined explainability of model parameters. The determined explainability of model parameters indicates impacts of respective input features of the model on an output of the model. Then, the second node (such as NWDAF) may transmit model parameters of the trained model, together with the second set of features.

[0204]

[0214] FIG. 14 is a flow chart depicting a method 1400 performed at the third node according to an embodiment of the present disclosure. In an example, the method may be performed by a network node which can support explainability-based Al or ML model training (e.g., 6G PC NF or PCF shown as 203 or 403 in FIGs. 2 and 4), or an apparatus for use in the network node.

[0205]

[0215] At block 1410, the third node (such as PCF) stores a policy defining how at least one explainability technique is to be applied in artificial intelligence or machine learning within a mobile communication network. The policy may specify or include a condition under which the at least one explainability technique is to be applied. Alternatively or additionally, the policy may specify a thresh-based policy. In this regard, the policy may include a threshold for a similarity between explainability of model parameters from a current round of model training for a model and explainability of model parameters from a previous round of model training for the model. For example, the threshold may indicate that the current round of model training may be skipped in case that the similarity is equal to or greater than the threshold. The policy (including any of the conditions and the threshold) may vary and configurable by an operator of the mobile communication network.

[0206]

[0216] At block 1420, the third node (such as PCF) transmits the policy to a first node (such as a UE or a NF) according to a capability of the first node to support the at least one explainability technique. In this regard, the policy related to the at least one explainability technique supported by the first node would be provided to the first node.

[0207]

[0217] FIG. 15 is a flow chart depicting a method 1500 performed at the fourth node according to an embodiment of the present disclosure. In an example, the method may be performed by a network node which can support explainability -based Al or ML model training (e.g., a NF acting as FL server or coordinator shown as 301 in EIG. 3), or an apparatus for use in the network node.

[0208]

[0218] At block 1510, the third node (e.g., a EL server) transmits to a network node (such as a NRE) of the mobile communication network, a third indication indicating a capability of the third node to support one or more explainability techniques in artificial intelligence or machine learning within the mobile communication network.

[0209]

[0219] At block 1520, the third node (such as a NE) receives from the network node (such as a NRE), a first indication indicating a capability of another network node (e.g., a NF acting as FL client) to support at least one explainability technique of the one or more explainability techniques.

[0210]

[0220] At block 1530, the third node (such as a NF) transmits a message to said another network node (e.g., a FL client), to start a model training for a model based on a policy defining how the at least one explainability technique is to be applied for the model training. The policy may specify or include a condition under which the at least one explainability technique is to be applied. Alternatively or additionally, the policy may specify a thresh-based policy. In this regard, the policy may include a threshold for a similarity between explainability of model parameters from a current round of model training for a model and explainability of model parameters from a previous round of model training for the model. For example, the policy may be retrieved by the third node (such as a NF) from a PCF.

[0211]

[0221] Embodiments herein may enable the following advantages: reducing the training required in model training, especially in FL, decreasing the data transfer, especially for centralized learning, and optimizing and increasing the speed of generation of analytics (e.g., detection of attacks) by means of explainability. The embodiments herein are not limited to the features and advantages mentioned above. A person skilled in the art will recognize additional features and advantages upon reading the following detailed description.

[0212]

[0222] FIG. 16 shows, by way of example, a block diagram of an apparatus 10, that may be embodied in / as the terminal device, or the network node. The apparatus 10 comprises, for example, at least one processor 12 and at least one memory 14 storing instructions 15 that, when executed by the at least one processor, cause the apparatus 10 at least to perform the method or methods as disclosed herein, and any of the embodiments thereof. In an example, the at least one memory and the instructions (e.g. a computer program code, software), are configured, with the at least one processor, to cause the apparatus 10 to perform the method or methods as disclosed herein, and any of the embodiments thereof.

[0213]

[0223] A processor 12 may comprise circuitry, or be constituted as circuitry or circuitries, the circuitry or circuitries being configured to perform phases of methods in accordance with example embodiments described herein. As used in this application, the term “circuitry” may refer to one or more or all of the following: (a) hardware-only circuit implementations, such as implementations in only analog and / or digital circuitry, and (b) combinations of hardware circuits and software, such as, as applicable: (i) a combination of analog and / or digital hardware circuit(s) with software / firmware and (ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a user equipment, to perform various functions) and (c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation. This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.

[0214]

[0224] The memory 14 may be implemented using any suitable data storage technology. The memory may comprise a database for storing data. The memory 14 may be at least in part external to apparatus 10 but accessible to apparatus 10.

[0215]

[0225] The instructions 15 may be comprised in a computer readable medium or a non-transitory computer readable medium. A term non-transitory, as used herein, is a limitation of the medium itself (i.e. tangible, not a signal) as opposed to a limitation on data storage persistency (e.g. random access memory, RAM, vs. read only memory, ROM).

[0226] For example, the apparatus 10 is a terminal device, e.g., a UE. As another example, the apparatus is comprised in such a terminal device, e.g. as a chipset configured to control the transmitting device. The apparatus 10 may be caused or configured to perform at least the methods of FIG. 6-10 and / or any one or more of the embodiments described.

[0216]

[0227] As another example, the apparatus 10 is a network node, e.g. a NF, PCF or NWDAF. In another embodiment, the apparatus is comprised in such a network node, e.g. as a chipset configured to control the network node. The apparatus 10 may be caused or configured to perform at least the methods of FIGs. 6-15 and / or any one or more of the embodiments described.

[0217]

[0228] The apparatus may comprise one or more entities of any of protocol layers, such as a MAC entity, an RRC entity, an RLC entity, a PDCP entity or a PHY entity. In some embodiments, the entity is configured to perform at least the methods of FIGs. 6-15, and / or any one or more of the embodiments described.

[0218]

[0229] The apparatus 10 comprises a radio interface 16. The radio interface 16 may provide the apparatus 10 with communication capabilities. The radio interface 16 may comprise a receiver configured to receive information in accordance with at least one cellular or non-cellular standard. The radio interface 16 may comprise a transmitter configured to transmit information in accordance with at least one cellular or non-cellular standard. The receiver may comprise more than one receiver. The transmitter may comprise more than one transmitter. The radio interface 16 may comprise a transceiver configured to receive and transmit information in accordance with at least one cellular or non-cellular standard. The transceiver may comprise more than one transceiver.

[0219]

[0230] The apparatus 10 may comprise a user interface 18 comprising, for example, at least one of a keypad, a microphone, a touch display, a display, a speaker, etc. The user interface 18 may be used to control the apparatus by the user. The user interface 18 may be external to the apparatus 10. For example, the apparatus 10 may be connected to another device, such as a computer, either via wireless or wired connection, and the apparatus 10 is controlled by the user via the computer.

[0220]

[0231] In an embodiment, at least some of the processes described herein may be carried out by an apparatus comprising means for carrying out at least some of the described processes. Means for performing method steps as disclosed herein may include software and / or hardware components of the apparatus 10. For example, the at least one processor 12, the memory 14, and the computer program code form means for carrying out the method or methods as disclosed herein, and any of the embodiments thereof. As used herein the term “means” is to be construed in singular form, i.e. referring to a single element, or in plural form, i.e. referring to a combination of single elements. Therefore, terminology “means for [performing A, B, C]”, is to be interpreted to cover an apparatus in which there is only one means for performing A, B and C, or where there are separate means for performing A, B and C, or partially or fully overlapping means for performing A, B, C. Further, terminology “means for performing A, means for performing B, means for performing C” is to be interpreted to cover an apparatus in which there is only one means for performing A, B and C, or where there are separate means for performing A, B and C, or partially or fully overlapping means for performing A, B, C.

[0221]

[0232] It should be appreciated that at least some aspects of the exemplary embodiments of the disclosures may be embodied in computer-executable instructions, such as in one or more program modules, executed by one or more computers or other devices. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types when executed by a processor in a computer or other device. The computer executable instructions may be stored on a computer readable medium, for example, non-transitory computer readable medium, such as a hard disk, optical disk, removable storage media, solid state memory, RAM, etc. As will be appreciated by one of skills in the art, the function of the program modules may be combined or distributed as desired in various embodiments. In addition, the function may be embodied in whole or in part in firmware or hardware equivalents such as integrated circuits, field programmable gate arrays (FPGA), and the like.

[0222]

[0233] Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are contained in the above discussions, these should not be construed as limitations on the scope of the present disclosure, but rather as descriptions of features that may be specific to particular embodiments. Certain features that are described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment may also be implemented in multiple embodiments separately or in any suitable sub-combination.

[0223]

[0234] Even though the invention has been described above with reference to an example according to the accompanying drawings, it is clear that the invention is not restricted thereto but may be modified in several ways within the scope of the appended claims. Therefore, all words and expressions should be interpreted broadly and they are intended to illustrate, not to restrict, the embodiment. It will be obvious to a person skilled in the art that, as technology advances, the inventive concept may be implemented in various ways. Further, it is clear to a person skilled in the art that the described embodiments may, but are not required to, be combined with other embodiments in various ways.

Claims

CLAIMS1. An apparatus operating in a mobile communication network, the apparatus comprising: at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to: receive training data to perform security analytics with artificial intelligence or machine learning; determine a first set of features relevant to a model training for the security analytics based on an explainability technique to be used for the model training; and perform the security analytics with a subset of the training data for the first set of features.

2. The apparatus according to claim 1, wherein when the instructions are executed by the at least one processor, the instructions further cause the apparatus at least to, receive information related to configuration for one or more security analytics with artificial intelligence or machine learning, wherein the information comprises indications of respective explainability techniques to be used in model trainings for each of the one or more security analytics.

3. The apparatus according to claim 2, wherein the information related to the configuration is received from a policy control entity.

4. The apparatus according to claim 2 or 3, wherein when the instructions are executed by the at least one processor, the instructions further cause the apparatus at least to, determine respective sets of features relevant to model trainings for each of the one or more security analytics based on the respective explainability techniques; and create a mapping table for each of the one or more security analytics and the respective sets of features relevant to model trainings for each of the one or more security analytics.

5. The apparatus according to claim 4, wherein when the instructions are executed by the at least one processor, the instructions further cause the apparatus at least to, retrieve the first set of features based on the mapping table.

6. The apparatus according to any of claims 1 to 5, wherein when the instructions are executed by the at least one processor, the instructions further cause the apparatus at least to, perform a model training for a model for the security analytics with the subset of training data for the first set of features.

7. The apparatus according to claim 6, wherein when the instructions are executed by the at least one processor, the instructions further cause the apparatus at least to, determine explainability of model parameters for the model by applying the explainability technique; determine a second set of features which impact an output of the model according to the determined explainability of model parameters, wherein the determined explainability of model parameters indicates impacts of respective input features of the model on an output of the model; and transmit model parameters of the trained model, together with the second set of features.

8. The apparatus according to any of claims 1 to 7, wherein the explainability technique comprises at least one of,SHapley Additive exPlanations (SHAP) technique;Local Interpretable Model- agnostic Explanations (LIME) technique;Itegrated Gradients (IG) technique; orDeepLIFT technique.

9. The apparatus according to any of claims 1 to 8, wherein the network node is a network data analytics function (NWDAF) entity.

10. A method performed in a mobile communication network, the method comprising: receiveing training data to perform security analytics with artificial intelligence or machine learning; determining a first set of features relevant to a model training for the security analytics based on an explainability technique to be used for the model training; and performing the security analytics with a subset of the training data for the first set of features.

11. The method according to claim 10, further comprising: receiving information related to configuration for one or more security analytics with artificial intelligence or machine learning, wherein the information comprises indications of respective explainability techniques to be used in model trainings for each of the one or more security analytics12. The method according to claim 11, wherein the information related to the configuration is received from a policy control entity.3913. The method according to claim 10 or 11, further comprising: determining respective sets of features relevant to model trainings for each of the one or more security analytics based on the respective explainability techniques; and creating a mapping table for each of the one or more security analytics and the respective sets of features relevant to model trainings for each of the one or more security analytics.

14. The method according to claim 13, further comprising: retrieving the first set of features based on the mapping table.

15. The method according to any of claims 10 to 14, further comprising: performing a model training for a model for the security analytics with the subset of training data for the first set of features.

16. The method according to claim 15, further comprising: determining explainability of model parameters for the model by applying the explainability technique; determining a second set of features which impact an output of the model according to the determined explainability of model parameters, wherein the determined explainability of model parameters indicates impacts of respective input features of the model on an output of the model; and transmitting model parameters of the trained model, together with the second set of features.

17. The method according to any of claims 10 to 16, wherein the explainability technique comprises at least one of,SHapley Additive exPlanations (SHAP) technique;Local Interpretable Model- agnostic Explanations (LIME) technique;Itegrated Gradients (IG) technique; orDeepLIFT technique.

18. The method according to any of claims 10 to 17, wherein wherein the network node is a network data analytics function (NWDAF) entity.

19. A computer-readable medium having computer program codes embodied thereon which, when executed by a processor, cause the processor to perform the method according to any of claims 10 to 18.

20. A computer program product comprising computer programs or instructions which, when40executed by a processor, cause the processor to perform any of the methods according to any of claims 10 to 18.

Images