System and method for detecting PING-PONG behavior of user devices in a communication network

Abstract

Disclosed herein is a system (200) and a method (400) for detecting ping-pong behavior of user devices in a communication network. The method processes two categories of data logs, one originating from a core network and other from Radio Access Network (RAN) nodes linked to the user devices. After applying multiple preprocessing steps to refine these logs, the method identifies inter-Radio Access Technology (RAT) transitions for each user device and calculates frequency of such transitions within a specified time interval. If the observed frequency exceeds a predefined threshold, the user device is flagged as exhibiting the ping-pong behavior. The method further generates a structured list of affected user devices along with their associated sectors. By accurately detecting excessive inter-RAT transitions, the method provides actionable insights that enable network operators to optimize handover strategies, reduce unnecessary signaling, and improve overall network performance and user experience.

Description

SYSTEM AND METHOD FOR DETECTING PING-PONG BEHAVIOR OF USER DEVICES IN A COMMUNICATION NETWORK TECHNICAL FIELD

[0001] The embodiments of the present disclosure generally relate to the field of communication networks. More particularly, the present disclosure relates to a system and a method for detecting ping-pong behavior of user devices in a communication network.BACKGROUND OF THE INVENTION

[0002] The subject matter disclosed in the background section should not be assumed or construed to be prior art merely because of its mention in the background section. Similarly, any problem statement mentioned in the background section or its association with the subject matter of the background section should not be assumed or construed to have been previously recognized in the prior art.

[0003] Wireless communication networks, such as Fourth Generation Long Term Evolution (4GLTE) networks and Fifth Generation (5G) networks, are designed to provide uniform and continuous connectivity to mobile users. As mobile users move across different geographical locations or experience variations in radio signal conditions, user devices may transition between different Radio Access Technologies (RATs), such as transitioning from a 4G network to a 5G network or vice versa. These transitions, commonly referred to as handovers or inter-RAT transitions, are intended to maintain service continuity and optimize network performance.

[0004] While such handovers are generally beneficial, certain operating conditions result in frequent and unnecessary RAT transitions, commonly referred to as ping-pong behavior. Ping-pong behavior typically occurs when a user device repeatedly switches between two or more RATs over a short period of time. This behavior is particularly prevalent for the user devices in idle mode, where mobility decisionsare often driven by fluctuating radio conditions, weak signal strength, suboptimal handover thresholds, coverage overlap between neighboring cells or sectors, or temporary interference effects.

[0005] The Ping-pong behavior introduces several technical challenges within a communication network. Frequent RAT transitions generate excessive signaling traffic on both the core network and the Radio Access Network (RAN), increasing processing load on network elements such as Mobility Management Entities (MMEs), Access and Mobility Management Functions (AMFs), and radio access nodes. Additionally, repeated signaling exchanges adversely impact the user devices by increasing power consumption, thereby reducing battery life. From a user perspective, the ping-pong behavior may also lead to degraded service quality, increased latency, and intermittent service disruptions.

[0006] Conventional approaches for identifying and managing the ping-pong behavior often rely on limited analysis of either core-network signaling data or isolated RAN performance metrics. Such approaches fail to provide a holistic view of user mobility behavior because they do not effectively correlate signaling events with radio conditions, sector information, and user location. In many deployments, identification of inefficient mobility patterns still depends on manual inspection of large volumes of heterogeneous logs generated by the core network and the RAN, which is time-consuming, error-prone, and impractical for large-scale networks.

[0007] Furthermore, existing systems typically lack the ability to automatically distinguish between normal mobility-related handovers and problematic ping-pong behavior based on both the frequency of inter-RAT transitions and the time intervals over which those transitions occur. Without an automated and structured analysis framework, network operators are unable to efficiently identify specific user devices or radio sectors that contribute disproportionately to signaling overhead and mobility inefficiencies.

[0008] Accordingly, there exists a need for an improved system and method that automatically detects the ping-pong behavior of the user devices in the communication network.SUMMARY

[0009] The following embodiments present a simplified summary to provide a basic understanding of some aspects of the disclosed invention. This summary is not an extensive overview, and it is not intended to identify key / critical elements or to delineate the scope thereof. Its sole purpose is to present some concepts in a simplified form as a prelude to the more detailed description that is presented later.

[0010] According to an aspect of the present disclosure, disclosed herein is a method for detecting ping-pong behavior of one or more user devices in a communication network. The method comprises receiving, periodically at predefined time intervals by a receiving module, a first set of data logs associated with the one or more user devices from a core network, and a second set of data logs associated with the one or more user devices from one or more Radio Access network (RAN) nodes serving the one or more user devices. The method further comprises performing, by a data processing module, a plurality of preprocessing operations on each of the received first set of data logs and the second set of data logs to generate a set of preprocessed data logs. The method further comprises identifying, by an identification module, based on the generated set of the preprocessed data logs, inter-Radio Access Technology (RAT) transitions for each user device among the one or more user devices. The method further comprises determining, by a determination module, for each user device among the one or more user devices, time intervals at which the inter-RAT transitions are identified and a frequency of the identified inter-RAT transitions within the determined time intervals. The method further comprises comparing, by a comparison module, for each user device among the one or more user devices, the determined frequency of the identified inter-RAT transitions of the one or more user devices with a predefined threshold frequency. The method further comprises detecting, by a detectionmodule, a set of user devices among the one or more user devices exhibiting the ping-pong behavior based on a result of the comparison that the determined frequency of the identified inter-RAT transitions of the set of user devices among the one or more user devices exceeds the predefined threshold frequency and generating, by a generation module, a list of the set of user devices exhibiting the ping-pong behavior.

[0011] In one or more implementations, the method further comprises detecting a set of sectors among the one or more sectors, associated with the set of user devices, exhibiting the ping-pong behavior by identifying, by the identification module, from the second set of data logs, sector identifier information associated with each user device among the set of user devices. The method further comprises calculating, by the determination module, a percentage of ping-pong handovers for each sector among the one or more sectors based on the sector identifier information and corresponding inter- RAT transitions for each user device among the set of user devices. The method further comprises comparing, by the comparison module, the calculated percentage of the ping-pong handovers for each sector among the one or more sectors with a predefined threshold percentage and detecting, by the detection module, the set of sectors among the one or more sectors exhibiting the ping-pong behavior based on a result of the comparison that the calculated percentage of the ping-pong handovers of the set of sectors among the one or more sectors exceeds the predefined threshold percentage.

[0012] In one or more implementations, the method further comprises generating, by the generation module, a list of the set of sectors with corresponding sector identifiers among the one or more sectors exhibiting the ping-pong behavior.

[0013] In one or more implementations, the first set of data logs comprises one or more signaling events including at least one of a Tracking Area Update (TAU) event, a Routing Area Update (RAU) event, an attachment of the one or more user devices to the core network, and a detachment of the one or more user devices from the core network.

[0014] In one or more implementations the second set of data logs comprises signal strength information, signal quality parameters, and location data corresponding to the one or more user devices and the one or more sectors.

[0015] In one or more implementations, the plurality of preprocessing operations comprises standardizing, by the data processing module, timestamps associated with each of the first set of data logs and the second set of data logs and sorting, by the data processing module, each of the first set of data logs and the second set of data logs based on identifier information corresponding to the one or more user devices, sector identifier information associated with each user device, and a type of one or more signaling events included in the first set of data logs. The method further comprises combining, by the data processing module upon the sorting, each of the first set of data logs and the second set of data logs. The combining comprises associating each of the first set of data logs with last recorded second set of data logs in connected mode.

[0016] In one or more implementations, the list of the set of user devices exhibiting the ping-pong behavior further comprises, for each user device, metadata extracted from the generated set of the preprocessed data logs, the metadata including the frequency of the identified inter-RAT transitions, corresponding inter-RAT timeinterval values, signal strength information, signal quality parameters, and location data derived from the second set of data logs.

[0017] According to another aspect of the present disclosure, a system for detecting ping-pong behavior of one or more user devices in a communication network is described. The system comprises a receiving module, a data processing module, an identification module, a determination module, a comparison module, a detection module, and a generation module. The receiving module is configured to receive, periodically at predefined time intervals, a first set of data logs associated with the one or more user devices from a core network, and a second set of data logs associated with the one or more user devices from one or more Radio Access network (RAN) nodes serving the one or more user devices. The data processingmodule is configured to perform a plurality of preprocessing operations on each of the received first set of data logs and the second set of data logs to generate a set of preprocessed data logs. The identification module is configured to identify, based on the generated set of the preprocessed data logs, inter-Radio Access Technology (RAT) transitions for each user device among the one or more user devices. The determination module is configured to determine, for each user device among the one or more user devices, time intervals at which the inter-RAT transitions are identified and a frequency of the identified inter-RAT transitions within the determined time intervals. The comparison module is configured to compare, for each user device among the one or more user devices, the determined frequency of the identified inter-RAT transitions of the one or more user devices with a predefined threshold frequency. The detection module is configured to detect a set of user devices among the one or more user devices exhibiting the ping-pong behavior based on a result of the comparison that the determined frequency of the identified inter-RAT transitions of the set of user devices among the one or more user devices exceeds the predefined threshold frequency. The generation module is configured to generate a list of the set of user devices among the one or more user devices exhibiting the ping-pong behavior.BRIEF DESCRIPTION OF DRAWINGS

[0018] Various embodiments disclosed herein will become better understood from the following detailed description when read with the accompanying drawings. The accompanying drawings constitute a part of the present disclosure and illustrate certain non-limiting embodiments of inventive concepts. Further, components and elements shown in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. For consistency and ease of understanding, similar components and elements are annotated by reference numerals in the exemplary drawings.

[0019] FIG. 1 illustrates a communication environment depicting a ping-pong behavior, in accordance with an embodiment of the present disclosure.

[0020] FIG.2 illustrates a system architecture for detecting the ping-pong behavior in a communication network, in accordance with an embodiment of the present disclosure.

[0021] FIG. 3 illustrates a block diagram depicting an architecture of a user analytics / report server, in accordance with an embodiment of the present disclosure.

[0022] FIG.4 illustrates a flowchart depicting a method for detecting the ping-pong behavior of the user devices in the communication network, in accordance with an embodiment of the present disclosure.

[0023] FIG. 5 illustrates a flowchart depicting a method for generating a list of sectors exhibiting the ping-pong behavior, in accordance with an embodiment of the present disclosure.

[0024] FIG. 6 illustrates a schematic block diagram depicting a computing system for detecting the ping-pong behavior of the user devices in the communication network, in accordance with an embodiment of the present disclosure.DETAILED DESCRIPTION OF THE INVENTION

[0025] Inventive concepts of the present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which examples of one or more embodiments of inventive concepts are shown. Inventive concepts may, however, be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Further, the one or more embodiments disclosed herein are provided to describe the inventive concept thoroughly and completely, and to fully convey the scope of each of the present inventive concepts to those skilled in the art. Furthermore, it should be noted that the embodiments disclosed herein are not mutually exclusive concepts. Accordingly, one or more components from one embodiment may be tacitly assumed to be present or used in any other embodiment.

[0026] The following description presents various embodiments of the present disclosure. The embodiments disclosed herein are presented as teaching examples and are not to be construed as limiting the scope of the present disclosure. The present disclosure should in no way be limited to the illustrative implementations, drawings, and techniques illustrated below, including the exemplary design and implementation illustrated and described herein, but may be modified, omitted, or expanded upon without departing from the scope of the present disclosure.

[0027] The following description contains specific information pertaining to embodiments in the present disclosure. The detailed description uses the phrases “in some embodiments” or “some implementations” which may each refer to one or more or all of the same or different embodiments or implementations. The term “some” as used herein is defined as “one, or more than one, or all.” Accordingly, the terms “one,” “more than one,” “more than one, but not all” or “all” would all fall under the definition of “some.” In view of the same, the terms, for example, “in an embodiment” or “in an implementation” refers to one embodiment or one implementation and the term, for example, “in one or more embodiments” refers to “at least one embodiment, or more than one embodiment, or all embodiments.” Further, the term, for example, “in one or more implementations” refers to “at least one implementation, or more than one implementation, or all implementations.

[0028] The term “comprising,” when utilized, means “including, but not necessarily limited to;” it specifically indicates open-ended inclusion in the so-described one or more listed features, elements in a combination, unless otherwise stated with limiting language. Furthermore, to the extent that the terms “includes,” “has,” “have,” “contains,” and other similar words are used in either the detailed description, such terms are intended to be inclusive in a manner similar to the term “comprising.”

[0029] In the following description, for the purposes of explanation, various specific details are set forth in order to provide a thorough understanding of embodiments of the present disclosure. It will be apparent, however, thatembodiments of the present disclosure may be practiced without these specific details. Several features described hereafter can each be used independently of one another or with any combination of other features.

[0030] The description provided herein discloses exemplary embodiments only and is not intended to limit the scope, applicability, or configuration of the present disclosure. Rather, the foregoing description of the exemplary embodiments will provide those skilled in the art with an enabling description for implementing any of the exemplary embodiments. Specific details are given in the following description to provide a thorough understanding of the embodiments. However, it may be understood by one of the ordinary skilled in the art that the embodiments disclosed herein may be practiced without these specific details.

[0031] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. As used herein the description, the singular forms "a", "an", and "the" include plural forms unless the context of the invention indicates otherwise.

[0032] The terminology and structure employed herein are for describing, teaching, and illuminating some embodiments and their specific features and elements and do not limit, restrict, or reduce the scope of the present disclosure. Accordingly, unless otherwise defined, all terms, and especially any technical and / or scientific terms, used herein may be taken to have the same meaning as commonly understood by one having ordinary skill in the art.

[0033] An object of the present disclosure is to provide a system and a method for detecting ping-pong behavior of user devices in a communication network by analyzing Radio Access Technology (RAT) transitions.

[0034] Another object of the present disclosure is to provide a system and a method for identifying frequent RAT transitions in an idle mode of the user devices.

[0035] Yet another object of the present disclosure is to provide a system and a method that identify network sectors exhibiting frequent ping-pong handovers based on user mobility patterns and signaling events.

[0036] In order to facilitate an understanding of the disclosed invention, a number of terms are defined below.

[0037] The RAT: The RAT is a type of wireless communication technology used to connect the user devices to the communication network. The RAT defines how data is transmitted between the user devices (like smartphones) and the radio network.

[0038] A Radio Access Network (RAN): The RAN is a part of a mobile network that connects the user devices to a core network, consisting of cell towers, base stations (gNB / eNB), and associated infrastructure.

[0039] A Routing Area Update (RAU): The RAU is a procedure in the communication network where the user device updates its location when moving between routing areas, ensuring continuous service.

[0040] A Tracking Area Update (TAU): The TAU is a procedure in the 4G and the 5G networks where the user device updates its location when moving between tracking areas, allowing the network to track the user device status.

[0041] Attach / Detach Events: The attach / detach are the events where the user device connects (attach) or disconnects (detach) from the communication network. The attach is required for network registration, while the detach occurs when the user turns off their device or loses connection.

[0042] Reference Signal Received Power (RSRP): The RSRP measures a strength of a received signal from a cell tower, used to determine signal coverage.

[0043] A Reference Signal Received Quality (RSRQ): The RSRQ assesses signal quality by considering interference and signal strength, helping in handover decisions.

[0044] A Channel Quality Indicator (CQI): The CQI is a value reported by the user device to indicate how good the wireless channel is, influencing data transmission rates.

[0045] A Signal-to-Interference-plus-Noise Ratio (SINR): The SINR is a measure of the signal quality that considers both interference and noise levels, affecting overall network performance.

[0046] A Mobility Management Entity (MME): The MME is a key component in the 4G networks responsible for handling user authentication, mobility management, and session management.

[0047] An Access and Mobility Management Function (AMF): The AMF is the 5G equivalent of the MME, managing user sessions, mobility, and initial access procedures.

[0048] An International Mobile Subscriber Identity (IMSI): The IMSI is a unique identifier assigned to a mobile subscriber, used for tracking and authentication.

[0049] Aping pong handover: The ping pong handover is a situation where the user device frequently switches between two or more cells or the RATs within a short period.

[0050] The present disclosure relates to the system and the method for detecting the ping-pong behavior of the user devices and the network sectors in the communication network by analyzing signaling and radio performance data. The present disclosure focuses on identifying the user devices experiencing frequent and repetitive transitions between different RATs or network cells within the short period.

[0051] The method processes data logs obtained from the core network and the RAN. The data logs obtained from the core network provide insights into user mobility through signaling events such as the TAU, the RAU, the attach, and the detach events. The data logs obtained from the RAN capture radio conditions suchas signal strength and quality parameters, including the RSRP and the SINR. By preprocessing and correlating these data logs, the present disclosure determines frequency and time intervals of inter-RAT transitions. If the number of transitions exceeds a predefined threshold within a given timeframe, the user device is classified as exhibiting the ping-pong behavior. Further analysis aggregates handover data per sector to identify areas with high ping-pong handover occurrences, enabling targeted network optimization efforts.

[0052] Embodiments of the present disclosure will be described below in detail with reference to the accompanying drawings. FIG. 1- FIG. 6, discussed below, and the one or more embodiments used to describe the principles of the present disclosure are by way of illustration only and should not be construed in any way to limit the scope of the present disclosure. Those skilled in the art will understand that the principles of the present disclosure may be implemented in any suitably arranged system or device.

[0053] FIG. 1 illustrates a communication environment 100 depicting the ping-pong behavior, in accordance with an embodiment of the present disclosure.

[0054] FIG 1 represents the communication environment 100 where a user device 110 experiences frequent transitions, or "ping-pong" effects, between two different RATs i.e., the 4G and the 5G networks. Referring to FIG. 1, the ping-pong behavior occurs when the user device 110 moves within an overlapping coverage area of both the networks, leading to repeated handovers between a 4G eNB (Evolved Node B) base station 106 and a 5G gNB (Next Generation Node B) base station 108. Such handovers negatively impact network performance, increasing signaling load, degrading user experience, and causing higher power consumption in the user device 110. In an embodiment shown in FIG.l, a 4G network 104 is depicted as a smaller coverage area, representing regions where LTE signal strength is relatively stronger. A 5G network 102, on the other hand, provides broader coverage, indicating a presence of a larger area where the 5G connectivity is available. The user device 110, positioned within an overlap of these two coverage areas,frequently switches between the 4G network 104 and the 5G network 102 due to fluctuating signal conditions such as the RSRP and the SINR. These factors influence decision-making at the user device 110 side when selecting the most suitable RAT to stay connected to. In one non-limiting example, as the user device 110 moves closer to the 5G network 102 coverage boundaries, it may trigger handovers to the 4G network 104 due to insufficient 5G signal strength. In another non-limiting example, when the user device 110 moves back into stronger 5G network 102 coverage, it reconnects to the 5G gNB 108, resulting in a continuous loop of transitions known as the ping-pong effect. This issue is often worsened in the idle mode when the user device 110 is not actively transmitting data but still periodically updates its location with the network, causing unnecessary signaling overhead.

[0055] To address this issue, network operators may leverage core network logs (such as MME / AMF logs) and RAN logs (Call Summary Logs (CSL) to analyze the frequency of inter-RAT transitions. These logs provide critical insights, including the location of the user device, signal quality metrics (e.g., the RSRP, the SINR, the CQI), and handover timestamps. By processing and analyzing these logs, the network operators may identify patterns of frequent RAT switching and implement optimization strategies, such as adjusting handover thresholds, tuning cell reselection parameters, or improving coverage overlap between the 4G and the 5G networks.

[0056] FIG. 2 illustrates a system architecture 200 for detecting the ping-pong behavior in the communication network, in accordance with an embodiment of the present disclosure.

[0057] As shown in FIG.2, the system architecture 200 (may also be referred as the system 200) comprises a Trace Collection Entity (TCE) 202 for the RAN CSL logs, a user analytics / report server 204, MME / the AMF 206 for core logs. The TCE 202 collects the RAN CSL logs, specifically from the 4G eNB and the 5G gNB nodes which provide detailed radio parameters, including signal strength metrics such asthe RSRP, the RSRQ, signal quality metrics such as the CQI, the SINR and location information such as sector identifiers (IDs) of cell sites where mobile users are connected. In various embodiments, the TCE 202 continuously monitors the user devices in the idle mode and records RAN-level data for events where network changes (e.g., the handovers between the 4G network 104 and the 5G network 102) occur. The data is forwarded to the system 200 for integration with the core signaling logs, enabling an identification of the mobile users experiencing the frequent RAT transitions.

[0058] The MME in the 4G and the AMF in the 5G are core network components that manage user mobility and session-related signaling. The MME / AMF 206 provides the core signaling logs, which include mobility events such as the attach, the detach, the TAU, and the RAU, inter-RAT handover events such as the logs of user transitions between different RATs, and time-sequenced signaling data to analyze event intervals. These logs are sent to the system 200 for preprocessing and integration with the RAN CSL logs.

[0059] The system 200 integrates the data from both the TCE 202 and the MME / AMF 206 and preprocesses the data to combine core signaling events with RAN signal conditions. The user analytics / report server 204 processes the combined data to identify the ping-pong behavior using structured algorithms. Further, analytics reports are generated comprising a list of the users and the sectors exhibiting the ping-pong behavior.

[0060] FIG. 3 illustrates a block diagram depicting an architecture of the user analytics / report server 204 (hereinafter referred as “the server 204), in accordance with an embodiment of the present disclosure.

[0061] As shown in FIG. 3, the server 204 includes a processor 302, a memory 304, a communication interface 306, an Input / Output (VO) interface 308, and communication modules 310. Components of the server 204 are coupled to each other via a first communication bus 300-2.

[0062] The processor 302 may include various processing circuitry and communicate with the memory 304, and the communication interface 306 via the first communication bus 300-2. The processor 302 is configured to execute instructions or a set of instructions stored in the memory 304 to perform various processes. In an implementation, the processor 302 may also include the communication modules 310. Components of the communication modules 310 are coupled to each other via a second communication bus 300-4.

[0063] The processor 302 may include a general-purpose processor, such as, for example, and without limitation, a Central Processing Unit (CPU), an Application Processor (AP), a dedicated processor, a Graphics-only Processing Unit such as a Graphics Processing Unit (GPU) or the like, a programmable logic device, or any combination thereof.

[0064] The memory 304 stores the set of instructions required by the processor 302 of for controlling its overall operations. The memory 304 may include non-volatile storage elements. Examples of such non-volatile storage elements may include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of Electrically Programmable Memories (EPROM) or Electrically Erasable and Programmable (EEPROM) memories. In addition, the memory 304 may, in some examples, be considered a non-transitory storage medium. The "non-transitory" storage medium is not embodied in a carrier wave or a propagated signal. However, the term "non-transitory" should not be interpreted as the memory 304 is nonmovable. In some examples, the memory 304 may be configured to store larger amounts of information. In certain examples, a non-transitory storage medium may store data that can, over time, change (e.g., in Random Access Memory (RAM) or cache). The memory 304 may be an internal storage unit or an external storage unit, cloud storage, or any other type of external storage.

[0065] The communication interface 306 may include an electronic circuit specific to a standard that enables wired or wireless communication. The communication interface 306 is configured for communicating with external devices via networks.

[0066] The I / O interface 308 may include suitable logic, circuitry, interfaces, and / or codes that may be configured to receive input(s) and present (or display) output(s) on the server 204. For example, the I / O interface 308 may have an input interface (not shown) and an output interface (not shown). The input interface may be configured to enable a user to provide input(s) to trigger (or configure) the server 204 for performing data processing operation(s). Examples of the input interface may include, but are not limited to, a touch interface, a mouse, a keyboard, a motion recognition unit, a gesture recognition unit, a voice recognition unit, or the like. The output interface may be configured to display (or present) output(s) generated (or provided) by the server 204. Examples of the output interface may include, but are not limited to, a digital display, an analog display, a touch screen display, an appearance of a desktop, and / or illuminated characters. Aspects of the present disclosure are intended to include or otherwise cover any type of the input interface and output interface in the I / O interface 308, including known, related art, and / or later developed technologies without deviating from the scope of the present disclosure.

[0067] The communication modules 310 comprises a receiving module 320, a data processing module 330, an identification module 340, a determination module 350, a comparison module 360, a detection module 370, and a generation module 380. The receiving module 320 is configured to receive, periodically at predefined time intervals, a first set of data logs associated with the one or more user devices from the core network, and a second set of data logs associated with the one or more user devices from one or more RAN nodes serving the one or more user devices. The data processing module 330 is configured to perform a plurality of preprocessing operations on each of the received first set of data logs and the second set of data logs to generate a set of preprocessed data logs. The identification module 340 is configured to identify, based on the generated set of the preprocessed data logs, the inter- RAT transitions for each user device among the one or more user devices. The determination module 350 is configured to determine, for each user device among the one or more user devices, the time intervals at which the inter-RAT transitionsare identified and the frequency of the identified inter-RAT transitions within the determined time intervals. The comparison module 360 is configured to compare, for each user device among the one or more user devices, the determined frequency of the identified inter-RAT transitions of the one or more user devices with a predefined threshold frequency. The detection module 370 is configured to detect a set of user devices among the one or more user devices exhibiting the ping-pong behavior based on a result of the comparison that the determined frequency of the identified inter-RAT transitions of the set of user devices among the one or more user devices exceeds the predefined threshold frequency. The generation module 380 is configured to generate the list of the set of user devices among the one or more user devices exhibiting the ping-pong behavior.

[0068] Further, to detect the set of sectors among the one or more sectors associated with the set of user devices exhibiting the ping-pong behavior, the identification module 340 is configured to identify, from the second set of data logs, sector identifier information associated with each user device among the set of user devices. The determination module 350 is configured to calculate a percentage of the ping-pong handovers for each sector among the one or more sectors based on the sector identifier information and corresponding inter- RAT transitions for each user device among the set of user devices. The comparison module 360 is configured to compare the calculated percentage of the ping-pong handovers for each sector among the one or more sectors with a predefined threshold percentage and the detection module is configured to detect the set of sectors among the one or more sectors exhibiting the ping-pong behavior based on a result of the comparison that the calculated percentage of the ping-pong handovers of the set of sectors among the one or more sectors exceeds the predefined threshold percentage. The generation module 380 is configured to generate the list of the set of sectors with corresponding sector identifiers among the one or more sectors exhibiting the ping-pong behavior.

[0069] Furthermore, to perform the plurality of preprocessing operations, the data processing module 330 is configured to standardize timestamps associated with each of the first set of data logs and the second set of data logs. The data processingmodule 330 is further configured to sort each of the first set of data logs and the second set of data logs based on identifier information corresponding to the one or more user devices, the sector identifier information associated with each user device, and a type of one or more signaling events included in the first set of data logs. The data processing module 330 is further configured to combine, upon the sorting, each of the first set of data logs and the second set of data logs.

[0070] Although FIG. 3 illustrates one example of the server 204, various changes may be made to FIG. 3. Further, various components in FIG. 3 may be combined, further subdivided, or omitted, and additional components may be added according to particular needs.

[0071] FIG. 4 illustrates a flowchart depicting a method 400 for detecting the ping-pong behavior of the user devices in the communication network, in accordance with an embodiment of the present disclosure. The method 400 begins at step 402.

[0072] At step 402, the receiving module 320 receives input data from two primary sources periodically at the predefined time intervals i.e. the input data is received at regular, recurring time gaps that are set before the execution of the method 400. In one or more embodiments, the predefined time intervals may be expressed in units such as seconds, minutes, or hours, depending on the requirements.

[0073] The first set of data logs may correspond to the core network logs. The core network logs are collected from the MME in the 4G and the AMF in the 5G. These logs include signaling events such as the TAU, the RAU and the events related to the attachment of the user devices to the core network, and the detachment of the user devices from the core network, and other mobility -related signaling messages. The user devices may correspond to mobile or wireless communication devices capable of accessing the communication network and performing the inter-RAT transitions, such as user equipment including the smartphones, tablets, Internet-of-Things (loT) devices, or other wireless terminals. The second set of data logs may correspond to the RAN CSL logs. The RAN CSL Logs are collected from the RAN nodes serving the user devices. The RAN CSL logs provide contextual data on radiosignal conditions including the signal strength metrics such as the RSRP and the RSRQ, the signal quality metrics such as the CQI and the SINR, and the location information identifying the geographical sector of the network. Core signaling data and RAN-level contextual information are integrated for a comprehensive view of user mobility behavior.

[0074] At step 404, the data processing module 330 performs pre-processing operations on the input data to generate the set of preprocessed data logs. The received logs are parsed to extract relevant fields such as the IMSI associated with subscribers, the timestamps associated with the received logs, the sector IDs, and event types (e.g., the TAU, the RAU, the attach and the detach). The timestamps are aligned into a standardized format to ensure chronological consistency. In a nonlimiting example, the timestamps associated with the core-network logs and the RAN CSL logs, which may be recorded in different time formats or time zones, are converted into a common standardized timestamp format to enable chronological ordering of events. The event types are filtered and sorted based on identifier information corresponding to the user devices, the sector identifier information associated with each user device, location data corresponding to the user devices and the sectors and a type of the event. In an implementation, the core signaling logs are further combined with the corresponding last recorded RAN CSL logs in connected mode for the same user device based on the identifier information. In a non-limiting example, when the core network logs indicates that the user device identified by a particular IMSI performs an idle-mode mobility event, the data-processing module 330 associates that signaling event with the RAN CSL log, most recently recorded for the same IMSI during the connected mode. This enables the idle-mode mobility event to be analyzed together with the corresponding sector, location, and the RF parameters derived from the RAN CSL logs. Thus, the generated set of pre-processed data logs represents a consolidated data set obtained after standardizing the timestamps, sorting and filtering the events by the user and sector identifier information, and combining the core-network logs with corresponding RAN CSL logs. The pre-processed data logs thus provide a unifiedand time-aligned view of signaling events and radio conditions for each user device, which is used for the detection of the ping-pong behavior.

[0075] At step 406, the identification module 340 identifies the inter-RAT transitions for each user device among the multiple user devices using the generated set of the preprocessed data logs. In a non-limiting example, using the pre-processed data logs, the identification module 340 may analyze the time-ordered records associated with each user device and detects changes in the RAT between successive events for the same user device. The inter-RAT transition is identified when the RAT indicated in a later event differs from the RAT indicated in a preceding event for that user device.

[0076] At step 408, the determination module 350 determine key metrics for the inter-RAT transitions. The time intervals at which the inter-RAT transitions are identified and the frequency of the identified inter-RAT transitions within the determined time intervals is calculated. The number or frequency of the RAT transitions for each user is calculated based on the condition:

[0077] Inter radio access technology (IRAT) Handover (HO) Count per IMSI = Count of logs when RAT(n) RAT(n-l) for a single IMSI.

[0078] Further, the time interval associated with the inter-RAT transitions for the user device is determined based on temporal differences between successive inter-RAT transitions associated with the user device. In one or more embodiments, the time interval may be determined by evaluating differences between the timestamps of consecutive inter-RAT transition events and aggregating the evaluated differences over a defined observation period.

[0079] For instance, the user with IMSI: 12345 experiences the following RAT transitions: Timestamp 1 : RAT = 4GTimestamp 2: RAT = 5GTimestamp 3 : RAT = 4G

[0080] In this case, the IRAT HO Count = 2 (since the RAT changed twice), and the IRAT HO time Interval is a sum of the time differences between the RAT transitions. The users who meet the above criteria are classified as the ping-pong users. The relevant logs and sector IDs associated with these handovers are identified.

[0081] As illustrated, the frequency of the inter-RAT transitions for the user device is determined with respect to one or more defined time intervals. In a non -limiting example, the determination module 350 may determine that the user device performs five inter-RAT transitions within a ten-minute interval, resulting in a transition frequency associated with that time interval. The determined frequency is then compared with a predefined threshold frequency corresponding to the same time interval. The predefined threshold frequency may represent a configurable limit specifying a maximum allowable number of inter-RAT transitions permitted within the corresponding time interval. When the determined transition frequency exceeds the predefined threshold frequency, the user device is identified as exhibiting the ping-pong behavior.

[0082] At step 410, the comparison module 360 compares, for each user device among the one or more user devices, the determined frequency of the identified inter-RAT transitions of the one or more user devices with the predefined threshold frequency. In a non-limiting example, if the user device is determined to perform five inter-RAT transitions within the ten-minute interval and the predefined threshold frequency is set to allow fewer than five transitions within the same time interval, the comparison module 360 determines that the threshold condition is exceeded.

[0083] At step 412, the detection module 370 detects the set of user devices exhibiting the ping-pong behavior based on the result of the comparison. In an implementation, the user device is classified as exhibiting the ping-pong behavior if the RAT transition frequency exceeds a threshold X (the IRAT HO Count per IMSI) within a specified time interval Y (the IRAT HO Time Interval). The user devices meeting above criteria are flagged as the ping-pong user devices and thecorresponding logs, including the sector IDs and the time intervals, are tagged as the ping-pong handovers. This step identifies problematic users whose frequent RAT transitions indicate inefficient mobility patterns.

[0084] At step 414, the generation module 380 generates the list of the user devices exhibiting the ping-pong behavior, along with the metadata extracted from the generated set of the preprocessed data logs, the metadata including frequency of the identified inter-RAT transitions, the time intervals between the transitions, the location details, the signal strength information, and the signal quality parameters. In a non-limiting example, when the comparison results indicate that multiple user devices exceed the predefined threshold frequency within the given time-interval, the identifiers and the metadata corresponding to those user devices are added to the ping-pong user list, while the user devices that do not exceed the predefined threshold frequency within the given time-interval, are excluded from the list.

[0085] FIG. 5 illustrates a flowchart depicting a method 500 for generating the list of sectors exhibiting the ping-pong behavior, in accordance with an embodiment of the present disclosure. The method 500 begins at step 502.

[0086] At step 502, the identification module 340 identifies, from the preprocessed RAN data logs, the sector identifier information corresponding to the inter-RAT transitions associated with the set of user devices previously detected as exhibiting the ping-pong behavior. The sector identifier information may include the identifiers of eNB or gNB sectors serving the user devices at the time of the inter-RAT transitions. The identification module 340 correlates the identified sector identifier information with the inter-RAT transitions for the set of user devices. The correlation enables the identification module 340 to associate each ping-pong handover event with the corresponding sector in which the transition occurred.

[0087] At step 504, the determination module 350 calculates, for each identified sector, the percentage of the ping-pong handovers. The percentage is determined based on a ratio of a count of ping-pong handover events associated with the sectorto a total count of handover events associated with the same sector over a predefined observation period.

[0088] At step 506, the comparison module 360 compares the calculated percentage of ping-pong handovers for each sector with a predefined sector-level threshold percentage.

[0089] At step 508, based on the result of the comparison, the detection module 370 detects one or more sectors exhibiting ping-pong behavior when the calculated percentage exceeds the predefined threshold percentage and classifies such sectors as the ping-pong sectors.

[0090] In an implementation, the sector is classified as problematic if the percentage of the ping-pong handovers exceeds a threshold Z%. The sectors meeting this criterion are flagged as ping-pong sectors, indicating areas with inefficient handover configurations or poor mobility management. This step highlights the sectors that require further optimization to improve network performance and reduce unnecessary handovers. For instance, consider a sector with the following handover data: Total HO Count: 300, Ping-Pong HO Count: 30.

[0091] Thus, the percentage of the ping-pong handovers for each identified sector may be calculated as 10% (30 / 300x100). If the predefined sector-level threshold Z is set to 5%, then this sector qualifies as a ping-pong sector.

[0092] At step 510, the generation module 380 generates an output comprising the list of the identified ping-pong sectors, which may be used by the network operator for further analysis, optimization of handover parameters, or adjustment of RAN configurations. The list of the identified ping-pong sectors may include, but not limited to, sector name, the sector identifiers, the location and the identifier information corresponding to the user devices.

[0093] FIG. 6 illustrates a schematic block diagram of a computing system 600 for detecting the ping-pong behavior of the user devices in the communication network, in accordance with an embodiment of the present disclosure.

[0094] The computing system 600 includes a network 610, a network interface 620, a processor 630 (similar in functionality to the processor 302 of FIG. 2), an Input / Output (I / O) interface 640 and a non-transitory computer readable storage medium 650 (hereinafter may also be referred to as the “storage medium 650” or the “storage media 650”).

[0095] The network interface 620 includes wireless network interfaces such as Bluetooth, Wi-Fi, Worldwide Interoperability for Microwave Access (WiMAX), General Packet Radio Service (GPRS), or Wideband Code Division Multiple Access (WCDMA) or wired network interfaces such as Ethernet, Universal Serial Bus (USB), or Institute of Electrical and Electronics Engineers-802 (IEEE-802).

[0096] The processor 630 may include various processing circuitry and communicate with the storage medium 650 and the VO interface 640. The processor 630 is configured to execute instructions stored in the storage medium 650 and to perform various processes. The processor 630 may include an intelligent hardware device including a general-purpose processor, such as, for example, and without limitation, the CPU, the AP, the dedicated processor, or the like, the graphics-only processing unit such as the GPU, the microcontroller, the FPGA, the programmable logic device, the discrete hardware component, or any combination thereof. The processor 630 may be configured to execute computer-readable instructions 652 stored in the storage medium 650 to cause the server 204 to perform various functions.

[0097] The storage medium 650 stores a set of instructions i.e., computer program instructions 652 (hereinafter may also be referred to as instructions 652) required by the processor 630 for controlling its overall operations.

[0098] The storage media 650 may include an electronic storage medium, a magnetic storage medium, an optical storage medium, a quantum storage medium, or the like. For example, the storage media 650 may include, but are not limited to, hard drives, floppy diskettes, optical disks, ROMs, RAMs, EPROMs, EEPROMs, flash memory, magnetic or optical cards, solid-state memory devices, or other types of physical media suitable for storing electronic instructions. In one or more embodiments, the storage media 650 includes a Compact Disk-Read Only Memory (CD-ROM), a Compact Disk-Read / Write (CD-R / W), and / or a Digital Video Disc (DVD).

[0099] In one or more implementations, the storage medium 650 stores computer program code configured to cause the computing system 600 to perform at least a portion of the processes and / or methods. Accordingly, in at least one implementation, the computing system 600 performs the method for detecting the ping-pong behavior of the user devices in the communication network.

[0100] Embodiments of the present disclosure have been described above with reference to flowchart illustrations of methods and systems according to embodiments of the disclosure, and / or procedures, algorithms, steps, operations, formulae, or other computational depictions, which may also be implemented as computer program products. In this regard, each block or step of the flowchart, and combinations of blocks (and / or steps) in the flowchart, as well as any procedure, algorithm, step, operation, formula, or computational depiction can be implemented by various means, such as hardware, firmware, and / or software including one or more computer program instructions embodied in computer-readable program code. As will be appreciated, any such computer program instructions may be executed by one or more computer processors, including without limitation a general -purpose computer or special purpose computer, or other programmable processing apparatus to perform a group of operations comprising the operations or blocks described in connection with the disclosed method.

[0101] Further, these computer program instructions, such as embodied in computer-readable program code, may also be stored in one or more computer-readable memory or memory devices (for example, the storage medium 650) that can direct a computer processor or other programmable processing apparatus to function in a particular manner, such that the instructions 652 stored in the computer-readable memory or memory devices produce an article of manufacture including instruction means which implement the function specified in the block(s) of the flowchart(s).

[0102] It will further be appreciated that the term “computer program instructions” as used herein refer to one or more instructions that can be executed by the one or more processors (for example, the processor 304 or the processor 630) to perform one or more functions as described herein. The instructions 652 may also be stored remotely such as on a server, or all or a portion of the instructions can be stored locally and remotely.

[0103] Now, referring to the technical abilities and advantageous effect of the present disclosure, operational advantages that may be provided by one or more embodiments may include providing the system and the method that enables automatic detection of the ping-pong behavior of the user devices by performing analysis of network data logs, thereby eliminating the need for manual inspection of large volumes of heterogeneous core-network and the RAN logs. This significantly reduces operational effort and improves detection accuracy and scalability.

[0104] By integrating and correlating core-network signaling logs with the RAN logs, the invention provides a comprehensive view of user mobility behavior. This correlation allows the inter-RAT transitions to be analyzed together with radio conditions, sector information, and location data. The present disclosure determines the ping-pong behavior based on both the frequency of the inter-RAT transitions and the associated time intervals, enabling the system to distinguish abnormal ping-pong1behavior from normal mobility-related handovers. This time-aware analysis reduces false positives and improves the reliability of detection.

[0105] Further, the present disclosure supports sector-level analytics by identifying the RAN sectors exhibiting a high percentage of the ping-pong handovers. This allows the network operators to pinpoint problematic sectors and perform targeted optimization of handover parameters, neighbor configurations, and coverage planning. The present disclosure generates structured output lists of affected user devices and the sectors together with relevant metadata such as radio-frequency parameters and location information. These outputs facilitate faster troubleshooting, data-driven network optimization, improved user experience, and reduced signaling overhead in the network.

[0106] Those skilled in the art will appreciate that the methodology described herein in the present disclosure may be carried out in other specific ways than those set forth herein in the above disclosed embodiments without departing from essential characteristics and features of the present invention. The above-described embodiments are therefore to be construed in all aspects as illustrative and not restrictive.

[0107] The drawings and the forgoing description give examples of embodiments. Those skilled in the art will appreciate that one or more of the described elements may well be combined into a single functional element. Alternatively, certain elements may be split into multiple functional elements. Elements from one embodiment may be added to another embodiment. For example, orders of processes described herein may be changed and are not limited to the manner described herein. Any combination of the above features and functionalities may be used in accordance with one or more embodiments.

[0108] In the present disclosure, each of the embodiments has been described with reference to numerous specific details which may vary from embodiment to embodiment. The foregoing description of the specific embodiments disclosed herein may reveal the general nature of the embodiments herein that others may, byapplying current knowledge, readily modify and / or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications are intended to be comprehended within the meaning of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and is not limited in scope.LIST OF REFERENCE NUMERALS

[0109] The following list is provided for convenience and in support of the drawing figures and as part of the text of the specification, which describe innovations by reference to multiple items. Items not listed here may nonetheless be part of a given embodiment. For better legibility of the text, a given reference number is recited near some, but not all, recitations of the referenced item in the text. The same reference number may be used with reference to different examples or different instances of a given item. The list of reference numerals is:100- Communication environment102- 5G network104- 4G network106- 4G eNB108- 5G gNB110-User Device200- System architecture / System202- Trace collection Entity (TCE)204- User analytics / report server (server / system)206- MME / AMF300-2- Communication bus300-4- Second Communication bus302-Processor304- Memory306- Communication interface308- Input-Output (I / O) interface310- Communication Modules320- Receiving module330- Data Processing module340- Identification module350-Determination module360- Comparison module370-Detection module380-Generation module400- Method for detecting the ping-pong behavior402-414- Steps for performing the method 400500- Method for generating list of sectors exhibiting the ping-pong behavior 502-510- Steps for performing the method 500600- Computing system620- Network Interface630- Processor640- I / O Interface650- Non-transitory computer readable storage medium652- Instructions

Claims

We Claim:

1. A method (400) for detecting ping-pong behavior of one or more user devices in a communication network, the method comprising:receiving, periodically at predefined time intervals by a receiving module (320), a first set of data logs associated with the one or more user devices from a core network, and a second set of data logs associated with the one or more user devices from one or more Radio Access network (RAN) nodes serving the one or more user devices;performing, by a data processing module (330), a plurality of preprocessing operations on each of the received first set of data logs and the second set of data logs to generate a set of preprocessed data logs;identifying, by an identification module (340), based on the generated set of the preprocessed data logs, inter-Radio Access Technology (RAT) transitions for each user device among the one or more user devices;determining, by a determination module (350), for each user device among the one or more user devices, time intervals at which the inter-RAT transitions are identified and a frequency of the identified inter-RAT transitions within the determined time intervals;comparing, by a comparison module (360), for each user device among the one or more user devices, the determined frequency of the identified inter-RAT transitions of the one or more user devices with a predefined threshold frequency;detecting, by a detection module (370), a set of user devices among the one or more user devices exhibiting the ping-pong behavior based on a result of the comparison that the determined frequency of the identified inter-RAT transitions of the set of user devices among the one or more user devices exceeds the predefined threshold frequency; andgenerating, by a generation module (380), a list of the set of user devices exhibiting the ping-pong behavior.

2. The method as claimed in claim 1, further comprising detecting a set of sectors among the one or more sectors, associated with the set of user devices, exhibiting the ping-pong behavior by:identifying, by the identification module (340), from the second set of data logs, sector identifier information associated with each user device among the set of user devices;calculating, by the determination module (350), a percentage of ping-pong handovers for each sector among the one or more sectors based on the sector identifier information and corresponding inter- RAT transitions for each user device among the set of user devices;comparing, by the comparison module (360), the calculated percentage of the ping-pong handovers for each sector among the one or more sectors with a predefined threshold percentage; anddetecting, by the detection module (370), the set of sectors among the one or more sectors exhibiting the ping-pong behavior based on a result of the comparison that the calculated percentage of the ping-pong handovers of the set of sectors among the one or more sectors exceeds the predefined threshold percentage.

3. The method as claimed in claim 2, further comprising generating, by the generation module, a list of the set of sectors with corresponding sector identifiers among the one or more sectors exhibiting the ping-pong behavior.

4. The method as claimed in claim 1, wherein the first set of data logs comprises one or more signaling events including at least one of a Tracking Area Update (TAU) event, a Routing Area Update (RAU) event, an attachment of the one or more user devices to the core network, and a detachment of the one or more user devices from the core network.

5. The method as claimed in claim 1, wherein the second set of data logs comprises signal strength information, signal quality parameters, and location data corresponding to the one or more user devices and the one or more sectors.

6. The method as claimed in claim 1, wherein the plurality of preprocessing operations comprises:standardizing, by the data processing module (330), timestamps associated with each of the first set of data logs and the second set of data logs;sorting, by the data processing module (330), each of the first set of data logs and the second set of data logs based on identifier information corresponding to the one or more user devices, sector identifier information associated with each user device, and a type of one or more signaling events included in the first set of data logs; andcombining, by the data processing module (330) upon the sorting, each of the first set of data logs and the second set of data logs, wherein the combining comprises associating each of the first set of data logs with last recorded second set of data logs in connected mode.

7. The method as claimed in claim 1, wherein the list of the set of user devices exhibiting the ping-pong behavior further comprises, for each user device, metadata extracted from the generated set of the preprocessed data logs, the metadata including the frequency of the identified inter-RAT transitions, corresponding inter-RAT time-interval values, signal strength information, signal quality parameters, and location data derived from the second set of data logs.

8. A system (200) for detecting ping-pong behavior of one or more user devices in a communication network, the system comprising:a receiving module (320) configured to receive, periodically at predefined time intervals, a first set of data logs associated with the one or more user devices from a core network, and a second set of data logs associated with the one or more user devices from one or more Radio Access network (RAN) nodes serving the one or more user devices; anda data processing module (330) configured to perform a plurality of preprocessing operations on each of the received first set of data logs and the second set of data logs to generate a set of preprocessed data logs;an identification module (340) configured to identify, based on the generated set of the preprocessed data logs, inter-Radio Access Technology (RAT) transitions for each user device among the one or more user devices;a determination module (350) configured to determine, for each user device among the one or more user devices, time intervals at which the inter-RAT transitions are identified and a frequency of the identified inter-RAT transitions within the determined time intervals;a comparison module (360) configured to compare, for each user device among the one or more user devices, the determined frequency of the identified inter-RAT transitions of the one or more user devices with a predefined threshold frequency;a detection module (370) configured to detect a set of user devices among the one or more user devices exhibiting the ping-pong behavior based on a result of the comparison that the determined frequency of the identified inter-RAT transitions of the set of user devices among the one or more user devices exceeds the predefined threshold frequency; anda generation module (380) configured to generate a list of the set of user devices among the one or more user devices exhibiting the ping-pong behavior.

9. The system as claimed in claim 8, wherein, to detect a set of sectors among the one or more sectors, associated with the set of user devices, exhibiting the ping-pong behavior:the identification module (340) is configured to identify, from the second set of data logs, sector identifier information associated with each user device among the set of user devices;the determination module (350) is configured to calculate a percentage of ping-pong handovers for each sector among the one or more sectors based on the sector identifier information and corresponding inter- RAT transitions for each user device among the set of user devices;the comparison module (360) is configured to compare the calculated percentage of the ping-pong handovers for each sector among the one or more sectors with a predefined threshold percentage; andthe detection module (370) is configured to detect the set of sectors among the one or more sectors exhibiting the ping-pong behavior based on a result of the comparison that the calculated percentage of the ping-pong handovers of the set of sectors among the one or more sectors exceeds the predefined threshold percentage.

10. The system as claimed in claim 9, wherein the generation module (380) is further configured to generate a list of the set of sectors with corresponding sector identifiers among the one or more sectors exhibiting the ping-pong behavior.

11. The system as claimed in claim 8, wherein the first set of data logs comprises one or more signaling events including at least one of a Tracking Area Update (TAU) event, a Routing Area Update (RAU) event, an attachment of the one or more user devices to the core network, and a detachment of the one or more user devices from the core network.

12. The system as claimed in claim 8, wherein the second set of data logs comprises signal strength information, signal quality parameters, and location data corresponding to the one or more user devices and the one or more sectors.

13. The system as claimed in claim 8, wherein, to perform the plurality of preprocessing operations, the data processing module (330) is configured to:standardize timestamps associated with each of the first set of data logs and the second set of data logs;sort each of the first set of data logs and the second set of data logs based on identifier information corresponding to the one or more user devices, sector identifier information associated with each user device, and a type of one or more signaling events included in the first set of data logs; andcombine, upon the sorting, each of the first set of data logs and the second set of data logs, wherein the combining comprises associating each of the first set of data logs with last recorded second set of data logs in connected mode.

14. The system as claimed in claim 8, wherein the list of the set of user devices exhibiting the ping-pong behavior further comprises, for each user device, metadata extracted from the generated set of the preprocessed data logs, the metadata including the frequency of the identified inter-RAT transitions, corresponding inter-RAT time-interval values, signal strength information, signal quality parameters, and location data derived from the second set of data logs.

15. A computer program product comprising computer-executable instructions that are stored on a non-transitory computer-readable medium and that, when executed by at least one processor performs operations comprising:receiving, periodically at predefined time intervals, a first set of data logs associated with one or more user devices from a core network, and a second set of data logs associated with the one or more user devices from one or more Radio Access network (RAN) nodes serving the one or more user devices;performing a plurality of preprocessing operations on each of the received first set of data logs and the second set of data logs to generate a set of preprocessed data logs;identifying, based on the generated set of the preprocessed data logs, interRadio Access Technology (RAT) transitions for each user device among the one or more user devices;determining for each user device among the one or more user devices, time intervals at which the inter-RAT transitions are identified and a frequency of the identified inter-RAT transitions within the determined time intervals;comparing for each user device among the one or more user devices, the determined frequency of the identified inter-RAT transitions of the one or more user devices with a predefined threshold frequency;detecting a set of user devices among the one or more user devices exhibiting the ping-pong behavior based on a result of the comparison that the determinedfrequency of the identified inter-RAT transitions of the set of user devices among the one or more user devices exceeds the predefined threshold frequency; and generating a list of the set of user devices exhibiting the ping-pong behavior.

Images