Anomaly Detection System with Root Cause Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection systems in radio access networks face challenges in identifying true anomalous events while avoiding false positives and negatives, especially in environments with large data sets and significant noise, and struggle to determine the root cause of anomalies in key performance indicators (KPI) parameters.
Innovation Solution
A system and method for anomaly detection with root cause identification, which involves selecting historical statistical parameters based on randomness, using anomaly detection models like isolation forest, and filtering out false positives by identifying desirable behavior in KPI parameters, and determining root cause KPI parameters using SHAP values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection systems monitor a large number of parameters in radio access networks, then the ability to identify true anomalous events improves, but the number of false positives and computational complexity increases
Solution Approach 1:
The system segments the anomaly detection process into multiple specialized modules: isolation forest algorithm for initial anomaly identification, SHAP value computation for root cause analysis, and hierarchical parameter grouping. This segmentation allows each module to focus on specific aspects of the problem, improving overall detection accuracy while managing computational complexity through divided responsibility.
Solution Approach 2:
The patent introduces intermediary components such as the isolation forest algorithm that acts as a mediator between raw parameter data and final anomaly identification. This intermediary layer processes and filters data before passing it to subsequent analysis stages, reducing the burden on downstream components and lowering overall system complexity.
2Reliability
If anomaly detection systems use multiple parameters for monitoring, then the reliability of anomaly identification improves, but the difficulty of determining root cause increases
Solution Approach 1:
The system transforms multiple monitoring parameters into a unified anomaly score through the isolation forest algorithm, changing the parameter representation from numerous individual metrics to a single composite anomaly indicator. This parameter transformation simplifies root cause analysis by providing a clear anomaly signal that can be traced back to specific parameter deviations using SHAP values.
Solution Approach 2:
The patent replaces manual or rule-based root cause analysis with automated machine learning models (isolation forest and SHAP computation). This substitution of mechanical analysis methods with computational algorithms reduces the difficulty of determining root causes by automatically processing multiple parameters and identifying their relative contributions to anomalies.
3Quantity of substance
If anomaly detection systems process large data sets with significant noise, then the comprehensiveness of monitoring improves, but the ability to distinguish true anomalies from false positives deteriorates
Solution Approach 1:
The isolation forest algorithm performs partial action by focusing computational resources on identifying the most significant anomalies rather than processing every data point with equal depth. The algorithm builds multiple isolation trees that progressively filter data, applying excessive action in early stages to reduce the data set size, then refining analysis on the reduced set to minimize false positives.
Solution Approach 2:
The system implements feedback through SHAP value computation that provides information about the contribution of each parameter to anomaly scores. This feedback mechanism allows the system to adjust its analysis focus, identifying which parameters are driving false positives and refining the detection criteria accordingly, thereby improving the distinction between true anomalies and false positives.
Data Source
AI summary
A computer device may include a processor configured to obtain key performance indicator (KPI) values for KPI parameters associated with at least one device and compute a set of historical statistical values for the obtained KPI values associated with the network device. The processor may be further configured to provide the KPI values and the computed set of historical statistical values to an anomaly detection model to identify potential anomalies; filter the identified potential anomalies based on a designated desirable behavior for a particular KPI parameter to identify at least one anomaly; and send an alert that includes information identifying the at least one anomaly to a management system or a repair system associated with the device. The computer device may further determine a root cause KPI parameter for the identified at least one anomaly and include information identifying the determined root cause KPI parameter in the alert.