Core Network KPI Anomaly Detection With Root Cause Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Threshold-based anomaly detection in telecommunications networks fails to identify disturbances that do not meet the threshold but affect network performance, and does not detect the root cause of performance deviations, making it difficult to improve network reliability.
Innovation Solution
A method using time series analysis and artificially intelligent clustering to identify deviations in Key Performance Indicators (KPIs), grouping them into clusters with associated root causes, enabling detailed analysis of anomalous events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If threshold-based alerts are used for anomaly detection, then simple implementation is achieved, but disturbances below threshold that affect network performance are not detected
Solution Approach 1:
The patent changes the detection parameter from fixed threshold values to dynamic predicted values generated by time series analysis algorithms. This allows the system to detect deviations that are statistically significant even when they don't exceed fixed thresholds, thereby improving detection accuracy while maintaining implementation simplicity through automated algorithmic predictions.
Solution Approach 2:
The patent replaces the mechanical threshold-based alerting system with an intelligent system using time series analysis and clustering algorithms. This substitution enables the system to automatically learn normal performance patterns and detect anomalies based on deviations from these patterns, rather than relying on static thresholds that require manual configuration and adjustment.
2Ease of manufacture
If threshold alerts are used, then implementation is simple, but root cause analysis of performance deviations cannot be determined
Solution Approach 1:
The patent merges multiple KPI deviations that occur together into unified anomaly clusters. By grouping related deviations that happen simultaneously or in sequence, the system preserves information about the interconnected nature of performance issues, enabling root cause analysis by identifying which deviations are part of the same underlying event rather than treating them as isolated incidents.
Solution Approach 2:
The patent introduces clustering algorithms as an intermediary between raw KPI data and root cause analysis. These algorithms process individual KPI deviations and organize them into meaningful clusters that represent coherent events, serving as a bridge that transforms scattered performance data into structured information suitable for root cause determination.
3Ease of operation
If threshold alerts are used, then detection is straightforward, but slow term degradation of KPI is not detected
Solution Approach 1:
The patent performs preliminary action by training time series analysis algorithms on historical KPI data to establish baseline performance patterns before actual anomaly detection begins. This pre-training phase enables the system to recognize normal variations and trends, allowing it to detect slow term degradations as deviations from the learned baseline rather than requiring them to reach fixed threshold levels.
Solution Approach 2:
The patent implements feedback by continuously comparing actual KPI values against predicted values from the time series models. This ongoing feedback mechanism allows the system to adapt to changing network conditions and detect gradual performance degradation as cumulative deviations from the predicted trajectory, improving reliability without complicating the detection process.
4Device complexity
If threshold alerts are used, then simple monitoring is achieved, but deviations on nodes affected by other nodes are not detected
Solution Approach 1:
The patent merges KPI deviations from multiple nodes into unified anomaly clusters when they occur together. By combining data across nodes and identifying correlated deviations, the system recovers information about propagated anomalies that would be invisible when monitoring nodes in isolation, while keeping the monitoring approach relatively simple through automated clustering rather than complex inter-node correlation analysis.
Data Source
AI summary
The computer implemented methods, systems, and program instructions detect anomalies in a core network of a telecommunications network. The method comprises: receiving data representative of streams of time series data of a plurality of Key Performance Indicators (KPIs) of the performance of nodes of the core network; comparing the received time series data for each of the KPIs to predicted time series values for each KPI generated by one or more time series analysis algorithms trained with historical data for each KPI to predict the KPI over time; determining any KPIs having deviations between the received time series data and the predicted time series data during a specific time period, wherein each deviation is an anomaly; grouping the streams of time series data for each KPI determined to be deviated to generate anomaly data; using an artificially intelligent clustering algorithm to generate a plurality of clusters, wherein each cluster comprises a subset of the KPIs determined to be deviated that have been assigned to said cluster by the artificially intelligent clustering algorithm; wherein each of the clusters is identified as having an associated root cause.