Adaptive Network Anomaly Detection Using Residue Frequency Bands
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless network management systems lack real-time detection and prediction of anomalous behaviors, such as abnormal key quality indicators (KQI) and key performance indicators (KPI), which are affected by time-varying factors like traffic load and RF conditions, leading to inefficiencies in network management.
Innovation Solution
The implementation of adaptive filtering methods, specifically using Kalman filtering and morphological filtering processes, to predict future network quality indicator values, calculate residues, and detect anomalies by analyzing these residues over selected frequency bands, enabling early detection of threshold exceedances and contour completion for anomaly event identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If real-time anomaly detection is implemented using adaptive filtering and frequency band analysis, then detection accuracy and prediction capability are improved, but computational complexity and processing requirements increase
Solution Approach 1:
The network quality indicator signal is segmented into multiple frequency bands using band-pass filters. This segmentation allows the system to analyze different frequency components separately, improving anomaly detection accuracy by capturing localized frequency-specific anomalies while reducing computational complexity by processing each band independently rather than analyzing the entire spectrum at once.
Solution Approach 2:
The system applies partial action by selectively monitoring only specific frequency bands that are most relevant to anomaly detection, rather than processing all frequency components equally. The morphological filtering process also applies partial action by focusing computational resources on completing contours only where anomaly thresholds are exceeded, rather than processing the entire signal uniformly.
2Reliability
If adaptive filtering is applied to predict future network quality indicator values, then prediction capability is improved, but processing time and computational load increase
Solution Approach 1:
The system performs preliminary action by continuously updating the adaptive filter coefficients using the Kalman filter algorithm based on incoming measurements. This preliminary adaptation allows the predictor to be pre-configured with optimal coefficients that reflect current network conditions, enabling faster and more accurate predictions without requiring extensive real-time computation when anomalies occur.
Solution Approach 2:
The Kalman filter implements feedback by continuously comparing predicted values with actual measurements and using the residue (difference) to update filter coefficients. This feedback mechanism allows the system to adapt to changing network conditions dynamically, improving prediction reliability while maintaining efficient processing through iterative refinement rather than exhaustive recalculation.
3Measurement precision
If multiple frequency bands are analyzed for anomaly detection, then detection coverage and accuracy are improved, but computational resources and processing overhead increase
Solution Approach 1:
The signal is segmented into multiple frequency bands using bank of band-pass filters, allowing parallel processing of different frequency components. This segmentation improves detection coverage by capturing anomalies across different frequency ranges while managing computational resources through independent parallel processing of each band rather than sequential analysis.
Solution Approach 2:
The system extracts only the relevant frequency components that contain anomaly information by analyzing residues in each frequency band separately. The morphological filtering process extracts anomaly contours only from bands where thresholds are exceeded, taking out the essential anomaly information while discarding redundant data from normal frequency bands, thus reducing overall computational resource requirements.
4Measurement precision
If morphological filtering is used to complete anomaly contours, then anomaly event identification accuracy is improved, but processing complexity increases
Solution Approach 1:
The morphological filtering process performs preliminary action by preparing the residue signal through opening and closing operations before final contour completion. This preliminary processing simplifies the signal structure by removing noise and filling gaps, making the subsequent contour completion step more efficient and accurate while reducing the overall processing complexity compared to direct contour detection on raw residue signals.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes performing, via a controller, adaptive filtering on a network quality indicator to predict future values of the network quality indicator, calculating, via the controller, residues between the predicted future values and measured values of the network quality indicator, analyzing, via the controller, the residues over at least one selected frequency band to determine if a threshold has been exceeded for the at least one selected frequency band, and detecting, via the controller, an anomaly event of the network in a frequency band in which a threshold has been exceeded using the residues and measured values of the network quality indicator.