Anomaly Detection in Telecom Data Flows Using Confidence Intervals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods in telecommunication networks face challenges in accurately distinguishing between normal behavior and anomalies due to the dynamic nature of metrics and the uniqueness of each system, often resulting in a high rate of false positives.
Innovation Solution
A method that employs multiple models such as µ-rule, Seasonal Trend using Loess filtering, ARIMA, TBATS, and NNAR to capture different aspects of data behavior, combined with residual analysis and confidence interval estimation using GARCH models to reduce false positives by dynamically adapting to changing conditions and filtering extreme deviations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If threshold-based mechanisms are used for anomaly detection, then the detection process is simple, but the accuracy is poor due to high false positive rates
Solution Approach 1:
The patent transforms static threshold parameters into dynamic confidence intervals that adapt to changing system behavior. By using statistical models (ARIMA, exponential smoothing) to continuously update expected values and variability, the detection mechanism adjusts its parameters based on observed data patterns, thereby improving accuracy while maintaining computational feasibility.
Solution Approach 2:
The patent introduces dynamic adaptation by modeling the time-series nature of monitoring data. Instead of fixed thresholds, the system continuously learns the normal behavior patterns and their variations over time, allowing the detection boundaries to move and expand/contract based on actual system conditions, thus reducing false positives caused by static thresholds.
2Ease of manufacture
If static thresholds are used for anomaly detection, then the implementation is straightforward, but the system cannot adapt to evolving normal behavior
Solution Approach 1:
The patent enables the system to automatically learn and adapt to its own behavior patterns without requiring manual threshold configuration. The statistical models continuously analyze the monitoring data, automatically updating the expected values and confidence intervals, making the system self-adjusting to normal behavior evolution while eliminating the need for expert intervention.
Solution Approach 2:
The patent performs preliminary modeling of normal behavior patterns before anomaly detection begins. By pre-establishing statistical models that capture the inherent variability and patterns of normal operations, the system prepares adaptive detection boundaries in advance, allowing it to respond appropriately to genuine anomalies while ignoring normal variations.
3Measurement precision
If deep understanding of system behavior is required to set thresholds, then the detection can be accurate, but the complexity and expertise requirement increases
Solution Approach 1:
The patent replaces the manual, expert-driven threshold setting process with automated statistical modeling. Instead of relying on human expertise to understand and configure detection parameters, the system uses mathematical models (ARIMA, exponential smoothing) to automatically learn system behavior patterns and generate detection boundaries, thereby achieving high accuracy without requiring deep system knowledge from operators.
Data Source
Figure 1~2
Figure 3~4
Figure 5a~5c
AI summary
Apparatus (60) for monitoring a service (11) deployed over a telecommunication network (20, 30), comprising: - interfaces (61) configured to receive flows of data corresponding to metrics corresponding to said service, and inserting them into an input queue (62); - a streaming anomaly detector (63) configured to retrieved said flows of data from the input queue and to determine residuals of the application of said flows of data on at least two models (68) previously trained on historical data, and configured to define confidence intervals for said residuals; and, - output interfaces (66) configured to transmit anomalies based on said residuals and said confidence intervals, to an external application (67).