WO2022079724A1

WO2022079724A1 - First node, and method performed thereby, for handling one or more categories of data

Info

Publication number: WO2022079724A1
Application number: PCT/IN2020/050880
Authority: WO
Inventors: Joy Bose; Sai Hareesh Anamandra; Rahul Sharma
Original assignee: Telefonaktiebolaget Lm Ericsson (Publ)
Priority date: 2020-10-14
Filing date: 2020-10-14
Publication date: 2022-04-21

Abstract

A method performed by a first node (111) for handling one or more categories of data in a communications network (10). A first node (111) determines (204), in a set of data from second nodes (112) and categorized into first categories, an existence of second categories. The set comprises subsets of data collected: a) during a first plurality of time periods and b) under a second plurality of conditions, and first labels indicating the one or more first categories. The determining (204) comprises iteratively: i) obtaining a subset of the data; and ii) analyzing the set of data, using machine learning and based on the plurality time periods, the plurality of conditions and the one or more first categories, to determine the existence of the second categories. The first node (111) also provides a first indication to a third node (113) based on the determined second categories.

Description

FIRST NODE, AND METHOD PERFORMED THEREBY, FOR HANDLING ONE OR MORE CATEGORIES OF DATA

TECHNICAL FIELD

The present disclosure relates generally to a node and methods performed thereby for handling one or more categories of data. The present disclosure further relates generally to a computer program product, comprising instructions to carry out the actions described herein, as performed by the node. The computer program product may be stored on a computer- readable storage medium.

BACKGROUND

Computer systems in a communications network may comprise one or more nodes, which may also be referred to simply as nodes. A node may comprise one or more processors which, together with computer program code may perform different functions and actions, a memory, a receiving and a sending port. A node may be, for example, a server.

Computer systems may be comprised in telecommunications network. In the course of operations of a telecommunications network, data may be collected on the performance of the telecommunications network, which may enable to monitor and manage the malfunctioning of any of its elements. For example, alarm systems may be configured that may monitor the data collected, and raise alarms if patterns are recognized in the data that indicate a deviation from normal operation. Multiple alarms may be configured to detect different faulty operations.

The advent of for example, the Internet of Things (loT) has exponentially increased the amount of data to be monitored over extensive number of alarms. "Things," in the loT sense, may refer to a wide variety of devices, e.g., physical devices, vehicles, which may also referred to as "connected devices" and "smart devices", buildings and other items — embedded with electronics, software, sensors, actuators, and network connectivity that may collect and exchange data. Devices may be such as heart monitoring implants, biochip transponders on farm animals, electric clams in coastal waters, automobiles with built-in sensors, DNA analysis devices for environmental/food/pathogen monitoring, or field operation devices that may assist firefighters in search and rescue operations, home automation devices such as for the control and automation of lighting via e.g., cameras, light monitors, heating, e.g. a “smart” thermostat, ventilation, air conditioning, and appliances such as washers, dryers, ovens, refrigerators or freezers that may use telecommunications for remote monitoring. These devices may collect data with the help of various existing technologies and then autonomously flow the data between other devices. The availability of large amounts of data, such as those collected for example, from loT devices, may be understood to enable the possibility of analysing such data to make predictions on events, with a high predictive power. To make predictions on events may be understood to refer to building mathematical models that may fit those data, which mathematical models may then be used to make predictions for such events, e.g., what radio transmitter is about to fail, which sensors may be obstructed, etc...

Within this context, machine learning models may be used to analyze the data collected, and enable an improved management of the operation of the telecommunications network. Analyzing the data may involve categorizing the data, e.g., from one or more telecom providers into two or more categories. A category may be understood as a pattern in the data indicating similarity in some dimension or dimensions, or similarity of some features or aspects of the data, and which may be indicative of a particular condition, in this case, in an operational aspect of a communications network.

Currently, some rule-based algorithms are used for the categorization of the data, along with a manual process. For example, in a sensor system, a rule may be set to produce an alert every time a certain combination of parameters in the data collected by the sensors has values within set ranges for each parameter. However, as it may be understood from systems such as e.g., loT systems, these rule-based approaches are not scalable. A new stored procedure will have to be written every time the rules change or whenever a new category of data comes up. This may happen as the rules to generate the data are re-configured over time. In some instances there may be a manual process to examine the data and find relationships to make new rules. A team of Subject Matter Experts (SMEs) may need to manually look at the telecom data, identify this this is indeed not covered by any of the old categories and manually craft rules for this new category of alarm. Steps such as feature engineering, finding relationships, defining workflows between the entities etc is time consuming. When a new category is created and the task that the SMEs may need to perform to write rules for a new category, or to split an existing category, is challenging. Furthermore, the manual process the SMEs may need to perform is very time consuming and demands a lot of effort. For example, in case of a system to classify telecommunication alarms, a new category may refer to a new category of alarm based on new inputs coming in from the sensors, such as power is less, temperature is outside the allowed range, telecommunication signal strength is below a threshold, the number of connections is too high etc. Initially the system may be configured with a few known categories of alarms, but new input may not correspond to any of the known categories, but a completely new category. Moreover, rule based approaches cannot generalize well. To “generalize” may be understood to refer to accurately categorizing data even for new categories, which may not have been previously found. For example, existing models cannot deal with changing the background context, such as re-configuration of the system, with time, based on changing criteria, behind the data.

Furthermore, rules may be ambiguous in some situations. Some data may satisfy multiple rules, or some rules may contradict each other.

Additionally, in some cases, the data may be skewed. Some categories may have too much available data, whereas others may have too little. For some types of data, such as image classification data, it may be possible to tweak the data and generate new images by rotation etc or by using data augmentation techniques such as SMOTE. However, in the context of data in the telecommunications domain, such as data from sensors, data related to cellular networks etc... may have issues such as privacy concerns and it may be challenging to simulate real life conditions, unlike with other kinds of data. Often, the data available is limited. There may be also privacy concerns, such that data may not be exposed to the outside world, that is, exposed publicly, such as by e.g., uploading the data to a public server without proper encryption. Augmented data may be misclassified.

Current efforts exist to address some of the existing issues just described. In “Semi supervised class discovery”, available at https://arxiv.org/pdf/2002.03480.pdf, Nixon et al., deal with the creation of new classes, that is, new categories, that capture similarities in datapoints previously rejected as uncategorizable. An out of order distribution (OOD) embedding is proposed, and a clustering algorithm is used to cluster the OOD data embeddings for the previously uncategorizable data. In “Unsupervised Deep Learning by Neighborhood Discovery”, available at https://arxiv.org/pdf/1904.11567.pdf, Huang et. al. formulate an anchor neighborhood discovery method. This may be understood to be a special type of clustering, a neighborhood discovery approach is used to form classes. A class consistent entropy measurement for neighborhood discovery and supervision in a progressive manner is presented, which analyses a spatial neighborhood configuration.

In spite of the advances, existing categorization methods may still result in a cumbersome and time consuming categorization process, which may fail to identify useful categories, or do it with long latency and poor accuracy, resulting in a poor operation of a communications network.

SUMMARY

It is an object of embodiments herein to improve the handling one or more categories of data in a communications network.

According to a first aspect of embodiments herein, the object is achieved by a method, performed by a first node. The method is for handling one or more categories of data. The first node operates in a communications network. The first node determines, in a set of data categorized into one or more first categories, an existence of one or more second categories. The set of data is derived from one or more second nodes operating in the communications network. The set of data comprises subsets of data collected during a first plurality of time periods and under a second plurality of conditions. The data further comprises one or more first labels indicating the one or more first categories. The determining comprises performing iteratively the following actions. First, determining comprises obtaining a subset of the data, a respective time period of the first plurality of time periods during which the subset of data was collected, a respective condition of the plurality of conditions under which the subset of data was collected, and a respective first label corresponding to a respective first category, of the one or more first categories, of the subset of data. Second determining comprises analyzing, using machine learning and based on the plurality time periods, the plurality of conditions and the one or more first categories, the set of data comprising the obtained subset of data, to determine the existence of the one or more second categories. The first node then provides a first indication to a third node operating in the communications network. The first indication is based on the determined one or more second categories.

According to a second aspect of embodiments herein, the object is achieved by the first node. The first node may be considered to be for handling the one or more categories of data. The first node is configured to operate in the communications network. The first node is further configured to determine, in the set of data configured to be categorized into the one or more first categories, the existence of the one or more second categories. The set of data is configured to be derived from the one or more second nodes configured to operate in the communications network. The set of data is configured to comprise subsets of data collected: during the first plurality of time periods and under the second plurality of conditions. The data is further configured to comprise the one or more first labels configured to indicate the one or more first categories. To determine is configured to comprise to perform iteratively the following actions. First, to determine is configured to comprise obtaining the subset of the data, the respective time period of the first plurality of time periods during which the subset of data was collected, the respective condition of the plurality of conditions under which the subset of data was collected, and the respective first label corresponding to the respective first category, of the one or more first categories, of the subset of data. Second, to determine is configured to comprise analyzing, using machine learning and based on the plurality time periods, the plurality of conditions and the one or more first categories, the set of data further configured to comprise the subset of data configured to be obtained, to determine the existence of the one or more second categories. The first node is also configured to provide the first indication to the third node configured to operate in the communications network. The first indication is configured to be based on the one or more second categories configured to be determined. According to a third aspect of embodiments herein, the object is achieved by a computer program, comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out the method performed by the first node.

According to a fourth aspect of embodiments herein, the object is achieved by a computer-readable storage medium, having stored thereon the computer program, comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out the method performed by the first node.

By the first node determining the existence of the one or more second categories, by iteratively obtaining subsets of data and analyzing the set of data based on the plurality time periods, the plurality of conditions and the one or more first categories, the first node may be enabled to automatically determine the existence of the one or more second categories, incorporating context and time series to get a better understanding of the data obtained and make a more accurate prediction of categories. This may be understood to enable the first node to automatically and dynamically recognize previously unknown categories of data, or recategorize categories of data, with higher accuracy, based on analyzing the change of data over time, and based on particular conditions given in the communications network. All this, while the conditions may continue to change over time, on an ongoing basis. Embodiments herein use self-learning and may be understood to be scalable, the first node may only need to be retrained and it may be understood to run seamlessly. This may be understood to save time and effort in not having to write new rules every time there may be a rule change or whenever there may be a new category. Furthermore, by the one or more second categories being more accurately determined, the determination is generalizable, since no changes in the configuration of the nodes may need to be performed in order to determine the new categories or recategorize the existing data with increased accuracy. Furthermore, embodiments herein may be understood to prominently reduce the validation time by human experts by leveraging active learning. By then providing the first indication to the third node, the first node enables the third node to perform an action in the communications network, based on the indicated existence of the one or more second categories. For example, the first node may detect a new alarm in data collected by a set of loT sensors in a building, and the third node may be enabled to initiate a reconfiguration of the set of loT sensors to handle the detected alarm, and rectify a potential malfunction in the communications network, even when there may have been a change in the configuration of the set of loT sensors, and the alarm was previously unknown.

By the data comprising the one or more first labels indicating the one or more first categories, the first node may be enabled to determine the existence of the one or more second categories faster and more accurately. BRIEF DESCRIPTION OF THE DRAWINGS

Examples of embodiments herein are described in more detail with reference to the accompanying drawings, according to the following description.

Figure 1 is a schematic diagram illustrating two non-limiting examples of a communications network, according to embodiments herein.

Figure 2 is a flowchart depicting a method in a first node, according to embodiments herein. Figure 3 is a schematic diagram depicting aspects of the method performed by the first node, according to embodiments herein.

Figure 4 is a schematic diagram depicting other aspects of the method performed by the first node, according to embodiments herein.

Figure 5 is a schematic diagram depicting yet other aspects of the method performed by the first node, according to embodiments herein.

Figure 6 is a schematic diagram depicting particular aspects of a non-limiting example of the method performed by the first node, according to embodiments herein.

Figure 7 is a schematic block diagram illustrating embodiments of a first node, according to embodiments herein.

DETAILED DESCRIPTION

As part of the development of embodiments herein, one or more problems with the existing technology will first be identified and discussed.

As stated earlier, current efforts exist to address some of the existing issues described in the Background section. Such methods provide solutions for performing categorization in data pools that are static in nature. One of the existing methods may be applicable for the case where the categories are fixed, yet some data is not able to be classified using supervised methods. Such an approach may only be described for spatial embeddings. Supervised methods may enable to detect similarities in data for which category labels may be available. That is, where the categories of the ground truth data may be already labelled, and the supervised algorithm may generalize this categorization for new data based on the similarities with the existing data. These supervised models can only work well in case the new data is drawn from the similar distribution, and share the same properties, as the existing data. If this condition is not met, the categorization of the new data by the supervised model may be incorrect. Another existing method may also analyze a spatial neighborhood configuration. Such a method may be able to detect the spatial relationships between the data, but not the temporal relationships, that is, the relationship between the data arriving at different times. Certain kind of data may be temporally related. That is, values of data at previous times may influence the values at the current time. Analyzing the spatial neighborhood configuration method cannot categorize the data correctly always, because such categorization needs to take the temporal aspect into consideration. Also, this method may not be able to detect previously unseen new categories or reconfigure existing categories.

Therefore not only are existing methods limited to the analysis of static categories, but the existing solutions may be solely concerned with creating new categories, and not with reconfiguring existing categories. In some cases the existing categories or classes, that may have been correct for older data, may not be valid any more with newer data. Some of the existing categories may have to be broken down, or others categories may need to be deleted completely because there may no longer be new data in those old categories. Existing methods are not be able to do this.

In the communications network, e.g., telecommunications, domain, however, data may be typically collected over time, into time series, and categories may change with time. Since, for example, the system configuration may change over time, original categories may change all the time, as new data comes in. That is, in the example of alarms for loT sensors, after a software upgrade, the old defined alarms may no longer work to recognize a faulty performance after the new software update. Alternatively, existing categories may need to be reconfigured. If an existing class or category of alarm cannot be reconfigured, it may be categorized incorrectly. That is, for example, it may be categorized as belonging to category X of alarm when in reality it should belong to category Y.

Additionally, in order to address unbalanced data, existing methods may generate synthetic data for the categories lacking data. In existing methods wherein synthetic data may be generated to balance data, there may be generated synthetic data that may not belong to the correct categories. In such cases, the synthetic data generation is not useful. This may be the case in telecommunications data, where it may be difficult to replicate the data with exact correct conditions.

Certain aspects of the present disclosure and their embodiments address one or more of the issues with the existing methods and provide solutions to the challenges just discussed. In general terms, embodiments herein may be understood to be drawn to introducing a new method to categorize data, which enables the categorization process to be dynamic and time based. That is, the method may be able to dynamically detect new categories or perform a recategorization of data, without the need of changing any configuration. Time based may be understood to refer to the fact that the nature of data may be changing with time, and this may be factored into the categorization, allowing to deal with the fact that previous categorizations may no longer be valid in current or future time periods. Particular embodiments herein may use dynamic temporal class, that is, category, embedding. Further particular embodiments herein may incorporate contextual information in the category analysis, such as reconfiguration of the system, with time, based on changing criteria, and the dynamic temporal class embedding may be derived from the context of the data.

More particularly, embodiments herein, may be understood to be drawn to an intelligent, Machine Learning (ML)-based, solution that may enable categorization of data related to a communications network, e.g., telecommunications in a dynamic fashion using self-learning. As new data comes in, embodiments herein may enable to learn new categories by retraining a model. In some aspects, embodiments herein may be understood to enable addition of new categories automatically as new data may be added. In other aspects, embodiments herein may be understood to enable to flag some of the data for re-categorization of existing categories.

In some further particular aspects, embodiments herein may be understood to be drawn to an intelligent, ML-based, solution that may enable categorization of data related to a communications network, e.g., telecommunications, regardless of whether the data may be skewed or not. In some aspects, embodiments herein may be understood to enable accurate prediction of a category of data, which a rules-based approach may have been unable to predict, even when the categories of data may be unbalanced in terms of available data for training. Particular embodiments herein may be understood to relate to an intelligent system for categorizing unbalanced data in telecommunication projects.

Several embodiments and examples are comprised herein. It should be noted that the embodiments and/or examples herein are not mutually exclusive. Components from one embodiment or example may be tacitly assumed to be present in another embodiment or example and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments and/or examples.

Figure 1 depicts two non-limiting examples, in panels “a” and “b”, respectively, of a communications network 10, in which embodiments herein may be implemented. In some example implementations, such as that depicted in the non-limiting example of Figure 1a), the communications network 10 may be a computer network. In other example implementations, such as that depicted in the non-limiting example of Figure 1b), the communications network 10 may be implemented in a telecommunications network 100, sometimes also referred to as a cellular radio system, cellular network or wireless communications system. In some examples, the telecommunications network 100 may comprise network nodes which may serve receiving nodes, such as wireless devices, with serving beams.

In some examples, the telecommunications network 100 may for example be a network such as 5G system, or Next Gen network or an Internet service provider (ISP)-oriented network. The telecommunications network 100 may also support other technologies, such as a Long-Term Evolution (LTE) network, e.g. LTE Frequency Division Duplex (FDD), LTE Time Division Duplex (TDD), LTE Half-Duplex Frequency Division Duplex (HD-FDD), LTE operating in an unlicensed band, Wideband Code Division Multiple Access (WCDMA), Universal Terrestrial Radio Access (UTRA) TDD, GSM/Enhanced Data Rate for GSM Evolution (EDGE) Radio Access Network (GERAN) network, Ultra-Mobile Broadband (UMB), EDGE network, network comprising of any combination of Radio Access Technologies (RATs) such as e.g. Multi-Standard Radio (MSR) base stations, multi-RAT base stations etc., any 3rd Generation Partnership Project (3GPP) cellular network, Wireless Local Area Network/s (WLAN) or WiFi network/s, Worldwide Interoperability for Microwave Access (WiMax), IEEE 802.15.4-based low-power short-range networks such as IPv6 over Low-Power Wireless Personal Area Networks (6LowPAN), Zigbee, Z-Wave , Bluetooth Low Energy (BLE), or any cellular network or system.

The communications network 10 comprises a plurality of nodes, whereof a first node

111 , one or more second nodes 112, a third node 113 and one or more fourth nodes 114 are depicted in Figure 1. The one or more second nodes 112 and the one or more fourth nodes 114 are respectively represented by a single node, to simplify the non-limiting example of Figure 4. The first node 111, the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may be understood, respectively, as a first computer system or server, one or more second computer systems or servers, a third computer system or server and one or more fourth computer systems or servers. Any of the first node 111 , the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may be implemented as a standalone server in e.g., a host computer in the cloud 110, as depicted in the non-limiting example of Figure 1 b) for the first node 111 , the one or more second nodes

112, and the third node 113. In other examples, any of the first node 111, the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may be a distributed node or distributed server, such as a virtual node in the cloud 110, and may perform some of its respective functions being locally, e.g., by a client manager, and some of its functions in the cloud 110, by e.g., a server manager. In other examples, any of the first node 111, the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may perform its functions entirely on the cloud 110, or partially, in collaboration or collocated with a radio network node. Yet in other examples, any of the first node 111 , the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may also be implemented as processing resource in a server farm. Any of the first node 111 , the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may be under the ownership or control of a service provider, or may be operated by the service provider or on behalf of the service provider.

Any of the first node 111 , the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may be a core network node, such as, e.g., a Serving General Packet Radio Service Support Node (SGSN), a Mobility Management Entity (MME), a positioning node, a coordinating node, a Self-Optimizing/Organizing Network (SON) node, a Minimization of Drive Test (MDT) node, etc.... In 5G, for example, any of the first node 111, the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may be located in the OSS (Operations Support Systems).

The first node 111 may be understood to have a capability to perform machine- implemented learning procedures, which may be also referred to as “machine learning”. The first node 111 may, for example, support running python/Java with Tensorflow or Pytorch, theano etc... The first node 111 may also have GPU capabilities.

Any of the one or more second nodes 112 and the third node 113 may be another core network node, as depicted in the non-limiting example of Figure 1a), a radio network node, such as the radio network node 150 described below, a user equipment, such as the communication device 130 described below, or a database in the communications network. The one or more second nodes 112 may be understood to have a capability to generate data or gather and/or store data generated by any of the components of the communications network 10, e.g., the radio network node 150 described below or the communication device 130 described below.

Any of one or more fourth nodes 114 may, in some examples, be radio network nodes such as the radio network 150 described below, as depicted in the non-limiting example of Figure 1 b), or devices such as the communication device 130.

In some examples of the communications network 10, which are not depicted in Figure 1, any of the first node 111 , the one or more second nodes 112, the third node 113 and the one or more fourth nodes 114 may be co-located, or be a same node.

The communications network 10 may comprise a plurality of communication devices, whereof a communication device 130 is depicted in the non-limiting example scenario of Figure 1 b). The communications network 10 may also comprise other communication devices. The communication device 130 may be a UE or a Customer Premises Equipment (CPE) which may be understood to be enabled to communicate data, with another entity, such as a server, a laptop, a Machine-to-Machine (M2M) device, device equipped with a wireless interface, or any other radio network unit capable of communicating over a wired or radio link in a communications system such as the communications network 10. The communication device 130 may be also e.g., a mobile terminal, wireless device, wireless terminal and/or mobile station, mobile telephone, cellular telephone, or laptop, just to mention some further examples. The communication device 130 may be, for example, portable, pocket-storable, hand-held, computer-comprised, a sensor, camera, or a vehicle-mounted mobile device, enabled to communicate voice and/or data, via a RAN, with another entity, such as a server, a laptop, a Personal Digital Assistant (PDA), or a tablet computer, sometimes referred to as a tablet with wireless capability, or simply tablet, a Machine-to-Machine (M2M) device, a device equipped with a wireless interface, such as a printer or a file storage device, modem, Laptop Embedded Equipped (LEE), Laptop Mounted Equipment (LME), USB dongles or any other radio network unit capable of communicating over a wired or radio link in the communications network 10. The communication device 130 may be enabled to communicate wirelessly in the communications network 10. The communication may be performed e.g., via a RAN and possibly one or more core networks, comprised within the communications network 10.

The communications network 10 may comprise a plurality of radio network nodes, whereof a radio network node 150, e.g., an access node, or radio network node, such as, for example, the radio network node, depicted in Figure 1b). The telecommunications network 100 may cover a geographical area, which in some embodiments may be divided into cell areas, wherein each cell area may be served by a radio network node, although, one radio network node may serve one or several cells. The radio network node 150 may be e.g., a gNodeB. That is, a transmission point such as a radio base station, for example an eNodeB, or a Home Node B, a Home eNode B or any other network node capable to serve a wireless device, such as the communications device 140 in the communications network 10. The radio network node 150 may be of different classes, such as, e.g., macro eNodeB, home eNodeB or pico base station, based on transmission power and thereby also cell size. In some examples, the radio network node may serve receiving nodes with serving beams. The radio network node 150 may support one or several communication technologies, and its name may depend on the technology and terminology used. The radio network node 150 may be directly connected to one or more core networks in the telecommunications network 100.

The first node 111 may be configured to communicate within the communications network 10 with any of the one or more second nodes 112 over a respective first link 161 , e.g., a radio link, an infrared link, or a wired link. The first node 111 may be configured to communicate within the communications network 10 with the third node 113 over a second link 162, e.g., a radio link, an infrared link, or a wired link. Any of the one or more second nodes 112 may be configured to communicate with any of the one or more fourth nodes 114 over a respective third link 163, e.g., a radio link, an infrared link, or a wired link. The third node 113 may be configured to communicate with any of the one or more fourth nodes 114 over a respective fourth link 164, e.g., a radio link, an infrared link, or a wired link. The radio network node 150 may be configured to communicate with the communication device 130 over a fifth link 165, e.g., a radio link, an infrared link, or a wired link.

Any of the respective first link 161, the second link 162, the respective third link 163, the respective fourth link 164 and the fifth link 165 may be a direct link or may be comprised of a plurality of individual links, wherein it may go via one or more computer systems or one or more core networks in the communications network 10, which are not depicted in Figure 1, or it may go via an optional intermediate network. The intermediate network may be one of, or a combination of more than one of, a public, private or hosted network; the intermediate network, if any, may be a backbone network or the Internet; in particular, the intermediate network may comprise two or more sub-networks, which is not shown in Figure 1.

In general, the usage of “first”, “second”, “third”, “fourth”, “fifth” etc. herein may be understood to be an arbitrary way to denote different elements or entities, and may be understood to not confer a cumulative or chronological character to the nouns they modify.

Some of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. Other embodiments, however, are contained within the scope of the subject matter disclosed herein, the disclosed subject matter should not be construed as limited to only the embodiments set forth herein; rather, these embodiments are provided by way of example to convey the scope of the subject matter to those skilled in the art.

Embodiments of a method, performed by the first node 111 , will now be described with reference to the flowchart depicted in Figure 2. The method is for handling one or more categories of data. The first node 111 operates in the communications network 10.

Several embodiments are comprised herein. In some embodiments all the actions may be performed. In some embodiments, some actions may be optional. In Figure 2, optional actions are indicated with dashed lines. It should be noted that the examples herein are not mutually exclusive. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description.

Action 201

During the course of operations in the communications network 10, data may be generated and/or gathered by the one or more second nodes 112. For example, the one or more second nodes 112 may be a set of loT sensors in a building collecting data about different variables, such as temperature, humidity, etc... In other examples, the one or more second nodes 112 may be core network nodes, gathering the data from other components of the communications network 10, for example a node in the cloud collecting and storing the data generated by the loT sensors in the building.

The data may then, in some examples, be processed or transformed by for example, the one or more second nodes 112 or by the first node 111 itself, to e.g., normalize the data, reduce noise, substitute bad data etc... . The data, whether in raw form, or processed, may then be further processed to categorize it into one or more first categories, to result in a set of data derived from the one or more second nodes 112, where derived may be understood to mean directly obtained, or processed based on data originally obtained from the one or more second nodes 112. As described earlier, a category or class may be understood as a pattern in the data which may indicate similarity between different data points, and which may be indicative of a particular condition, such as an operational aspect of the communications network 10. The one or more first categories may therefore be considered to be previously known categories.

The categorization may have taken place, for example, according to rule-based methods, performed by the first node 111 at an earlier stage, or by another node in the communications network 10. The set of data derived from the one or more second nodes 112 may be obtained by the first node 111 over a certain period of time during the course of operations of the communications network 10.

The set of data comprises subsets of data that may have been collected during a first plurality of time periods. That the set of data comprises subsets of data collected during the first plurality of time periods may be understood to mean that the subsets of data may record how the data may have changed over time, that is, the subsets of data may enable the first node 111 to perform a time series analysis. Specifically, the subsets of data may enable to determine how the data may have changed over time.

The set of data comprises subsets of data that may have been collected under a second plurality of conditions. Each of the conditions may correspond to context information. Context information may be understood as a multi-dimensional vector with multiple parameters representing variables, such as changed system configuration, e.g., as a state vector, and attention to the data. A state vector may be understood as a vector with multiple dimensions that may represent a state, or current condition or current configuration, of in this case, the communications network 10. The variables in this vector may be, for example, configuration of loT sensors at the current time, a memory representation of the configuration at previous times etc. Attention may be understood to refer to giving a higher weight to certain variables in the context vector and less weight to other variables. Each of conditions in the second plurality of conditions may, in some embodiments, correspond to a respective configuration of the one or more fourth nodes 114 comprised in the communications network 10.

In some embodiments, the set of data comprises subsets of data that may have been collected: a) during the first plurality of time periods, and b) under the second plurality of conditions. This may enable the first node 111 to identify the state vector of the one or more second nodes 112, and improve the categorization of the data at the current moment.

The data further comprises one or more first labels indicating the one or more first categories. A label may be understood to refer to the identified category of the data, or the name of the type of data recognized by, for example, the ML/ Al model that may have been used for the categorization. For example, if the data obtained is to be analysed to identify categories corresponding to different alarms, sensor data may need to be categorized into one of the fixed number of categories of alarm. A label in such a case may be the identity of the alarm, for example, “alarm number 56”.

In this Action 201 , the first node 111 may determine that the set of data is unbalanced over one or more categories of data. The one or more categories of data may be for example, one or more types of alarm indicating different conditions of the communications network 10 being out of the ordinary. That the data may be unbalanced may be understood to mean that the data may be skewed. That is, for some categories there may be a lot of data available, while for other categories there may be too little data. This may be understood to be a problem in order for the first node 111 to eventually analyze the data by training an ML/AI model since any resulting model may be biased and may be unable to accurately make a correct prediction of a category of data. That is, the first node 111 may not be able to correctly identify the category of data.

The determining in this Action 201 may be understood as calculating, deriving or detecting.

If data balancing were not to be performed, and some of the categories had more training data and other categories had less training data, any trained machine learning or Al model the first node 111 may try to determine as described later in Action 204, would be biased towards those categories where more data may have been available during training. By determining, in this Action 201 , that the set of data is unbalanced over the one or more categories of data, the first node 111 is then enabled to take action to address the imbalance in the next Action 202, and thereafter be enabled, when analyzing the data in Action 204, to increase the accuracy of predicting a correct category or class in the data, for example a correct type of alarm in the data collected from the loT sensors in the building. Action 202

In the embodiments wherein the first node 111 may have determined that the set of data is unbalanced over one or more categories of data, in this Action 202, the first node 111 may balance the set of data, refraining from generating simulated data.

By refraining from generating simulated data, the first node 111 may address the need to balance the data generating new data, which in the case of data in the communications network 10 may be problematic due to the fact that the data may be protected due to security concerns. The first node 111 may in this Action 201 balance the data circumventing the need to simulate synthetic data or generate data points of the unbalanced category, for example by performing focal loss (FL) method. The first node 111 may automatically balance the set of data by performing an FL method to balance the data algorithmically. One such method the first node 111 may use to balance the probability for the categories may be according to the following formulation:

H..( ) - - ■■■ M R) where FL is focal loss, p_t is an estimated probability for the given category and y is a smoothing parameter and.

By balancing the set of data, refraining from generating simulated data, the first node 111 may then be enabled to, when analyzing the data in Action 204, to increase the accuracy of predicting a correct category or class in the data.

Action 203

In this Action 203, the first node 111 may create one or more respective unique signatures for the derived data. The derived data may be as originally obtained by the first node 111 , or as balanced after Action 202.

A signature may be understood herein as a unique representation of data that may be understood to preserve the similarities between similar data points and that may typically be of a lower dimensionality than the data. That the signature is unique may be understood to mean that no two different data points may have the same signature, and that a given data point may only have a unique signature.

The first node 111 may create the one or more respective unique signatures by using word embeddings and similar methods. Embedding may be understood to refer to a way of encoding or representing the input data, which e.g., may have 30 or 40 variables, as a single vector, in such a way that the relationships between similar data may be preserved. If the input data are similar in some way, their embeddings vectors may be understood to also be similar. If the input data are far apart, their embeddings vectors may be understood to also have a higher distance between them. The first node 111 may use word embeddings to create a unique data signature for each data point, based on the probability of the co-occurrence of the data points in the set of data, or in the balanced set of data, if Action 202 is performed. This may be understood to mean that the first node 111 may determine, for a given known category, that is, one of the one or more first categories, how often the data points may occur together. The creating in this Action 203 comprise fitting an embeddings model onto groups of data in the set of data, or in the balanced set of data, if Action 202 is performed, wherein the input may be understood to be data points for a given category of the one or more first categories, and the output may be understood to be an embeddings vector. A GLOVE style model, such as that described in e.g., https://nlp.stanford.edu/projects/glove/, may be used for the embeddings.

By creating one or more respective unique signatures for the derived data in this Action 203, the first node 111 may then be enabled to use the created one or more respective unique signatures to find the distance between any two data points, such as between previously known and unknown categories when analyzing the data in Action 204, and therefore conclude if a particular data point may belong to previously known category, that is, one of the one or more first categories, or an unknown category. That is, the first node 111 may prepare the data for further processing in the next Action.

Action 204

In this Action 204, the first node 111 determines, in the set of data categorized into the one or more first categories, an existence of one or more second categories. The set of data is derived from the one or more second nodes 112 operating in the communications network 10. The set of data comprises the subsets of data collected: a) during the first plurality of time periods and b) under the second plurality of conditions. The data further comprises the one or more first labels indicating the one or more first categories. That is, the data may be categories into one or more previously known categories.

The determining in this Action 204 comprises performing iteratively the following actions. First, the first node 111 obtains a subset of the data, a respective time period of the first plurality of time periods during which the subset of data was collected, a respective condition of the plurality of conditions under which the subset of data was collected, and a respective first label corresponding to a respective first category, of the one or more first categories, of the subset of data. Then, the first node 111 analyzes, using machine learning, and based on the plurality time periods, the plurality of conditions and the one or more first categories, the set of data comprising the obtained subset of data, to determine the existence of the one or more second categories. In other words, the first node 111 may analyze the set of data as subsets of data are input, and tries to determine which categories may be found. The one or more second categories may comprise one or more of: one of the first one or more categories, a previously unknown category, and a change with respect to one of the one or more first categories.

The analyzing using machine learning may be implemented by performing Exploratory Data Analysis (EDA) on the data using supervised learning or other methods. That is, analyzing the data set may be performed using various statistical and machine learning techniques, to discover patterns in the data, to categorize the data into the one or more second categories, e.g., one or more known categories and new categories, etc

The first node 111 may determine the existence of the one or more second categories by generating a Machine Learning (ML) model of the set of data, training the ML model in current data, and using the trained ML model to predict new categories as new subsets of data arrive. As part of the determining in this Action 204, the first node 111 may convert an output variable into a categorical parameter representing the output category, and train a supervised ML model to predict the category if it gets similar input data in the future. For a supervised ML model, the output variable may always need to be a number representing the category or class label. However, the output variable may be in some other format such as a real value. A mapping from that value to the class number may in such cases need to be performed.

The one or more first categories may be described by a mathematical model, a first ML model. The first ML model may then be used to predict whether the incoming subsets of the data fit into the first ML model, and may therefore be predicted to belong to any of the one or more first categories, or whether the incoming sets of data do not fit, and therefore represent changed or new categories, e.g., a new pattern in the data recorded by the sensors signifying another alarm.

In some embodiments wherein the balancing in Action 201 may have been performed, the determining in this Action 204 of the existence of the one or more second categories may be performed on the balanced set of data. The determining in this Action 204 of the existence of the one or more second categories may comprise an algorithmic determination of the one or more second categories.

In embodiments wherein the one or more respective unique signatures may have been created in Action 203 for the derived data, the determining in this Action 204 of the existence of the one or more second categories may be performed based on the one or more respective unique signatures created for the derived data. The first node 111 may use the one or more respective unique signatures in clustering and other models to classify the data as being closest to one of the known categories, or if enough outliers are close to each other, then they may be considered to be candidates for a new category. As part of the analyzing, the first node 111 may obtain a list of the previously unknown category data, that is, data that cannot be categorized by the supervised model, and the first node 111 may then perform clustering. Clustering may be understood to enable to identify if the data falls into clusters based on distance between the data points. A cluster formed by previously unknown category data points may potentially represent a new category. There may be measures such as intra cluster and inter cluster distance, silhouette score etc to determine how much cohesive a cluster may be.

The first node 111 may identify, as part of the determining of this Action 204, which of the previously unknown categories of data may potentially be part of a new category, as well as changed existing categories, e.g., based on data for a given time window.

The analyzing may comprise any of the procedures described below under, time analysis, context analysis, attention, handling concept drift, classification, frequency of retraining the model, and validation. These methods may be run simultaneously, or in any order. Each of these procedures may be performed by a respective unit or module within the first node 111.

Time analysis

Time series analysis may be needed in the case where the prediction of the data category may depend on the past history of the data collected for the same node, of the one or more second nodes 112, or the same device or group of devices from which the data may have been collected. This may be helpful as a category of the telecommunication data may be better identified if the values of the input variables taken as a series in different previous times, that is, as a time series, 1 minute ago, 2 minutes ago etc, may be taken into consideration, rather than only a value at an exact moment. The determining in this Action 204 of the existence of the one or more second categories may use historical time series analysis to determine the existence of the one or more second categories with higher accuracy. Specifically, the subsets of data may enable to determine how the data may have changed over time so that one or more categories, e.g., the category of an loT sensor alarm, may be predicted.

The fact that the set of data comprises the subsets of data collected under the first plurality of time periods enables the first node 111 to use time series analysis to incorporate the past history of the one or more second nodes 112, to make a more accurate prediction of the one or more second categories.

In some particular examples, the first node 111 may query the one or more second nodes 112, to obtain the past history of all variables of interest, or entries, with category labels, for a given device, and then use time series analysis to predict or forecast the next values of the category for future time periods. For this, the first node 111 may be understood to perform an application of multi horizon forecasting. A time horizon may be understood to indicate a specific period of time, which may be a year, a season, a month, a week, a day, or even an hour. Multi-horizon, that is, period, forecasting may be understood to mean that forecasts may be generated for multiple time horizons ahead. This may enable to predict future categories, e.g., of an alarm, in future time periods. The first node 111 may rely on an architecture called Temporal Fusion Transformer (TFT), such as that described in https://arxiv.org/abs/1912.09363.

The category labels of the data may be used e.g., to identify the type of the alarm, in the alarms use case. The category labels may enable the first node 111 to identify the categories faster and more accurately instead of a human having to do it, or having fixed rules being run to identify the category.

Context analysis

The fact that the set of data comprises the subsets of data collected under the second plurality of conditions enables the first node 111 to use context and attention, to form a state vector for the data, based on history and other additional data, considering that system configuration, e.g., of the nodes having generated the raw data, and rules for generating the data may change with time, and determine the likelihood of the system, e.g., one of the one or more second nodes 112, as being in a specific state out of a defined set of states. Using a model such as a Hidden Markov Model (HMM), the context of the data may be incorporated into the analysis run by the first node 111, which may be helpful to increase the accuracy of the categorization. This may be understood to be because when taking the second plurality of conditions into consideration, one or more of the one or more second categories may be determined, by the data clustering differently, based on the conditions in which they were collected. Each of the data in the set of data may take a finite number of states, and the future next state may depend on a current state. This state space may be modeled by the first node 111 using a Markov process, such as for example the following:

Where P may be understood to be the probability that the state of the system X at time 1+1 is s, given that the state at time I is si, state at time 1-1 is sl-1 and so on, s may be understood to be a set of states called the state space.

In examples of embodiments herein, the first node 111 may add components to the state vector that may be specific to the system, e.g., one of the one or more second nodes 112 generating the raw data, which may change over time. Some examples of the added components may be some components related to the rule based stored procedures that may be used to categorize the data, some components that may encode some representation of the current state of the one or more second nodes 112, some components related to the history of the same user equipment identifier, etc. The first node 111 may then create at probability matrix (P), wherein p may be understood to correspond to the probability of transition from state i to state j. Each of the items in the matrix maybe a value between 0 and 1. On this basis, the first node 111 may create the matrix of probabilities as follows:

Attention

The first node 111 may use an attention mechanism to filter out the context data. By filtering out the context data, it may be ensured that the first node 111 may only work on the relevant data corresponding to the current state of the system and mask out irrelevant information in the process, such as historical data that may not be related for a current categorization. This may be achieved by the use of an attention mechanism to focus only on the important information. That is, in the machine learning or Al model, some of the factors in the input data corresponding to the context of the system, or state of the system, a function of the state variables or the factors of the telecommunications system that may influence the values of the input sensor data, may be given a higher weight with the purpose of focusing on only the relevant portion of data that may affect the final categorization, masking out the irrelevant information. The data in the set may comprise an encoded representation of the input as a set of key-value pairs, (K,V), wherein the key may be understood too to correspond to correspond the features of the encoded representation of the data used to extract the value and the value may be understood to refer to the set of categories of data. The previous categorization of the data entity, such as categorization of the alarm, may be represented as a query Q. The query Q may be understood to serve the purpose of incorporating the previous state information of the data, in order to improve the accuracy of the categorization of the current input data. The categorization of the current input data may be dependent on the previous state of the communications network 10, or the relevant system comprised in it, represented by Q. The first node 111 may apply the self-Attention or K=V=Q, according to for example the following formulation:

OK

Attention(Q, K, V) = softmax(-= —^T )V s/n Handling concept drift

Concept drift may be understood as the phenomenon where the properties of the input data change with time, leading to errors in the predicted categories by the ML model which may have trained on earlier data. Feature representations in the set of data, that is, the representations of the features or properties of the data that may be presented to the ML model, may evolve over time. Input data may change slowly with time, and new categories of the data may have to be identified, and/or the old categories may slowly change or even disappear. In the training phase, the ML model may be trained on the input data at that time, which may get outdated later as the properties of the data change. Herein, a time window may be defined, e.g., one month. When re-training the ML model, the first node 111 may only consider the data within that time window, in the example given, within the last one month. In this way, the data that is older than the time window may not be able to influence the predictions of the categories. The first node 111 may therefore have to keep retraining the ML/AI model from time to time and take a weighted combination of the predictions from the two models, an old model and a new model. The old model may be understood as the machine learning model that may have been trained on old data. The new model may be understood as the machine learning model that may have been trained on the latest data within a specified time window, e.g., one month. The predictions of the categories made by the two models may be combined to arrive at a more accurate prediction. The first node 111 may therefore re-train the model as the input data may change with time, to make it more accurate when predicting the category of the input. For example, existing labels may change when there may be a new software patch or a change in the stored procedures used to generate the data. Therefore, the first node 111 may be understood to need to handle concept drift.

The evolution of feature representations may not happen that often, maybe once every few months. In such a case, it may happen that a few existing labels may be deleted, which may understood as an example of a sudden drift. In other cases it may happen that a few new labels may need to be created, which may be referred to as another example of a sudden drift. It may also happen that the distribution of the existing labels may have changed, which may understood as an example of a gradual drift and/or incremental drift, corresponding to a gradual distribution change. The first node 111 may be enabled to handle concept drift in the data, e.g., in each of these scenarios, by using a combination of techniques including ensemble learning, online adaptive learning, dynamic context with domain adaptation, a weighted model approach, or Feature transformers to avoid catastrophic forgetting. If concept drift is not handled, the machine learning, which has been trained on the earlier data, may not be able to make correct predictions on the new data because the characteristics of the data may have changed over time. The predicted categories may be incorrect. Handling concept drift may be understood to mean to adapt the machine learning in such a way to give correct predictions of the categories with data whose properties may change with time.

In some examples, the first node 111 may use ensemble learning in the following way. The first node 111 may use a supervised classification model trained on old data, and a model that may be trained on new data, e.g., that of the obtained subset of the data. The weighted combination of these models may then be used to form an ensemble. As and when the drift progresses, the weights may be adjusted accordingly. The first node 111 may identify the progression of the drift by using a Sequential Probability Ratio Test (SPRT) or Page Hinkley test (PHT).

Another way to handle concept drift may be by using online adaptive learning. The first node 111 may use a memory component of a dynamic context unit. The memory may be understood to also have a forgetting mechanism. Examples herein may have a time window for forgetting. The drift may then be detected as in the earlier method, using SPRT etc.

Another way to handle concept drift may be by using dynamic context, performed by a Reinforcement Learning strategy or using Markov chain, combined with domain adaptation techniques to cater to the drift. An example of domain adaptation techniques may be as mentioned in “Conditional Generative Adversarial Network for Structured Domain Adaptation”, https://openaccess.thecvf.com/content cvpr 2018/papers/Hong Conditional Generative Adv ersarial CVPR 2018 paper.pdf.

Classification

The first node 111 may use an intelligent system to merge the known category candidates with unknown category data based on some similarity and confidence measures. The first node 111 may use fuzzy clustering methods, such as fuzzy K-means, to identify if some of the new data, that is, the obtained subset of the data, may belong to a completely new category, and to measure how confident the first node 111 may be in identifying whether unknown data may belong to an existing category or not. Once the first node 111 may obtain a list of probable re-categorized previously unknown category candidates, the first node 111 may need to decide whether to merge them into the known categories, by using a decision system. This system may use the confidence score from fuzzy or soft K means clustering to get a confidence score. For fuzzy k means, the equation may be as follows:

where Xj may be understood to be a data point, may be understood to be a center of the j^th cluster, where each known category may form a cluster, and m may be understood to be a parameter that may control the fuzziness of the algorithm. Wjj may be understood to give the likelihood that the data point Xj belongs to cluster j.

The first node 111 may use an empirical system to decide what may be considered to be an ideal confidence score or likelihood threshold to decide whether to include a data point in an existing category.

Frequency of retraining the model

The first node 111 may retrain the ML model it may have generated to fit the set of data whenever there may be a degradation in performance because of a new patch, for example, because the data generation rules may have changed, or if the performance may go below a threshold performance, where the threshold may be decided empirically. Performance may be understood to refer to the accuracy of the data categorization. That is, whether the category of, e.g., the alarms or other data, may be identified correctly even though there may be a patch which may have changed, for example, the configuration of the loT sensors for example. The first node 111 may receive a notification whenever a new patch may have been installed or when the rules logic may have changed. Accordingly, the first node 111 may retrain the model.

The first node 111 may use an empirical system to decide how frequently the first node 111 may need to perform the retraining in an empirical manner. Although the cluster labels may be changing, they may not be changing all the time. Initially, the first node 111 may retrain according to a baseline frequency, such as once every 45 days. The frequency may be changed depending on the criteria mentioned. Also, the first node 111 may only consider the data for a specific past time window to retrain the model, that is, not use all the historic data from the beginning of collection. The length of the time window may also be based on similar criteria.

Validation

If any of the one or more second categories may be found to be new, that is, previously unknown, two alternate approaches may be used to validate the new categories.

For getting an optimal number of clusters from the data, the first node 111 may use common methods such as elbow and silhoutte score. However, the first node 111 may not always determine that that the clusters corresponding to new categories are correct with a guarantee of 100% accuracy. Therefore the first node 111 may perform validation of representative data samples. The first node 111 may perform this validation by using either self-learning, automatically, or active learning, by using feedback from human experts. The determining in this Action 204 may comprise validating the determined one or more second categories by a self-learning procedure which may comprise validating new categories on the basis of some metrics.

In examples wherein the first node 111 may perform validation by using self-learning, no human checking may be understood to be required needed. The first node 111 may learn new categories of data automatically as they come in, by detecting patterns in the data, incorporating contextual information and using metrics such as Rand index, Jaccard coefficient, Fowlkes and Mallows index, Calinski Harabaz Index and Dunn index, intra cluster distance, entropy, Gini coefficients to identify if a new category may need to be formed out of the new data and/or existing categories may need to be re-classified. Another option may be to use a soft assignment, such as the GMM models, e.g., soft K-means, to make sure there may be membership clustering. The result may be a confidence score of a data point may belong to a given cluster. The first node 111 may then empirically decide a threshold to indicate the cluster label may be correct.

In some examples, the determining in this Action 204 may comprise validating the determined one or more second categories, by an active learning procedure, which may comprise validating new identified categories on the basis of a few representative data points.

In examples wherein the first node 111 may perform validation by using an active learning system, human validators, such as SMEs may check if the new categories or the recategorization candidates identified by the self-learning system may be indeed valid or not. The first node 111 may use active learning to reduce the task of the human in the loop, since verifying the clusters may be a time consuming effort. The first node 111 may choose only a few representative data points from the unknown cluster and ask the subject experts to label only the representative data points, instead of asking them to label each point. In this way, their time may be optimized. The data points that may be nearest neighbors of the cluster centroids may be selected as the representative samples.

By performing iteratively the obtaining of the subset of the data, the respective time period of the first plurality of time periods and the respective condition, and then the analyzing, the first node 111 may be enabled to seamlessly identify categories in the data, e.g., new categories, and re-classify existing categories, e.g., based on a time window, as new data arrives, e.g., in real time. For example, in the alarms use case, the first node 111 may identify the category of the alarm, whether it may fall into one of the existing categories of alarms, or a completely new category of alarm. Action 205

In this Action 205, the first node 111 provides a first indication to the third node 113 operating in the communications network 10. The first indication is based on the determined one or more second categories. For example, the first indication may identify one or more new categories of the alarms found in the set of data.

Providing may comprise outputting or sending, e.g., via the second link 162. For example, in some examples wherein the first node 111 may be the same as the third node 113, the first node 111 may output the first indication. In other examples wherein the first node 111 may be different than the third node 113, the first node 111 may send the first indication to the third node 113. The third node 113 may be, for example, a node managing the configuration of the one or more fourth nodes 114. Some of the one or more fourth nodes 114 may be the same as those that may have generated the data in the set of data, although only some of the nodes may overlap in other examples. For example, one or the one or more fourth nodes 114 may comprise other nodes that may benefit from the one or more second categories identified in the set of data, such as a new communication device joining the communications network 10.

In some embodiments, providing in this Action 205 the first indication to the third node 113 may comprise initiating, based on the determined one or more second categories, a reconfiguration of the one or more fourth nodes 114. For example, if the one or more second categories are identified for an alarm in the set of data, the first indication may enable a node managing the configuration of the one or more fourth nodes 114 to make any necessary reconfiguration adjustments to manage the identified category of alarm.

In some particular examples wherein the firs node 111 may the same node as the third node 113, the first node 111 may initiate the reconfiguration itself, by sending one or more reconfiguration message to the one or more fourth nodes 114, e.g., to manage one or more aspects of the technical operation of the one or more fourth nodes 114, e.g., change the angle of an antenna, increase the detection threshold of a sensor, increase the power of a transmitter in a radio network node, etc...

Action 206

In this Action 206, the first node 111 may receive, based on the provided first indication, a second indication from the third node 113.

As described earlier, in some examples, the first node 111 may use active learning to validate the new categories, of the one or more second categories, by using human experts to validate a few representative data points. According to some examples, at least one of the one or more second categories may be validated by a human in the loop approach. Accordingly, in some embodiments, the second indication may indicate whether or not at least one of the determined one or more second categories may have been validated by a user of the third node 113.

In such embodiments, the determining in Action 204 of the existence of the one or more second categories may then continue to be iterated, based on the received second indication. The at least one of the determined one or more second categories may then be validated or discarded, based on the feedback provided by the user of the third node 113.

By receiving the second indication in this Action 206, the first node 111 may validate the at least one of the of the determined one or more second categories, which may be, e.g., new categories. That is, this second indication may enabled to confirm, upon manual validation by a human expert, if the identified new category indicated in Action 205 may be indeed correct. This validation may be understood to still save time, because only a few representative data samples, instead of all the data samples, from the new category may be provided given to the human expert to validate. In contrast, in existing methods, a human expert may be understood to be required to validate all such data samples, which takes a long time.

Figure 3 is a schematic illustration depicting a non-limiting example of the different components that may be comprised in the first node 111 and used according to particular examples of embodiments herein. At 1, data from the telecommunications domain, e.g., data collected by loT sensors in a building, may be provided as input raw data to a component, of the communications network 10, e.g., a data preprocessing module, which may for example substitute bad data and perform other preprocessing steps. This may be performed by the first node 111, by the one or more second nodes 112, or by yet another node in the communications network 10. The preprocessed data may then be obtained by the first node 111 at 2. a. The preprocessed data may also be provided at 2b to the first node 111 , e.g., to a dynamic context module or unit, or a separate node module or unit to add, based on the respective conditions of the plurality of conditions under which the subsets of data may have been collected, such as changed system configuration, the context information to the data, as e.g., a state vector, and to add attention to the data. The context data may then be obtained by the first node 111 for further analysis at 3. Some of the actions described earlier as performed by the first node 111 may be considered to be performed, in this non-limiting example, by a data analysis module or unit, which may perform EDA on the data using supervised learning or other methods, as described in Action 204. Within the data analysis module or unit, a data balancing module or unit may perform, according to Action 202, a focal loss method to balance the data algorithmically, when the data for different categories may be imbalanced, according to the determination performed in Action 201. A data signature module or unit may determine, according to Action 203, a unique signature for the data, which may then be used to find the distance between any two data points, e.g., one data point belonging to a known and another belonging to an unknown category. The signature may be used to compare any two data points and find the distance between them. One of the data points may be in a known category and another may be in an unknown category. If the distance is less, then the second data point may be determined to belong to the same category as the known one. The first node 111 , according to Action 204, via the data analysis module or unit may convert the output variable into a categorical parameter representing a particular category of data and train a supervised ML model. Data that may be categorized by into a known category, e.g., one of the one or more first categories, may be provided at 4 to a known category module, which may comprise a list of the previously known category data. Data that may not be able to be categorized by the supervised model may be provided at 4 to an unknown category module or unit, and placed at 4 into a list of previously unknown categories of data. The first node 111 may then perform clustering on this group of data to try to identify new categories. At 5, a self-learning system module or unit may validate, according to Action 204, new categories on the basis of some metrics. As explained earlier, an active learning system module or unit may validate the new identified categories on the basis of a few representative data points. A time series module or unit within the first node 111 may, according to Action 204, use a historical time series analysis to perform more accurate predictions of the output two or more categories. A time window based re-categorization module or unit, which is not depicted in Figure 3, may, according to Action 204, identify which of the previously unknown categories of data may potentially be part of a new category, as well as changed existing categories, e.g., based on data for a given time window. A concept drift module or unit within the first node 111 may, according to Action 204, handle concept drift in the data by using a combination of techniques including ensemble learning, online adaptive learning, dynamic context with domain adaptation, as explained earlier. After a category may have been predicted by the data analysis module and also may optionally have been validated by human experts in active learning, at 6, the data analysis module may output the prediction of the category for the current input data to the context module. This may update the configuration or state of the system based on the current prediction of the category from the data analysis module. Data regarding the system configuration may be provided for dynamic context analysis. Data regarding the system configuration may be understood to mean a multi-dimensional context vector representing the configuration of the communications network 10, or the relevant system comprised in it, such as the state of the loT sensors in the alarms use case. A7, in agreement with Action 204, the first node 111 may determine the final categorized output, that is, the one or more second categories, and e.g., provide the first indication to the third node 113 based on the determined one or more second categories.

Figure 4 is a schematic illustration depicting some aspects of embodiments herein relating to the determination of some of the one or more second categories as being previously unknown. Data that may not be able to be categorized by the supervised model may be provided to the unknown category module or unit, and placed into a list of previously unknown categories of data. The first node 111 may then perform clustering on this group of data to try to identify new categories. The first node 111 , e.g., via a new category module or unit comprised in it, may identify candidate data for one or more new categories. These may be candidates, as the first node 111 may need to validate them to be able to accept them as real new categories. The first node 111 , e.g., via the self-learning system module or unit, may validate, according to Action 204, the new categories on the basis of some metrics. As explained earlier, the first node 111 , e.g., via the active learning system module or unit, may validate the new identified categories on the basis of a few representative data points. This may involve human validation, by e.g., receiving the second indication according to Action 206.

Figure 5 is a schematic illustration depicting some aspects of embodiments herein relating to the determination of some of the one or more second categories as being known, or previously unknown. Data that may be categorized by the first node 111 , according to Action 204, into a known category, e.g., one of the one or more first categories, may be provided to the known category module, which may comprise a list of the previously known category data. The first node 111 may analyze the obtained subsets of the data, iteratively, and via a clustering module, determine if data in the obtained subsets have a similar pattern to known categories, by comparing its respective pattern with that of data in known categories via e.g., a classification system. This analysis may yield a number of candidates for re-classification of known categories of data, which may then be provided to e.g., the unknown category module of the first node 111 for further analysis. A time window based re-categorization module or unit, which may be comprised in an unknown category module or unit, may, according to Action 204, identify which of the previously unknown categories of data may potentially be a changed existing category, e.g., based on data for a given time window.

Certain embodiments may provide one or more of the following technical advantage(s). Embodiments herein incorporate context and time series to get a better understanding of the data and make a more accurate prediction of categories. Embodiments herein use selflearning and may be understood to be scalable, the ML model may only need to be retrained and it may be understood to run seamlessly. This may be understood to save time and effort in not having to write a new stored procedure every time there may be a new category. Embodiments herein may be understood to be able to perform the categorization of data with little or no manual intervention. As a further advantage, embodiments herein may be understood to be algorithm based only even when categories are unbalanced. There may be understood to be no need to generate synthetic data to balance different categories. This may be understood to save a lot of human time in manual recategorization of telecommunications data when new data may arrive and/or the rules may change. Furthermore, embodiments herein may be understood to prominently reduce the validation time by human experts by leveraging active learning.

So far the advantages of the embodiments herein have been illustrated with for example a use case of handling categories, e.g., alarms, in data collected from nodes in the communications network 10 such as loT sensors in a building. This may be understood to be applied to other types of nodes in the communications network 10. Furthermore, the benefits of embodiments herein may be understood to be able to be applied to analyze any kind of data collected in the communications network 10. Next, another illustrative non-limiting example of embodiments herein will be presented for the analysis of financial telecommunications data.

Example use case in the financial telecommunications data.

Figure 6 is a schematic illustration depicting some aspects of embodiments herein relating to the determination of some of the one or more second categories for an example use case in the financial telecommunications data. Problem: To illustrate the benefits of the embodiments herein in the analysis of financial data, the following use case may be considered. A case of Top-up/Refill may be considered in a customer prepaid account from a telecommunications service provider point of sale. Such a system may encounter the following illustrative problem. Once payment is collected by an agent 611 , a transaction with a payload describing the top-up purchase is sent to an Order Management system (OM) 612 for fulfilment of an order. On a high-level, the OM 612 may update a charging system 613 with new customer balance by adding the refill amount in a customer existing balance and may create a payment transaction record in a billing system 614 against a subscriber account. Once OM 612 may be done with all fulfilment steps, the success/failure may be sent to a Point of Sales (POS). In case of an order fallout, for example in case one of the order fulfilment steps fails, e.g. creating payment transaction record in billing system fails and updating the Charging System (CS) balance of a customer may be fulfilled successfully, a mismatch will result in the two systems, which may be understood to lead to a financial variance in CS and the billing system. If there is no handling of this order fallout scenario in OM 612, when replication happens in the financial database and a reconciliation report is generated at the end of the day, it may then indicate financial variance between the calculated value and the ending balance of the customer. This may result in the following problems. Any billing transaction which may result in a change in the customer account balance may be recorded in the CS and a respective balance information record (BIR) may be sent to the billing system for billing. Every transaction may be associated with an order identifier (ID) in OM 612 and the OM 612 may be responsible for orchestration and/or fulfilment of an order. As per the reconciliation process, there may be some processes that may be run on the financial system to find discrepancies in the transactions, from various systems, such as the billing, charging, order management etc.

As per the existing methods, if any financial variance is observed, those variances are manually resolved by finding the root cause before the financial feeds may be sent to the external systems. If there is a financial variance, that is, if the calculated balance is not equal to the actual balance, observed at the customer level for a complete day due to some reasons, such as order fallout, missing BIRs, bill cycle issues etc... then there may be understood to be a need to do the root cause analysis, which may be currently a manual process by looking into various tables of the billing system and the order management system. Once the Root Cause Analysis (RCA) may have been performed, the variance is fixed manually by considering some rule-based checks. Eventually, the feeds are to be shared with the external systems, such as a reporting system or a dashboard.

Solution according to embodiments herein:

According to embodiments herein, the one or more second network nodes 112 may in this case collect the financial data, and provide the raw data at 1 , to a data transformation system 614 to pre-process the data and, at 2, output the pre-processed data to a search and analytics system 615 of the first node 111. The search and analytics system 615 may feed the data from the search and analytics system, to be processed by the ML modules, and finally categorize the data into predicted known categories or non-predicted new categories. At 3, the set of data derived from the one or more second nodes 112 is obtained by an ML module or unit comprised in the first node 111 , wherein procedures according to data balancing, time series, supervised learning, and the determining according to Action 204 may be performed, e.g., via a prediction engine. The predicted, or known, and non-predicted, or unknown, or previously unknown, categories may be provided back to the search and analytics system 615 at 4 for reporting the determined categories to a dashboard where they may be viewed, or a ticket raised for a manual verification in case of the unknown categories. If any one or more second categories determined to exist in the set of data match the existing categories, in one example, the first indication may indicate the data for the predicted categories, and at 5.1, the first node 111 may provide it to the third node 113, in this example, a dashboard system 617 comprised in the communications network 10. This may initiate that dashboard system 617 to be used for viewing the statistics related to the financial data over a time period. If any one or more second categories determined to exist in the set of data do not match the existing categories, the first indication, indicating the data for the non-predicted categories, may be provided at 5.2, to the third node 113, in this other example, a node managing a non-predicted category Application Program Interface (API). This may initiate that the third node 113 outputs a tickets alert at 5.2.1 to a ticketing system 618 comprised in the communications network 10, so that the matter may be investigated further, and the new categories for financial data may a be manually verified by human experts.

In the financial data example, embodiments herein may be understood to have the advantages to different aspects of the analysis.

The first benefit may be in an adjustment use-case. Adjustment may be understood as the settlement of the amount to the customer that may have been overbilled or underbilled due to inconsistencies in various systems such as the bi lling/financial, order management, Customer Relation Management (CRM) and charging system etc. Embodiments herein may enable the first node 111 to determine the existence of cases such as order fallout or late arriving Bl Rs, and categorizing them as pending offsets, so that adjustments may be avoided. Furthermore, when the offset may be received later, the existing variance may then be fixed. Embodiments herein may enable to suggest waiting for the adjustment until the BIR may be received, or the order fallout may be fixed. Embodiments herein may enable the first node 111 to categorize the customers which may be possible candidates for adjustments, but may not project the waiting duration to fix the order fallout errors or to wait until BIR is received in order to avoid the Adjustments. Advantageously, the first node 111 may identify those financial transaction data that may be candidates for the adjustments, since they may belong to a new category, or else may be re-categorized out of the existing categories. This may be understood to save time from the manual analysis, which may have had to be spent in manually verifying the adjustments by the human experts.

The second benefit may be in a use-case of known issues with permanent fix in an upcoming release. There may be the variance categories for the customers where the category may be known and there may be a permanent product fix coming in the near future. Embodiments herein may enable the first node 111 to identify those scenarios and label them with a related variance category, subject to data availability of these kind of scenarios. This may also have the advantage of saving time that may otherwise be spent in manually verifying these scenarios out of the financial transactions data. The first node 111 may identify the financial transactions data points, which may be candidates for a new category related to this scenario.

The third benefit may be in a use case of Missing Balance Information Records (Bl Rs) of usage. This may be the case when BIRs may be missing in financial billing system tables, which may lead to variance of some amount. This case may arise when there may be a usage of some amount from the customer side, but there may be a missing BIR for that usage. As a result, the beginning balance for that day and the ending balance of the last day will not match. Embodiments herein may enable the first node 111 to detect these financial variances and place these financial variances under an appropriate category such as e.g., “Missing BIRs”, so that when their existence may be indicated in the first indication to the third node 113, an operations team managing the third node 113 may wait until the Bl R may arrive. For example, if the beginning balance is $50 and the ending Balance is $45, there is a difference of $ 5 which needs to be investigated. After checking the usage tables, it may be found that there is a usage entry of $5 but there is no BIR received for $ 5 which is leading to $ 5 discrepancy. Here, the determined category of financial transaction may be understood to be that of the missing BIRs, which is a known category. The first node 111 may save time of manual verification by automatically identifying the transactions.

A particular example of the missing BIR is an inflight use-case, such as transactions which are inflight. The inflight use-case may be understood as a kind of missing BIR subcategory. In this case, a customer may have recharged the balance of his account at midnight, right before the cut-off time of a data quality process. The data quality process may be understood to be the process which may check the inconsistencies in various systems, e.g., billing, financial, order management, charging system & CRM, and then may come up with a financial variance value of the customer. Then, there may be chances that BIR may not reach the financial database. In that scenario, there may be variance on that day for that customer, but the next day, when a data quality process may be run, it may fetch the missing BIR to the financial database for the same customer as offset. Embodiments herein may enable the first node 111 to identify such inflight scenarios and put them under appropriate variance category.

The fourth benefit may be in a use for some unknown cases, that is, previously unknown categories. According to existing methods, the variance category may be identified by manually writing the Sql queries and then running those Sql queries for a whole lot of customers to see whether these customers are affected by same category or not. Embodiments herein may enable the first node 111 to, according to Action 204, learn these different variance categories from historical data, and perform an allocation of meaningful variance category as examples of the one or more second categories.

Finally, the fifth benefit may be in that embodiments herein may enable the first node 111 to provide the first indication e.g., a dashboard or report for the customers which are having financial variances with variance categories, to the third node 113.

All these benefits may be understood to result in an improved performance of the financial system of the communications network 10, reducing its processing resources, energy resources, and time resources. This may be understood to in turn result in a customer experience with a lesser number of adjustments for late arriving Bl Rs and order fallout cases.

Moreover, the first node 111 may be enabled to provide the first indication as an efficient report to the third node 113, e.g., an external financial system in the cloud 110, which may result in a reduced number of financial variances. Once the categorization of the financial variances may take place by the first node 111 , then it may be understood to be easier for an operations team to fix the errors permanently by looking into the category of the financial variance, which may be understood to result in reduced number of financial variances in a next run.

The first node 111 may be enabled to identify billing financial variance categories as examples of the one or more second categories, multiple times a day, which may be understood to provide more time to an operations team to fix the financial variances and share the correct feed to an external system at the end of the day.

Furthermore, the automated categorization of the billing financial variance performed by the first node 111 may reduce the current time taken to do the root cause identification.

A further advantage of embodiments herein may be understood to be to improve the Mean Time to Resolution (MTTR). That is, once the first node 111 may determine a clear-cut category of the billing financial variances cases, as one of the one or more second categories, the time to resolve the financial variance may be understood to be reduced, since after looking into the category, an operations team may know what actions may need to be taken in order to resolve this particular category.

Another advantage of embodiments herein may be understood to be a reduction in trouble tickets. For example, according to existing methods, hundreds of customers may get reported on a daily basis as having billing financial variances. Out of them, about a fourth may be categorized as falling under a “miscellaneous” category for which tickets may get lodged. Embodiments herein may enable the number of tickets to be lodged to be decreased once the first node 111 may start predicting correct categories, here, categories of the financial variances which may be the actual reasons for the financial variances. According to the foregoing, embodiments herein may be understood to be applicable in a number of use cases including: categorizing alarms, billing financial variance categorizations, customer categorization -VIP, large customers, high usage customers, small customers etc.. Incident and/or tickets may be categorized based on components and processes, e.g., billing instances in one bucket, fulfilment in another etc. Embodiments herein may even be used to predict product purchases, for example to predict which product a customer may purchase based on his/her spending and previous history.

Figure 8 depicts two different examples in panels a) and b), respectively, of the arrangement that the first node 111 may comprise to perform the method actions described above in relation to Figure 2. In some embodiments, the first node 111 may comprise the following arrangement depicted in Figure 8a. The first node 111 may be understood to be for handling one or more categories of data. The first node 111 is configured operate in the communications network 10.

Several embodiments are comprised herein. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 , and will thus not be repeated here. For example, in some embodiments, the first node 111 may be configured to analyze the set of data by performing Exploratory Data Analysis (EDA) on the data using supervised learning or other methods, as described earlier.

The first node 111 is configured to, e.g. by means of a determining unit 701 within the first node 111 configured to, determine, in the set of data configured to be categorized into one or more first categories, the existence of the one or more second categories. The set of data is configured to be derived from the one or more second nodes 112 configured to operate in the communications network 10. The set of data is configured to comprise subsets of data collected: a) during the first plurality of time periods and b) under the second plurality of conditions. The data is further configured to comprise one or more first labels configured to indicate the one or more first categories. To determine is configured to comprise to perform iteratively the following actions. First, obtaining the subset of the data, the respective time period of the first plurality of time periods during which the subset of data was collected, the respective condition of the plurality of conditions under which the subset of data was collected, and the respective first label corresponding to the respective first category, of the one or more first categories, of the subset of data. Second, analyzing, using machine learning and based on the plurality time periods, the plurality of conditions and the one or more first categories, the set of data, wherein the set of data is configured to comprise the subset of data configured to be obtained, to determine the existence of the one or more second categories.

The first node 111 is configured to, e.g. by means of a providing unit 702 within the first node 111 configured to, provide the first indication to the third node 113 configured to operate in the communications network 10. The first indication is configured to be based on the one or more second categories configured to be determined.

In some embodiments, the first node 111 may be further configured to, e.g. by means of the determining unit 701 within the first node 111 configured to, determine that the set of data is unbalanced over one or more categories of data.

In some embodiments, the first node 111 may be further configured to, e.g. by means of a balancing unit 703 within the first node 111 configured to, balance the set of data, refraining from generating simulated data. To determine the existence of the one or more second categories may be configured to be performed on the balanced set of data. To determine the existence of the one or more second categories may be configured to comprise the algorithmic determination of the one or more second categories.

In some embodiments, the first node 111 may be further configured to, e.g. by means of a creating unit 704 within the first node 111 configured to, create the one or more respective unique signatures for the derived data. To determine the existence of the one or more second categories may be configured to be performed based on the one or more respective unique signatures configured to be created for the derived data.

In some embodiments, the one or more second categories may be configured to comprise one or more of: one of the first one or more categories, a previously unknown category, and a change with respect to one of the one or more first categories.

In some embodiments, each of the second plurality of conditions, may be configured to correspond to a respective configuration of one or more fourth nodes 114 configured to be comprised in the communications network 10.

In some embodiments, to provide the first indication to the third node 113 may be configured to comprise initiating, based on the one or more second categories configured to be determined, a reconfiguration of the one or more fourth nodes 114.

In some embodiments, the first node 111 may be configured to, e.g. by means of a receiving unit 705 within the first node 111 configured to, receive, based on the first indication configured to be provided, the second indication from the third node 113. The second indication may be configured to indicate whether or not at least one of the one or more second categories configured to be determined may be validated by the user of the third node 113. To determine the existence of the one or more second categories may be configured to continue to be iterated, based on the second indication configured to be received. Other modules may be comprised in the first node 111.

The embodiments herein in the first node 111 may be implemented through one or more processors, such as a processor 706 in the first node 111 depicted in Figure 7a, together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the first node 111. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the first node 111.

The first node 111 may further comprise a memory 707 comprising one or more memory units. The memory 707 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the first node 111.

In some embodiments, the first node 111 may receive information from, e.g., the one or more second nodes 112, the third node 113, and/or the one or more fourth nodes 114, through a receiving port 708. In some embodiments, the receiving port 708 may be, for example, connected to one or more antennas in first node 111. In other embodiments, the first node 111 may receive information from another structure in the communications network 10 through the receiving port 708. Since the receiving port 708 may be in communication with the processor

706, the receiving port 708 may then send the received information to the processor 706. The receiving port 708 may also be configured to receive other information.

The processor 706 in the first node 111 may be further configured to transmit or send information to e.g., the one or more second nodes 112, the third node 113, the one or more fourth nodes 114, and/or another structure in the communications network 10, through a sending port 709, which may be in communication with the processor 706, and the memory

707.

Those skilled in the art will also appreciate that the units 701-705, described above may refer to a combination of analog and digital modules, and/or one or more processors configured with software and/or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processor 706, perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC). Also, any of the units 701-705 described above may be respectively implemented as the processor 706 of the first node 111 , or an application running on such processor.

Thus, the methods according to the embodiments described herein for the first node 111 may be respectively implemented by means of a computer program 710 product, comprising instructions, i.e. , software code portions, which, when executed on at least one processor 706, cause the at least one processor 706 to carry out the actions described herein, as performed by the first node 111. The computer program 710 product may be stored on a computer- readable storage medium 711. The computer-readable storage medium 711 , having stored thereon the computer program 710, may comprise instructions which, when executed on at least one processor 706, cause the at least one processor 706 to carry out the actions described herein, as performed by the first node 111. In some embodiments, the computer- readable storage medium 711 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 710 product may be stored on a carrier containing the computer program 710 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer- readable storage medium 711 , as described above.

The first node 111 may comprise an interface unit to facilitate communications between the first node 111 and other nodes or devices, e.g., the first node 111, or any of the other nodes. In some particular examples, the interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

In other embodiments, the first node 111 may comprise the following arrangement depicted in Figure 7b. The first node 111 may comprise a processing circuitry 706, e.g., one or more processors such as the processor 706, in the first node 111 and the memory 707. The first node 111 may also comprise a radio circuitry 712, which may comprise e.g., the receiving port 708 and the sending port 709. The processing circuitry 706 may be configured to, or operable to, perform the method actions according to Figure 2, in a similar manner as that described in relation to Figure 7a. The radio circuitry 712 may be configured to set up and maintain at least a wireless connection with any of the one or more second nodes 112, the third node 113, the one or more fourth nodes 114, and/or another structure in the communications network 10. Circuitry may be understood herein as a hardware component.

Hence, embodiments herein also relate to the first node 111 operative to handle one or more categories of data. The first node 111 may be operative to operate in the communications network 10. The first node 111 may comprise the processing circuitry 706 and the memory 707, said memory 707 containing instructions executable by said processing circuitry 706, whereby the first node 111 is further operative to perform the actions described herein in relation to the first node 111, e.g., in Figure 2.

The first node 111 is operative to determine, in the set of data operative to be categorized into one or more first categories, the existence of the one or more second categories. The set of data is operative to be derived from the one or more second nodes 112 operative to operate in the communications network 10. The set of data is operative to comprise subsets of data collected: a) during the first plurality of time periods and b) under the second plurality of conditions. The data is further operative to comprise one or more first labels operative to indicate the one or more first categories. To determine is operative to comprise to perform iteratively the following actions. First, obtaining the subset of the data, the respective time period of the first plurality of time periods during which the subset of data was collected, the respective condition of the plurality of conditions under which the subset of data was collected, and the respective first label corresponding to the respective first category, of the one or more first categories, of the subset of data. Second, analyzing, using machine learning and based on the plurality time periods, the plurality of conditions and the one or more first categories, the set of data, wherein the set of data is operative to comprise the subset of data operative to be obtained, to determine the existence of the one or more second categories.

The first node 111 is operative to provide the first indication to the third node 113 operative to operate in the communications network 10. The first indication is operative to be based on the one or more second categories operative to be determined.

In some embodiments, the first node 111 may be further operative to determine that the set of data is unbalanced over one or more categories of data.

In some embodiments, the first node 111 may be further operative to balance the set of data, refraining from generating simulated data. To determine the existence of the one or more second categories may be operative to be performed on the balanced set of data. To determine the existence of the one or more second categories may be operative to comprise the algorithmic determination of the one or more second categories.

In some embodiments, the first node 111 may be further operative to create the one or more respective unique signatures for the derived data. To determine the existence of the one or more second categories may be operative to be performed based on the one or more respective unique signatures operative to be created for the derived data.

In some embodiments, the one or more second categories may be operative to comprise one or more of: one of the first one or more categories, a previously unknown category, and a change with respect to one of the one or more first categories. In some embodiments, each of the second plurality of conditions, may be operative to correspond to a respective configuration of one or more fourth nodes 114 operative to be comprised in the communications network 10.

In some embodiments, to provide the first indication to the third node 113 may be operative to comprise initiating, based on the one or more second categories operative to be determined, a reconfiguration of the one or more fourth nodes 114.

In some embodiments, the first node 111 may be operative to receive, based on the first indication operative to be provided, the second indication from the third node 113. The second indication may be operative to indicate whether or not at least one of the one or more second categories operative to be determined may be validated by the user of the third node 113. To determine the existence of the one or more second categories may be operative to continue to be iterated, based on the second indication operative to be received.

Generally, all terms used herein are to be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is clearly given and/or is implied from the context in which it is used. All references to a/an/the element, apparatus, component, means, step, etc. are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless a step is explicitly described as following or preceding another step and/or where it is implicit that a step must follow or precede another step. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, wherever appropriate. Likewise, any advantage of any of the embodiments may apply to any other embodiments, and vice versa. Other objectives, features and advantages of the enclosed embodiments will be apparent from the following description.

As used herein, the expression “at least one of:” followed by a list of alternatives separated by commas, and wherein the last alternative is preceded by the “and” term, may be understood to mean that only one of the list of alternatives may apply, more than one of the list of alternatives may apply or all of the list of alternatives may apply. This expression may be understood to be equivalent to the expression “at least one of:” followed by a list of alternatives separated by commas, and wherein the last alternative is preceded by the “or” term.

Claims

CLAIMS:

1. A method, performed by a first node (111), the method being for handling one or more categories of data, the first node (111) operating in a communications network (10), the method comprising:

- determining (204), in a set of data categorized into one or more first categories, an existence of one or more second categories, the set of data being derived from one or more second nodes (112) operating in the communications network (10), the set of data comprising subsets of data collected: a) during a first plurality of time periods and b) under a second plurality of conditions, wherein the data further comprises one or more first labels indicating the one or more first categories, the determining (204) comprising performing iteratively: a. obtaining a subset of the data, a respective time period of the first plurality of time periods during which the subset of data was collected, a respective condition of the plurality of conditions under which the subset of data was collected, and a respective first label corresponding to a respective first category, of the one or more first categories, of the subset of data, and b. analyzing, using machine learning and based on the plurality time periods, the plurality of conditions and the one or more first categories, the set of data comprising the obtained subset of data, to determine the existence of the one or more second categories, and

- providing (205) a first indication to a third node (113) operating in the communications network (10), the first indication being based on the determined one or more second categories.

2. The method according to claim 1 , wherein the method further comprises:

- determining (201) that the set of data is unbalanced over one or more categories of data, and

- balancing (202) the set of data, refraining from generating simulated data, wherein the determining (204) of the existence of the one or more second categories is performed on the balanced set of data, and wherein the determining (204) of the existence of the one or more second categories comprises an algorithmic determination of the one or more second categories.

3. The method according to any of claims and 1-2, the method further comprising: - creating (203) one or more respective unique signatures for the derived data, and wherein the determining (204) of the existence of the one or more second categories is performed based on the one or more respective unique signatures created for the derived data.

4. The method according to any of claims 1-3, wherein the one or more second categories comprise one or more of: one of the first one or more categories, a previously unknown category, and a change with respect to one of the one or more first categories.

5. The method according to any of claims 1-4, wherein each of the second plurality of conditions, corresponds to a respective configuration of one or more fourth nodes (114) comprised in the communications network (10).

6. The method according to any of claims 1-5, wherein providing (205) the first indication to the third node (113) comprises initiating, based on the determined one or more second categories, a reconfiguration of the one or more fourth nodes (114).

7. The method according to any of claims 1-6, the method further comprising:

- receiving (206), based on the provided first indication, a second indication from the third node (113), the second indication indicating whether or not at least one of the determined one or more second categories is validated by a user of the third node (113), and wherein the determining (204) of the existence of the one or more second categories continues to be iterated, based on the received second indication.

8. A computer program (710), comprising instructions which, when executed on at least one processor (706), cause the at least one processor (706) to carry out the method according to any one of claims 1 to 7.

9. A computer-readable storage medium (711), having stored thereon a computer program (710), comprising instructions which, when executed on at least one processor (706), cause the at least one processor (706) to carry out the method according to any one of claims 1 to 7. A first node (111), for handling one or more categories of data, the first node (111) being configured to operate in a communications network (10), the first node (111) being further configured to:

- determine, in a set of data configured to be categorized into one or more first categories, an existence of one or more second categories, the set of data being configured to be derived from one or more second nodes (112) configured to operate in the communications network (10), the set of data being configured to comprise subsets of data collected: a) during a first plurality of time periods and b) under a second plurality of conditions, wherein the data is further configured to comprise one or more first labels configured to indicate the one or more first categories, wherein to determine being configured to comprise to perform iteratively: a. obtaining a subset of the data, a respective time period of the first plurality of time periods during which the subset of data was collected, a respective condition of the plurality of conditions under which the subset of data was collected, and a respective first label corresponding to a respective first category, of the one or more first categories, of the subset of data, and b. analyzing, using machine learning and based on the plurality time periods, the plurality of conditions and the one or more first categories, the set of data further configured to comprise the subset of data configured to be obtained, to determine the existence of the one or more second categories, and

- provide a first indication to a third node (113) configured to operate in the communications network (10), the first indication being configured to be based on the one or more second categories configured to be determined. The first node (111) according to claim 10, wherein the first node (111) is further configured to:

- determine that the set of data is unbalanced over one or more categories of data, and

- balance the set of data, refraining from generating simulated data, wherein to determine the existence of the one or more second categories is configured to be performed on the balanced set of data, and wherein to determine the existence of the one or more second categories is configured to comprise an algorithmic determination of the one or more second categories. The first node (111) according to any of claims and 10-11 , the first node (111) being further configured to:

- create one or more respective unique signatures for the derived data, and wherein to determine the existence of the one or more second categories is configured to be performed based on the one or more respective unique signatures configured to be created for the derived data. The first node (111) according to any of claims 10-12, wherein the one or more second categories are configured to comprise one or more of: one of the first one or more categories, a previously unknown category, and a change with respect to one of the one or more first categories. The first node (111) according to any of claims 10-13, wherein each of the second plurality of conditions, is configured to correspond to a respective configuration of one or more fourth nodes (114) configured to be comprised in the communications network (10). The first node (111) according to any of claims 10-14, wherein to provide the first indication to the third node (113) is configured to comprise initiating, based on the one or more second categories configured to be determined, a reconfiguration of the one or more fourth nodes (114). The first node (111) according to any of claims 10-15, the first node (111 ) being further configured to:

- receive, based on the first indication configured to be provided, a second indication from the third node (113), the second indication being configured to indicate whether or not at least one of the one or more second categories configured to be determined is validated by a user of the third node (113), and wherein to determine the existence of the one or more second categories is configured to continue to be iterated, based on the second indication configured to be received.