WO2000036788A2

WO2000036788A2 - Marketing and controlling networks by using neurocomputing methods in network management data

Info

Publication number: WO2000036788A2
Application number: PCT/DE1999/003921
Authority: WO
Inventors: Bernhard Nauer; Michiaki Taniguchi
Original assignee: Siemens Aktiengesellschaft
Priority date: 1998-12-11
Filing date: 1999-12-08
Publication date: 2000-06-22
Also published as: EP1055309A2; WO2000036788A3; DE19857335A1

Abstract

Several neurocomputational method-based approaches, i.e. a neural network with supervised training, density-based modelling and a causal network, are used with regard to log data which is produced at network management level in order to recognise the utilisation profile of a final customer or employee of a user. Results from said methods are optionally combined with each other or with additional network data in order to provide more significant information with a reduced error rate. Premature recognition of irregularities in network management, information about the necessity of network expansion and significant information about market trends and marketing purposes are obtained.

Description

description

Marketing and controlling of networks by applying methods of neuroinformatics to network management data

Irregularities in the network management of a network (caused, for example, by operators, but also by private and business customers of a network operator) can reach an order of magnitude that endangers the business basis of a network operator. At the moment, it is technically very difficult to identify such cases of use so early that the damage caused is minimal.

The subject of the application relates to a method for detecting irregularities in network management and a method for recording the usage behavior in network management of users of a network, as a result of which the processes occurring in a telecommunications network are logged in the course of network management on log files.

Private and business customers can manage the services of a network in different ways, e.g. directly via a CNM (CNM = Customer Network Management) or CSC (= Customer Service Control) interface or indirectly with the help of an operator. Targeted marketing campaigns for the different usage groups on the part of the network operator, recognition of market trends, the detection of bottlenecks in the network or also the determination of cost savings potential have so far been very difficult, since the precise assignment of a private or business customer to various behavior categories is only insufficiently supported technically .

With network management, all operations carried out in the network, such as B. Operations, actions and events, in particular also alarms, are logged in detail by the systems involved on log files. There are currently various software tools, which experts also refer to as tools for detecting fraud. Such tools are based on various techniques, such as the rule-based approach or neural networks, etc. These techniques are used to evaluate CDR (Call Detail Records) or signaling data from the CCS7 signaling system. To evaluate log files, there are only applications, commands or tools today that evaluate each log file separately.

The object of the registration is based on the problem of specifying a method which provides significant statements on specific uses of a network based on log files, in particular on irregularities in network management, with a low error rate.

The problem is solved by the features of claim 1 or claim 2.

The method according to the application forms a detection tool with which specific uses of a network can be identified at an early stage, in particular suspicions of fraud and manipulation in networks, market trends in networks and network bottlenecks, which can be derived from network management activities.

According to a further development of the subject of the application, the results of the different methods of neuroinformatics are combined (linked, summarized) to form a significant statement with an extremely low error rate, if necessary with the inclusion of further data.

The subject matter of the application is explained in more detail below as an exemplary embodiment to the extent necessary for understanding with reference to figures. Show:

Fig. 1 is a basic block diagram of elements and Figure 2 is their interaction in Anme1degegenstand and a ^¬ An application example for modeling a behavior category in the causal network.

The subject of the application relates to the field of management of networks, in particular of telecommunications networks and of intelligent networks. Network management operations are carried out by the operator's staff as well as end customers (keyword: Customer Network Management, Customer Service Control).

In the method according to the application shown in FIG. 1, the log data LDAT can be subjected to a rule-based preprocessing PP (for: preprocessor), the log data being correlated and compressed and, if necessary, brought to a uniform format. The log data can, if necessary in preprocessed form, be subjected to an intermediate storage LDR (for: Log Data Record) as an intermediate result. The log data are fed, if necessary in preprocessed form and if necessary after buffering, to a method approach MA which comprises a neural network with monitored training NNUE, a densely based profile modeling DBPM and a causal-neural network KNN, in the following causal network called, has. The method approach MA works, as indicated by two double-headed arrows, with a database MO / TR, in which the modeling / training data are stored, and a database HIST, in which the evaluation results of the current and previous observation periods are stored . The intermediate results output by the method approach MA or stored in the database HIST can be subjected to an evaluation in a device COMB (for: combination). In this evaluation, the data can be combined with further data ADAT (for example the results of other methods, in particular a rule-based method, the CDRs (= Call Data Records) Participant data etc.) are combined (linked). They are output as the result OUT.

The method according to the application makes use of three different method approaches in neuroinformatics, namely the neural network with monitored training, density-based modeling and the causal network. In a further development of the subject of registration, the three method approaches are combined. The modeling with these three methods is carried out on the basis of various log files. The resulting model represents a marketing and controlling tool for networks.

With network management, all operations carried out in the network, such as B. Operations, actions and events, in particular also alarms, are logged in detail by the systems involved in recording files, which experts also refer to as log files.

The content of the log files depends to a large extent on the systems used, the type of log file and the setting of the log discriminator (administrable filter). Log entries can contain, for example: - unique log ID (identification, name of the recording file) - time of the log entry entity to which the log entry is assigned (e.g. user ID, application entity title) - type and scope of a file access (e.g. deletion of a Objects of object class k with object ID n, creation of an object of object class k with content description, modification of an object of object class k with object ID n and attribute values) Standards for log entries in the framework of network management are, for example, in ITU-T X.735 (log Control Function), ITU-T X.733 (Alarm Report Function), ITU-T X.740 (Security Audit Trail Function) and ITU-T X.736 (Security Alarm Reporting Function) and in various RFCs of the IETF . Such standards facilitate preprocessing of the log data, but are not a necessary prerequisite for the use of neuronal methods. In order to speed up the processing of the data, a preprocessor PP can optionally be used. The preprocessor has the task of correlating and compressing the log data in such a way that data sets are delivered with the attribute values required in the actual process.

In principle, any preprocessor can be used which, as a result, provides a superset of the attribute values required by the method.

In a preferred embodiment of the subject of the application, a rule-based preprocessor is used. The rules control the correlation and compression of the log data.

If a new characteristic attribute is added in the actual process or if a characteristic attribute is omitted, the selection rules of the preprocessor can be easily (automatically) adapted. An automatic adaptation of the selection rules can be controlled via notifications (free-running messages) to the preprocessor, as denoted in FIG. 1 by ADAP (for: adaptation).

The method described below can thus

- place directly on the log files,

- based on the results of any preprocessor

- Based on results (labeled INTM in Fig. 1) of a specific rule-based preprocessor.

The data on which the method is based are called log data below.

According to the subject of the application, various methods of neuroinformatics can be applied to log data. In the "Neural Network with Supervised Training" method, the neural network is trained using a set of examples. The prerequisite for the training is that for each example the associated target value is given, ie it must be known at the time of the training whether there was an irregularity, in particular fraud, for the example under consideration. An example consists of a series of attributes that characterize the behavior of a user with regard to certain login contents. The target values to be examined and the attributes characteristic of the example must be specified. The characteristic attributes determine the behavior of a user. The behavior in turn depends on certain attribute values (the data itself).

An example is generated for each user. The characteristic attributes are, for example: - Average number of management operations carried out by a user in one day over an observation period (e.g. four weeks) - Scattering in the number of management operations performed by a user in one day over an observation period (e.g. four weeks) - Maximum number the management operations performed by a user in one day over an observation period (e.g. four weeks) - minimum number of management operations performed by a user in a day over an observation period (e.g. four weeks)

- Average number of specific management operations carried out by a user in one day over an observation period (e.g. four weeks) - Scattering in the number of specific management operations performed by a user in one day over an observation period (e.g. four weeks) - Maximum number of users Specific management operations performed in one day over an observation period (e.g. four weeks) - minimum number of specific management operations performed by a user in one day over an observation period (e.g. four weeks)

- Average number of alarms sent by a system in a day over an observation period (eg four weeks) - Spread of the number of alarms sent by a system in a day over an observation period (eg four weeks) - Maximum number of alarms by a system on one Alarms sent during the day over an observation period (e.g. four weeks) - Minimum number of alarms sent by a system in one day over an observation period (e.g. four weeks) - Average number of special alarms sent by a system in one day over an observation period (e.g. four weeks) ) - Spread of the number of alarms sent by a system in a day over an observation period (e.g. four weeks) - Maximum number of alarms sent by a system in a day over an observation period (e.g. four weeks) - Minimum number of alarms by a system alarms sent out one day over an observation period (e.g. four weeks) etc. The aim of the training phase (preliminary steps) of the neural network is to create a model which, based on the example given, decides for a user whether a use is defined in terms of one or more Target values take place or not. The model is created by the supervised training, the basics of which are described in detail in Rumelhart, DE, Hinton, GE and Williams, RJ Learning internal representation by error backpropagation, Parallel Distributed Processing, pp. 318-362, Cambridge, MA, MIT Press, 1986 . The following steps are carried out in the training phase: Each user is assigned a behavior pattern in the form of attributes that describes a certain (behavior) profile over a longer period of time. The period of time on which the behavior pattern is based should not be shorter than four weeks and be before the time when the method is used for marketing and controlling purposes. The neural network is trained on the basis of training data for use with regard to the defined target values. After completion of the training phase, the application phase of the neural network begins, in which the following steps are carried out continuously: For each user, new attribute values (one example per user) are determined from the associated log entries of an observation period. If the method is used for controlling purposes, the observation room is chosen to be very small (e.g. one day). Will the method for Marketing purposes used, then the observation period is chosen longer (eg four weeks). The neural network decides on the basis of Examples, whether the use in Obs ^¬ caution period a particular target value can be assigned or not. This decision is displayed user-specifically as the result of the observation period and optionally logged in a database HIST. The prerequisite for this is that the data can be clearly assigned to a user. This requirement can be met in different ways:

- The name of the user is part of the log data in anonymized or non-anonymized form, or

- The name of the user is not part of the log data, but the data can be clearly assigned to a specific real user (e.g. a person or an application), or

- The name of the user is not part of the log data, but the data can be clearly assigned to a specific virtual user (such as user 1, user 2, ...); such an assignment is sufficient e.g. for statistics and for statements about market trends etc.

If necessary, the neural network is trained with new target values with regard to its use, in particular with hitherto unknown cases of fraud / manipulation. The method "density-based profile modeling" is a probabilistic modeling of the behavior of a user (probabilistic profile modeling). The behavior of a user is described in the form of behavior patterns. Each behavior pattern is created in the form of a model using the associated examples. These examples consist of several characteristic attributes that are based on certain login content, as described, for example, in the "Neural network with monitored training" method. In the training phase of density-based profile modeling, the following steps are carried out: Each user is given behavior patterns in the form of a number of examples assigned, which describe the behavior of the user over a longer period of time. The period on which the behavior pattern is based should not be shorter than four weeks and should be before the time when the method is used for marketing and controlling purposes. A probabilistic profile is created for each user. This is done by density estimation using the EM algorithm. The exact description is contained in Chris Bishop, Neural Networks in Pattern Recognition, Oxford Press, 1996.

After completing the training phase, the application phase of density-based profile modeling begins, in which the following steps are carried out continuously: The log data of an observation period (for example, one day) is analyzed with regard to the login content intended for probabilistic profile modeling (a new example is created). The density-based profile model outputs a value that represents a probability of using the network of the user under consideration with regard to the defined behavioral patterns. With the current example, the profile model is adapted. The re-adapted profile model is displayed user-specifically as the result of the observation period and optionally logged in a database. The prerequisite for this is that the data can be clearly assigned to a user as described above. The basis for the causal network method is the modeling of typical behavior scenarios in the form of causal dependencies and probabilities of certain login content, e.g. are shown in Fig. 2 in the form of a fraud scenario.

Both the respective weekday WD / WE (for: working day, workday / week end, weekend) and the respective fraud scenario BS have an impact on the object class OK, the number of accesses AZ, the duration of the accesses DZ and the access type ZA .

(1) If the object class "Billing data" is accessed more than once or not on any day, then if there is a probability of 0.8, the charge is irregular (fee fraud). (2) If the object class "Billing Data" is accessed with an access type other than FTP (File Transfer Protocol) or FTAM (File Transfer Access Method), then it is likely that the fee is 0.5 fraud. (3) If the transfer of a fee file with the FTAM access type takes more than n times (n> 1) of the average transfer time, then the probability max (l, n * 0.2) is a fee fraud.

The causal dependencies are based on the evaluation of known use cases. You can refer to several log files. They are not specifically assigned to individual users. The modeling of the causal network in this phase, the following steps are carried out: For all log files involved in network management, the causal dependencies with regard to the log content are formulated for all the behavior scenarios under consideration corresponding probabilities are assigned. The domain knowledge of the specialist is required in the modeling phase. The basis of the causal network is described in Finn V. Jensen, An Introduction to Bavarian Networks, UCL Press 1996. In the application phase of the causal network, the following steps are carried out continuously: The log data are continuously examined for the formulated causal dependencies. For each user or event, a decision is made as to the likelihood of specific use with regard to the defined behavior scenarios. This decision is displayed as a result and optionally logged in a database HIST. The probabilities behind the causal dependencies can be re-adapted. If necessary, the causal dependencies on new behavior scenarios not yet considered are added to the existing causal dependencies. This method can also be used if the user is not part of the log entry. In this case, however, a recognized usage cannot be assigned to a specific user, in particular a suspicion of fraud and manipulation cannot be attributed to any perpetrator.

In principle, it is possible to output the individual results of the individual procedures. In a further embodiment of the subject of the application, the individual results of the individual processes are condensed into an overall result. This consolidation includes the individual results of the different processes. The individual results can come from both the current and past observation periods. In addition, further data (such as the results of other methods, in particular a rule-based method, participant data, data about the participants' billing behavior, black lists of participants, white lists of participants, CDRs, etc.) can be taken into account in the compression. An example of such a compression is the recognition of how certain services are actually used. This can lead to market trend recognition by evaluating the results of different observation periods.

Claims

claims

1. A method for detecting irregularities in network management, consequently - the processes occurring in a telecommunications network are logged in the course of network management on log files

- a log file or several log files are evaluated using at least one of the following methods: • neural network, monitored trained,

• density based profile modeling,

• causal neuronal network in such a way that a significant deviation from a result, as occurs in the case of regular user behavior, is output.

2. Procedure for recording the usage behavior in the network management of users of a network accordingly

- The processes occurring in a network are logged in the course of network management on log files

- A log file or several log files are evaluated using at least one of the following methods:

Neural network, monitored trained,

• density-based profile modeling, • causal network in such a way that an assignment of a user according to his user behavior to a category of usage behavior (behavior pattern, behavior scenario) is output.

3. The method according to any one of the preceding claims, characterized in that the log files are subjected to a pretreatment before the evaluation.

4. The method according to any one of claims 1 to 3, characterized in that the data are pretreated to a uniform, standardized format according to ITU X.735, X.733, X.740 or X.736.

5. The method according to any one of claims 1 to 3, characterized in that the data are pretreated to a uniform, standardized format according to an IETF RFC.

6. The method according to any one of claims 3, 4 or 5, characterized in that the pretreatment is a rule-based pretreatment.

7. The method according to any one of claims 3 to 6, characterized in that the pretreated log data are buffered before evaluation.

8. The method according to any one of claims 3 to 7, characterized in that, depending on the evaluation result, at least one of the methods automatically adjusts the selection rules for the pretreatment of the subscriber data.

9. The method according to any one of the preceding claims, characterized in that the results of the current evaluations of at least two methods are linked to an end result.

10. The method according to any one of the preceding claims, characterized in that the results of the evaluations of at least two methods of a current observation period and a past observation period are linked to an end result.

11. The method according to any one of the preceding claims, characterized in that the results of the evaluations of at least one method are combined with further network data to form an overall end result.

12. The method according to any one of the preceding claims, characterized in that the network is a telecommunications network.

13. The method according to any one of the preceding claims, characterized in that the network is an intelligent network.

14. The method according to any one of the preceding claims, characterized in that the network is a data network.

15. The method according to any one of the preceding claims, characterized in that the method for fraud detection (detection of irregularities, manipulations) is used.

16. The method according to any one of the preceding claims, characterized in that the method is used to identify market trends and marketing statements.

17. The method according to any one of the preceding claims, characterized in that the method is used to detect network bottlenecks.