WO2000036788A2 - Marketing et controle de reseaux par application de methodes de neuro-informatique aux donnees de gestion de reseaux - Google Patents

Marketing et controle de reseaux par application de methodes de neuro-informatique aux donnees de gestion de reseaux Download PDF

Info

Publication number
WO2000036788A2
WO2000036788A2 PCT/DE1999/003921 DE9903921W WO0036788A2 WO 2000036788 A2 WO2000036788 A2 WO 2000036788A2 DE 9903921 W DE9903921 W DE 9903921W WO 0036788 A2 WO0036788 A2 WO 0036788A2
Authority
WO
WIPO (PCT)
Prior art keywords
network
data
behavior
log
user
Prior art date
Application number
PCT/DE1999/003921
Other languages
German (de)
English (en)
Other versions
WO2000036788A3 (fr
Inventor
Bernhard Nauer
Michiaki Taniguchi
Original Assignee
Siemens Aktiengesellschaft
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Siemens Aktiengesellschaft filed Critical Siemens Aktiengesellschaft
Priority to EP99967864A priority Critical patent/EP1055309A2/fr
Publication of WO2000036788A2 publication Critical patent/WO2000036788A2/fr
Publication of WO2000036788A3 publication Critical patent/WO2000036788A3/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/16—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using machine learning or artificial intelligence
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks

Definitions

  • Irregularities in the network management of a network can reach an order of magnitude that endangers the business basis of a network operator. At the moment, it is technically very difficult to identify such cases of use so early that the damage caused is minimal.
  • the subject of the application relates to a method for detecting irregularities in network management and a method for recording the usage behavior in network management of users of a network, as a result of which the processes occurring in a telecommunications network are logged in the course of network management on log files.
  • CNM Customer Network Management
  • CSC Customer Service Control
  • Targeted marketing campaigns for the different usage groups on the part of the network operator, recognition of market trends, the detection of bottlenecks in the network or also the determination of cost savings potential have so far been very difficult, since the precise assignment of a private or business customer to various behavior categories is only insufficiently supported technically .
  • the object of the registration is based on the problem of specifying a method which provides significant statements on specific uses of a network based on log files, in particular on irregularities in network management, with a low error rate.
  • the method according to the application forms a detection tool with which specific uses of a network can be identified at an early stage, in particular suspicions of fraud and manipulation in networks, market trends in networks and network bottlenecks, which can be derived from network management activities.
  • Fig. 1 is a basic block diagram of elements and Figure 2 is their interaction in Anme1deneuvestand and a ⁇ An application example for modeling a behavior category in the causal network.
  • the subject of the application relates to the field of management of networks, in particular of telecommunications networks and of intelligent networks.
  • Network management operations are carried out by the operator's staff as well as end customers (keyword: Customer Network Management, Customer Service Control).
  • the log data LDAT can be subjected to a rule-based preprocessing PP (for: preprocessor), the log data being correlated and compressed and, if necessary, brought to a uniform format.
  • the log data can, if necessary in preprocessed form, be subjected to an intermediate storage LDR (for: Log Data Record) as an intermediate result.
  • LDR for: Log Data Record
  • the log data are fed, if necessary in preprocessed form and if necessary after buffering, to a method approach MA which comprises a neural network with monitored training NNUE, a densely based profile modeling DBPM and a causal-neural network KNN, in the following causal network called, has.
  • the method approach MA works, as indicated by two double-headed arrows, with a database MO / TR, in which the modeling / training data are stored, and a database HIST, in which the evaluation results of the current and previous observation periods are stored .
  • the intermediate results output by the method approach MA or stored in the database HIST can be subjected to an evaluation in a device COMB (for: combination).
  • the method according to the application makes use of three different method approaches in neuroinformatics, namely the neural network with monitored training, density-based modeling and the causal network.
  • the three method approaches are combined.
  • the modeling with these three methods is carried out on the basis of various log files.
  • the resulting model represents a marketing and controlling tool for networks.
  • Log entries can contain, for example: - unique log ID (identification, name of the recording file) - time of the log entry entity to which the log entry is assigned (e.g. user ID, application entity title) - type and scope of a file access (e.g.
  • Standards for log entries in the framework of network management are, for example, in ITU-T X.735 (log Control Function), ITU-T X.733 (Alarm Report Function), ITU-T X.740 (Security Audit Trail Function) and ITU-T X.736 (Security Alarm Reporting Function) and in various RFCs of the IETF .
  • Such standards facilitate preprocessing of the log data, but are not a necessary prerequisite for the use of neuronal methods.
  • a preprocessor PP can optionally be used.
  • the preprocessor has the task of correlating and compressing the log data in such a way that data sets are delivered with the attribute values required in the actual process.
  • any preprocessor can be used which, as a result, provides a superset of the attribute values required by the method.
  • a rule-based preprocessor is used.
  • the rules control the correlation and compression of the log data.
  • the selection rules of the preprocessor can be easily (automatically) adapted.
  • An automatic adaptation of the selection rules can be controlled via notifications (free-running messages) to the preprocessor, as denoted in FIG. 1 by ADAP (for: adaptation).
  • log data The data on which the method is based are called log data below.
  • various methods of neuroinformatics can be applied to log data.
  • the neural network is trained using a set of examples.
  • the prerequisite for the training is that for each example the associated target value is given, ie it must be known at the time of the training whether there was an irregularity, in particular fraud, for the example under consideration.
  • An example consists of a series of attributes that characterize the behavior of a user with regard to certain login contents.
  • the target values to be examined and the attributes characteristic of the example must be specified.
  • the characteristic attributes determine the behavior of a user.
  • the behavior in turn depends on certain attribute values (the data itself).
  • the characteristic attributes are, for example: - Average number of management operations carried out by a user in one day over an observation period (e.g. four weeks) - Scattering in the number of management operations performed by a user in one day over an observation period (e.g. four weeks) - Maximum number the management operations performed by a user in one day over an observation period (e.g. four weeks) - minimum number of management operations performed by a user in a day over an observation period (e.g. four weeks)
  • the aim of the training phase (preliminary steps) of the neural network is to create a model which, based on the example given, decides for a user whether a use is defined in terms of one or more Target values take place or not.
  • the model is created by the supervised training, the basics of which are described in detail in Rumelhart, DE, Hinton, GE and Williams, RJ Learning internal representation by error backpropagation, Parallel Distributed Processing, pp. 318-362, Cambridge, MA, MIT Press, 1986 .
  • Each user is assigned a behavior pattern in the form of attributes that describes a certain (behavior) profile over a longer period of time.
  • the period of time on which the behavior pattern is based should not be shorter than four weeks and be before the time when the method is used for marketing and controlling purposes.
  • the neural network is trained on the basis of training data for use with regard to the defined target values.
  • the application phase of the neural network begins, in which the following steps are carried out continuously: For each user, new attribute values (one example per user) are determined from the associated log entries of an observation period. If the method is used for controlling purposes, the observation room is chosen to be very small (e.g. one day).
  • the observation period is chosen longer (eg four weeks).
  • the neural network decides on the basis of Examples, whether the use in Obs ⁇ caution period a particular target value can be assigned or not. This decision is displayed user-specifically as the result of the observation period and optionally logged in a database HIST. The prerequisite for this is that the data can be clearly assigned to a user. This requirement can be met in different ways:
  • the name of the user is part of the log data in anonymized or non-anonymized form, or
  • the name of the user is not part of the log data, but the data can be clearly assigned to a specific real user (e.g. a person or an application), or
  • the name of the user is not part of the log data, but the data can be clearly assigned to a specific virtual user (such as user 1, user 2, ...); such an assignment is sufficient e.g. for statistics and for statements about market trends etc.
  • the method "density-based profile modeling” is a probabilistic modeling of the behavior of a user (probabilistic profile modeling).
  • the behavior of a user is described in the form of behavior patterns.
  • Each behavior pattern is created in the form of a model using the associated examples. These examples consist of several characteristic attributes that are based on certain login content, as described, for example, in the "Neural network with monitored training" method.
  • the training phase of density-based profile modeling the following steps are carried out: Each user is given behavior patterns in the form of a number of examples assigned, which describe the behavior of the user over a longer period of time.
  • the period on which the behavior pattern is based should not be shorter than four weeks and should be before the time when the method is used for marketing and controlling purposes.
  • a probabilistic profile is created for each user. This is done by density estimation using the EM algorithm. The exact description is contained in Chris Bishop, Neural Networks in Pattern Recognition, Oxford Press, 1996.
  • the application phase of density-based profile modeling begins, in which the following steps are carried out continuously:
  • the log data of an observation period (for example, one day) is analyzed with regard to the login content intended for probabilistic profile modeling (a new example is created).
  • the density-based profile model outputs a value that represents a probability of using the network of the user under consideration with regard to the defined behavioral patterns.
  • the profile model is adapted.
  • the re-adapted profile model is displayed user-specifically as the result of the observation period and optionally logged in a database. The prerequisite for this is that the data can be clearly assigned to a user as described above.
  • the basis for the causal network method is the modeling of typical behavior scenarios in the form of causal dependencies and probabilities of certain login content, e.g. are shown in Fig. 2 in the form of a fraud scenario.
  • Both the respective weekday WD / WE (for: working day, workday / week end, weekend) and the respective fraud scenario BS have an impact on the object class OK, the number of accesses AZ, the duration of the accesses DZ and the access type ZA .
  • the causal dependencies are based on the evaluation of known use cases. You can refer to several log files. They are not specifically assigned to individual users.
  • the modeling of the causal network in this phase the following steps are carried out: For all log files involved in network management, the causal dependencies with regard to the log content are formulated for all the behavior scenarios under consideration corresponding probabilities are assigned. The domain knowledge of the specialist is required in the modeling phase. The basis of the causal network is described in Finn V. Jensen, An Introduction to Bavarian Networks, UCL Press 1996.
  • the application phase of the causal network the following steps are carried out continuously: The log data are continuously examined for the formulated causal dependencies. For each user or event, a decision is made as to the likelihood of specific use with regard to the defined behavior scenarios.
  • This decision is displayed as a result and optionally logged in a database HIST.
  • the probabilities behind the causal dependencies can be re-adapted. If necessary, the causal dependencies on new behavior scenarios not yet considered are added to the existing causal dependencies. This method can also be used if the user is not part of the log entry. In this case, however, a recognized usage cannot be assigned to a specific user, in particular a suspicion of fraud and manipulation cannot be attributed to any perpetrator.
  • the individual results of the individual processes are condensed into an overall result.
  • This consolidation includes the individual results of the different processes.
  • the individual results can come from both the current and past observation periods.
  • further data such as the results of other methods, in particular a rule-based method, participant data, data about the participants' billing behavior, black lists of participants, white lists of participants, CDRs, etc.
  • An example of such a compression is the recognition of how certain services are actually used. This can lead to market trend recognition by evaluating the results of different observation periods.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Databases & Information Systems (AREA)
  • Evolutionary Computation (AREA)
  • Medical Informatics (AREA)
  • Software Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Manipulator (AREA)
  • General Factory Administration (AREA)
  • Image Analysis (AREA)

Abstract

Plusieurs éléments de méthodes issues de la neuro-informatique, à savoir le réseau neuronal à apprentissage contrôlé, la modélisation fondée sur la densité et le réseau causal, sont appliqués aux fichiers journaux créés lors de la gestion d'un réseau, pour déterminer la façon dont un client final ou un employé d'un exploitant de réseau utilise ce réseau. Les résultats obtenus sont éventuellement combinés entre eux ou à d'autres données de réseau pour accroître l'utilité des informations obtenues, avec un taux d'erreurs réduit, dans le but de déterminer la façon dont le réseau est utilisé. Il est ainsi possible de détecter de manière précoce des anomalies dans la gestion du réseau, et d'obtenir des informations sur la nécessité d'étendre ou non le réseau, ainsi que des informations importantes sur les tendances du marché et pour des activités de marketing.
PCT/DE1999/003921 1998-12-11 1999-12-08 Marketing et controle de reseaux par application de methodes de neuro-informatique aux donnees de gestion de reseaux WO2000036788A2 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP99967864A EP1055309A2 (fr) 1998-12-11 1999-12-08 Marketing et controle de reseaux par application de methodes de neuro-informatique aux donnees de gestion de reseaux

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE19857335A DE19857335A1 (de) 1998-12-11 1998-12-11 Marketing und Controlling von Netzen durch Anwendung von Methoden der Neuroinformatik auf Netzmanagement-Daten
DE19857335.9 1998-12-11

Publications (2)

Publication Number Publication Date
WO2000036788A2 true WO2000036788A2 (fr) 2000-06-22
WO2000036788A3 WO2000036788A3 (fr) 2000-08-17

Family

ID=7890837

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/DE1999/003921 WO2000036788A2 (fr) 1998-12-11 1999-12-08 Marketing et controle de reseaux par application de methodes de neuro-informatique aux donnees de gestion de reseaux

Country Status (3)

Country Link
EP (1) EP1055309A2 (fr)
DE (1) DE19857335A1 (fr)
WO (1) WO2000036788A2 (fr)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2355621A (en) * 1999-07-30 2001-04-25 Hewlett Packard Co Writing log and diagnostic data in a policy-based network management (PBNM) system
EP1280298A1 (fr) * 2001-07-26 2003-01-29 BRITISH TELECOMMUNICATIONS public limited company Méthode et appareil de détection d'activité de réseau
WO2007000633A1 (fr) * 2005-06-29 2007-01-04 Nokia Corporation Evaluation de qualite pour reseau de telecommunications
GB2432685A (en) * 2005-10-26 2007-05-30 Agilent Technologies Inc Method of detecting an unsatisfactory quality of service
WO2008101859A1 (fr) * 2007-02-20 2008-08-28 Siemens Aktiengesellschaft Procédé d'exploitation d'un réseau de communication

Non-Patent Citations (5)

* Cited by examiner, † Cited by third party
Title
CATLEDGE L D ET AL: "Characterizing browsing strategies in the World-Wide Web" COMPUTER NETWORKS AND ISDN SYSTEMS,NL,NORTH HOLLAND PUBLISHING. AMSTERDAM, Bd. 27, Nr. 6, 1. April 1995 (1995-04-01), Seiten 1065-1073, XP004013208 ISSN: 0169-7552 *
HOOD C S ET AL: "PROBABILISTIC NETWORK FAULT DETECTION" GLOBAL TELECOMMUNICATIONS CONFERENCE (GLOBECOM),US,NEW YORK, IEEE, 18. November 1996 (1996-11-18), Seiten 1872-1876, XP000748773 ISBN: 0-7803-3337-3 *
LIU Y -C ; DOULIGERIS C : "Rate regulation with feedback controller in ATM - A neural network approach " IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS , Bd. 15, Nr. 2, 1. Februar 1997 (1997-02-01), Seiten 200-208, XP002138345 Areas Commun. (USA) *
See also references of EP1055309A2 *
TAK W Y ET AL: "From user access patterns to dynamic hypertext linking" COMPUTER NETWORKS AND ISDN SYSTEMS,NL,NORTH HOLLAND PUBLISHING. AMSTERDAM, Bd. 28, Nr. 11, 1. Mai 1996 (1996-05-01), Seiten 1007-1014, XP004018203 ISSN: 0169-7552 *

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2355621A (en) * 1999-07-30 2001-04-25 Hewlett Packard Co Writing log and diagnostic data in a policy-based network management (PBNM) system
EP1280298A1 (fr) * 2001-07-26 2003-01-29 BRITISH TELECOMMUNICATIONS public limited company Méthode et appareil de détection d'activité de réseau
WO2003013057A2 (fr) * 2001-07-26 2003-02-13 British Telecommunications Public Limited Company Procede et appareil de detection d'activite de reseau
WO2003013057A3 (fr) * 2001-07-26 2003-12-31 British Telecomm Procede et appareil de detection d'activite de reseau
WO2007000633A1 (fr) * 2005-06-29 2007-01-04 Nokia Corporation Evaluation de qualite pour reseau de telecommunications
GB2432685A (en) * 2005-10-26 2007-05-30 Agilent Technologies Inc Method of detecting an unsatisfactory quality of service
WO2008101859A1 (fr) * 2007-02-20 2008-08-28 Siemens Aktiengesellschaft Procédé d'exploitation d'un réseau de communication
EP1968234A1 (fr) * 2007-02-20 2008-09-10 Siemens Aktiengesellschaft Fonctionnement d'un réseau de communications
US8396818B2 (en) 2007-02-20 2013-03-12 Siemens Aktiengesellschaft Operating a communications network
CN101617501B (zh) * 2007-02-20 2013-04-24 西门子公司 对通信网络进行操作的方法、产品和系统

Also Published As

Publication number Publication date
EP1055309A2 (fr) 2000-11-29
DE19857335A1 (de) 2000-09-21
WO2000036788A3 (fr) 2000-08-17

Similar Documents

Publication Publication Date Title
DE69608108T2 (de) Mobiltelefon-missbrauch-erkennung
DE69637228T2 (de) Verfahren und vorrichtung zur messung der antwortzeit
EP0934567A1 (fr) Procede de classification de la dependance statistique d'une serie chronologique mesurable
DE102005020893A1 (de) System zur adaptiven Bestimmung von Operationseigenschaften einer ausführbaren Anwendung
DE19811097A1 (de) Simulator zur Simulation eines intelliegenten Netzwerks
DE60219821T2 (de) Verfahren und gerät zum wiedergewinnen von zeitreihedaten, die mit einer aktivität in beziehung stehen
DE69730130T2 (de) Betrugsüberwachung in einem fernmeldenetz
DE10337144A1 (de) Verfahren zur Aufzeichnung von Ereignis-Logs
DE19838055A1 (de) Kommunikationssystem
EP1055309A2 (fr) Marketing et controle de reseaux par application de methodes de neuro-informatique aux donnees de gestion de reseaux
DE102005055696A1 (de) Diskretes Wahlverfahren zum Melden und Vorhersagen mehrerer Transaktionstypen
DE19857336C1 (de) Verfahren zur Erfassung des Nutzungsverhaltens eines Teilnehmers im Internet/Intranet
EP0891069B1 (fr) Identification d'un appel frauduleux avec un réseau neuronal
EP1264253B1 (fr) Procede et dispositif pour la modelisation d'un systeme
EP1081665B1 (fr) Système expert
EP3961447A1 (fr) Procédé de détection des états de fonctionnement anormales d'un système informatique
DE19905884B4 (de) Verfahren zur Erkennung von kundenbezogenen Mißbräuchen von Dienstleistungen des Netzbetreibers mittels Online-Analyse von kundenbezogenen Datensätzen
EP1208541B1 (fr) Systeme expert
EP4227840B1 (fr) Dispositif de détection d'heure et/ou de présence, système, procédé de fonctionnement d'un dispositif de détection d'heure et/ou de présence, produit-programme informatique
DE69902726T2 (de) Verfahren und Gerät zur Identifizierung einer Leitungsblockierung
EP1725981A1 (fr) Procede et dispositif de prevision pour evaluer et prevoir des evenements stochastiques
EP1137218A1 (fr) Procédé et système pour tester des dispositifs de télécommunication
EP0891068A2 (fr) Détection d'appel frauduleux utilisant un réseau neuronal
EP3832512A1 (fr) Procédure d'apprentissage machine pour une analyse de protection des données
EP2453380A1 (fr) Dispositif et procédé pour empecher la saisie abusive d'évaluations et de traitement et de transfert de données

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A2

Designated state(s): US

AL Designated countries for regional patents

Kind code of ref document: A2

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE

121 Ep: the epo has been informed by wipo that ep was designated in this application
AK Designated states

Kind code of ref document: A3

Designated state(s): US

AL Designated countries for regional patents

Kind code of ref document: A3

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE

WWE Wipo information: entry into national phase

Ref document number: 1999967864

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 1999967864

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 09786420

Country of ref document: US

WWW Wipo information: withdrawn in national office

Ref document number: 1999967864

Country of ref document: EP