WO2023061568A1 - Devices and methods for root cause analysis in telecommunication networks - Google Patents

Devices and methods for root cause analysis in telecommunication networks Download PDF

Info

Publication number
WO2023061568A1
WO2023061568A1 PCT/EP2021/078267 EP2021078267W WO2023061568A1 WO 2023061568 A1 WO2023061568 A1 WO 2023061568A1 EP 2021078267 W EP2021078267 W EP 2021078267W WO 2023061568 A1 WO2023061568 A1 WO 2023061568A1
Authority
WO
WIPO (PCT)
Prior art keywords
root cause
cause analysis
data
analytics
producer
Prior art date
Application number
PCT/EP2021/078267
Other languages
French (fr)
Inventor
Narasimha Rao Pulipati
Chaitanya Aggarwal
Konstantinos Samdanis
Saurabh Khare
Original Assignee
Nokia Solutions And Networks Oy
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nokia Solutions And Networks Oy filed Critical Nokia Solutions And Networks Oy
Priority to PCT/EP2021/078267 priority Critical patent/WO2023061568A1/en
Publication of WO2023061568A1 publication Critical patent/WO2023061568A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0654—Management of faults, events, alarms or notifications using network fault recovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters

Definitions

  • Various example embodiments relate generally to devices, methods, and computer program products for root cause analysis in telecommunication networks.
  • Root cause analysis is a problem-solving method used to identify the root cause(s) of faults or problems or abnormal events occurring in a given device or system. RCA is used in various science and engineering fields such as telecommunications and industrial process control and accident analysis.
  • a telecommunication network is a system designed to transfer data from a network entity to one or more network entities.
  • Data transfer involves data collection, data switching, transmission media, and system controls in addition to hardware and/or software resources that need to be deployed for data storage and/or processing.
  • the architecture of telecommunication networks is logically separated into a plurality of planes (also referred to as ‘domains’) defining different areas of operations and carrying different types of traffic while being supported by the telecommunication network infrastructure.
  • the plurality of planes comprises at least a user plane, a control plane and a management plane.
  • the user plane also referred to as the ‘data plane’ or the ‘forwarding plane’ or ‘carrier plane’ or ‘bearer plane’
  • the control plane carries signaling traffic.
  • the management plane carries administrative traffic.
  • each device operable in the telecommunication network is adapted to perform operations in the plurality of planes, i.e. at least by processing the data traffic at the data plane and running the control plane and management plane protocols thereby producing respectively control plane and management plane data.
  • root cause analysis is performed separately at the different planes by analyzing the data collected at each plane separately.
  • the network experts perform root cause analysis at the control plane by analyzing the control plane data produced at the control plane, perform root cause analysis at the management plane by analyzing the management plane data produced at the management plane, and perform root cause analysis at the user plane by analyzing the user plane data produced at the user plane.
  • Performing root cause analysis considering each plane separately is suboptimal due at least to the increased time delays and the ping pong effects among the independent analysis performed separately at the different planes and the independent root cause analysis conclusions that are produced independently.
  • a root cause analysis service consumer operable in a telecommunication network comprising one or more entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane.
  • the root cause analysis service consumer comprises:
  • a root cause analysis service provider operable in a telecommunication network comprising one or more network entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane.
  • the root cause analysis service provider comprises:
  • the root cause analysis service provider comprises:
  • the collection and combined processing of root cause analysis data is coordinated by the root cause analysis service provider upon detecting one or more abnormal events at the management plane or at the control plane, the one or more abnormal events being detected at one or more network entities, the root cause analysis report comprising information for identifying the one or more entities.
  • the root cause analysis report comprises information related to the one or more abnormal events detected at the control plane or at the management plane and information related to one or more corrective actions for correcting the one or more abnormal events.
  • the root cause analysis service provider is a control plane data analytics producer and the data analytics producer is a management plane data analytics producer, the control plane data analytics producer comprising:
  • the triggering of the collection of root cause analysis data and the triggering of the generation of root cause analytics at the management plane depend further on load information and/or one or more exceptional conditions related to the one or more network entities.
  • the root cause analysis service provider is a management plane data analytics producer and the data analytics producer is a control plane data analytics producer, the management plane data analytics producer comprising: - means for receiving trigger information from the control plane data analytics producer, the trigger information indicating one or more abnormal events detected by the control plane analytics producer at the control plane;
  • the input data comprising the root cause analysis data collected by the management plane data analytics producer and root cause analytics generated by the control plane data analytics producer from the root cause analysis data collected by the control plane data analytics producer and
  • control plane data analytics producer is a network data analytics function and the management plane data analytics producer is a management data analytics function or a management data analytics service.
  • the root cause analysis data comprise at least measurements data generated by the one or more network entities, the measurements data being one or more of performance measurements data, communication measurements data, platform computing measurements data, and security-related measurements data.
  • the communication measurements data comprise traffic measurements data.
  • the platform computing measurements comprise information related to software activity and software resources used by the one or more network entities.
  • the security-related measurements data comprise information related to privileged user activity on the one or more network entities and information related to security mechanisms used in the one or more network entities.
  • a method for providing a root cause analysis service to a root cause analysis service consumer comprising:
  • a non-transitory computer-readable medium storing computer-executable instructions that, when executed by at least one processor at an apparatus, cause the apparatus to perform the method for providing a root cause analysis service to a root cause analysis service consumer.
  • the computer-executable instructions cause the apparatus to perform one or more or all steps of the method for providing a root cause analysis service to a root cause analysis service consumer.
  • a method for activating and consuming a root cause analysis service by a root cause analysis service consumer comprising:
  • a non-transitory computer-readable medium storing computer-executable instructions that, when executed by at least one processor at an apparatus, cause the apparatus to perform the method for activating and consuming the root cause analysis service by a root cause analysis service consumer.
  • the computer-executable instructions cause the apparatus to perform one or more or all steps of the method for activating and consuming the root cause analysis service by a root cause analysis service consumer.
  • a root cause analysis service consumer operable in a telecommunication network comprising one or more entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane.
  • the root cause analysis service consumer comprises at least one processor and at least one memory including computer program code.
  • the at least one memory and the computer program code are configured to, with the at least one processor, cause the root cause analysis service consumer to:
  • root cause analysis report from a root cause analysis service provider, the root cause analysis report being generated based on root cause analytics, the root cause analytics being generated by performing a collection of root cause analysis data from the one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing analytics in the control plane and the other being a management plane data analytics producer producing analytics in the management plane.
  • a root cause analysis service provider operable in a telecommunication network comprising one or more network entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane.
  • the root cause analysis service provider comprises at least one processor and at least one memory including computer program code.
  • the at least one memory and the computer program code are configured to, with the at least one processor, cause the root cause analysis service provider to:
  • root cause analytics by performing a collection of root cause analysis data from the one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane;
  • the at least one memory and the computer program code are configured to, with the at least one processor, cause the root cause analysis service provider to:
  • the root cause analysis service provider is a control plane data analytics producer and the data analytics producer is a management plane data analytics producer.
  • the control plane data analytics producer comprises at least one processor and at least one memory including computer program code. The at least one memory and the computer program code are configured to, with the at least one processor, cause the control plane data analytics producer to:
  • root cause analytics by processing input data, the input data comprising the root cause analysis data collected by the control plane data analytics producer and root cause analytics generated by the management plane data analytics producer from the root cause analysis data collected by the management plane data analytics producer, and
  • the root cause analysis service provider is a management plane data analytics producer and the data analytics producer is a control plane data analytics producer.
  • the management plane data analytics producer comprises at least one processor and at least one memory including computer program code. The at least one memory and the computer program code are configured to, with the at least one processor, cause the management plane data analytics producer to:
  • root cause analytics by processing input data, the input data comprising the root cause analysis data collected by the management plane data analytics producer and root cause analytics generated by the control plane data analytics producer from the root cause analysis data collected by the control plane data analytics producer, and
  • an apparatus comprising at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to perform:
  • root cause analysis report being generated based on root cause analytics
  • the root cause analytics being generated by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing analytics in the control plane and the other being a management plane data analytics producer producing analytics in the management plane.
  • an apparatus comprising at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to perform:
  • root cause analysis data by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the apparatus with a data analytics producer, one of the apparatus and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane;
  • FIG. 1 is a block diagram illustrating an exemplary telecommunication network implementing a root cause analysis service consumer and a root cause analysis service provider, according to some embodiments.
  • FIG. 2 is a connection flow illustrating an exemplary implementation of a root cause analysis service, according to some embodiments.
  • FIG. 3 is a connection flow illustrating an exemplary implementation of a proactive root cause analysis service, according to some embodiments.
  • FIG. 4 is a connection flow illustrating an exemplary implementation of a proactive root cause analysis service, according to some embodiments in which the root cause analysis service provider is a control plane data analytics producer.
  • FIG. 5 is a connection flow illustrating an exemplary implementation of a proactive root cause analysis service, according to some embodiments in which the root cause analysis service provider is a management plane data analytics producer.
  • FIG. 6 is a flowchart depicting a method for activating and consuming a root cause analysis service by a root cause analysis service consumer, according to some embodiments.
  • FIG. 7 is a flowchart depicting a method for providing a root cause analysis service by a root cause analysis service provider, according to some embodiments.
  • FIG 8 is a block diagram illustrating a data structure for storing data related to a root cause analysis report, according to some embodiments.
  • FIG. 9 is a block diagram illustrating an exemplary structure of a device operable in a telecommunication network, according to some embodiments.
  • FIG. 9 is a block diagram illustrating an exemplary structure of a device operable in a telecommunication network, according to some embodiments.
  • Exemplary embodiments provide devices, methods and computer program products enabling efficient cross-plane root cause analysis for identifying the root cause(s) of one or more abnormal events that occur at one or more network entity operable in a telecommunication network.
  • the telecommunication network has a multi-plane network architecture comprising a plurality of planes.
  • the plurality of planes comprises at least a user plane, a control plane and a management plane.
  • the telecommunication network is managed by a network operator.
  • An abnormal event designates any hardware or software fault or problem or abnormal behavior that happens at the one or more network entities.
  • An abnormal event can characterize the functioning of the one or more network entities and may occur due to an internal process within the network entity or due to an external actor that causes the event on the network entity for example in the case of software and/or hardware attacks on the one or more network entities.
  • the one or more abnormal events may be categorized into:
  • measured metrics comprise quality of service indicators (e.g. latency, call drop rate) and Key Performance Indicators (KPIs) such as throughput (uplink or downlink), Signal-to-Noise ratio, Signal to Interference plus Noise Ratio), User Equipment power Headroom, Channel Quality Indicator (uplink or downlink), bit rate (e.g. cell bit rate), and round trip time (uplink and downlink).
  • KPIs Key Performance Indicators
  • the operational behavior may be characterized by operational features or characteristics and/or by the performance of the network entity including for example the resource (e.g. storage and processing) consumption;
  • Exemplary abnormal events comprise, without limitation:
  • a network entity refers to any physical/hardware device or software function/functionality/application that is part of the telecommunication network and that produces data at the management plane and/or the control plane and/or the user plane.
  • Exemplary network entities comprise without limitation:
  • - end devices e.g. computers, laptops, tablets, mobile phones, robots, Internet of Things (loT) devices
  • loT Internet of Things
  • - network devices such as routers, switches, base stations (e.g. cellular base stations like eNodeB in LTE and LTE-advanced networks and gNodeB used in 5G networks, and femtocells used at homes or at business centers), control stations (e.g. radio network controllers, base station controllers, network switching sub-sustems), gateways, radio access network entities, core network devices, relay stations, and access points in local area networks or ad-hoc networks;
  • base stations e.g. cellular base stations like eNodeB in LTE and LTE-advanced networks and gNodeB used in 5G networks, and femtocells used at homes or at business centers
  • control stations e.g. radio network controllers, base station controllers, network switching sub-sustems
  • gateways e.g. radio access network entities, core network devices, relay stations, and access points in local area networks or ad-hoc networks
  • a network function/functionality may be virtualized.
  • Root cause analysis data designate the data used for root cause analysis.
  • the root cause analysis data comprise data produced at the different planes forming the logical operational architecture of the telecommunication network. Accordingly, the root cause analysis data comprises at least:
  • control data also referred to as ‘signaling data’
  • management data also referred to as ‘administrative data’
  • the root cause analysis data may comprise raw root cause analysis data and processed root cause analysis data.
  • Raw root cause analysis data designates data that is in its initial state as collected from its data source (that can be the network entities or other data sources operable in the telecommunication network and producing raw data such as sensors and loT devices) and that has not been yet processed or organized or visually presented.
  • Processed root cause analysis data designates data that has been converted or processed in any manner or transformed into information useful for further analysis and/or decision-making.
  • Exemplary processed root cause analysis data comprise statistics and data analytics.
  • the root cause analysis data comprises one or more of:
  • configuration data e.g. data identifying the hardware and/or software configuration of the one or more network entities
  • network description data e.g. network topology data, network configuration data, network activity data.
  • the measurements data comprise one or more of:
  • - network measurements data e.g. channel state measurements, quality of service measurements
  • the communication measurements data comprise traffic measurements data, network capacity measurements data, and data related to the communication/transmission protocols and ports.
  • traffic measurements data comprise measured current traffic rate.
  • a mean deviation of the current traffic rate with respect to a planned/expected traffic rate may be configured by the network operator such that the one or more network entities report the measured current traffic rates that exceed the mean deviation values.
  • the platform computing measurements comprise information related to software activity and software resources used by the one or more network entities including containerization data.
  • the information related to the software resources comprise open source and operating system related information and/or data comprising hypervisor related information/measurements and logs/data generated by the one or more network entities.
  • the open-source related information comprises a list of the used open source components and their release information. This information enables identifying critical bugs associated with the open-source components and predicting issues based on the vulnerable parts of the software that use the open source components.
  • the operating system related information comprises one or more of information related to the distribution of the operating system, information related to the release of the operating system, and information related to the configuration of the operating system.
  • the information related to the operating system release enables identifying bugs found in the release and their impacts on the performance or availability or the corresponding functionalities.
  • the information related to the operating system configuration enables identifying any misconfiguration to backtrack potential issues before they occur and/or to find root causes.
  • the hypervisor related measurements comprise statistics (e.g. number of active connection openings, number of passive connection openings, number of failed connection attempts) related to used internet protocols (e.g. Transmission Control Protocol or TCP, Internet Protocol or IP, Internet Message Control Protocol or IMCP, and User Datagram Protocol or UDP) collected by the operating system.
  • statistics e.g. number of active connection openings, number of passive connection openings, number of failed connection attempts
  • used internet protocols e.g. Transmission Control Protocol or TCP, Internet Protocol or IP, Internet Message Control Protocol or IMCP, and User Datagram Protocol or UDP
  • the system activity information comprises information related to the network activity and processor usage, the queue, the load, the swap, the storage resources, and the memory usage.
  • the security-related measurements data comprise one or more of information related to privileged user activity on the one or more network entities and information related to security mechanisms used in the one or more network entities.
  • the information related to privileged user activity enables identifying any suspicious activity originating from a suspicious user that has violated the access rules established through access controls and role-based access.
  • the security mechanisms refer to any hardware and/or software-based protocols, algorithms, methods used to provide confidentiality, integrity, authenticity, and non-repudiation services to the one or more network entities. This includes protecting the one or more network entities against any security-related attack and protecting the data stored and/or processed by the one or more network entities during its storage, processing, or transit. Exemplary security- related mechanisms comprise key-based cryptographic algorithms.
  • the root cause analysis data is sent by the one or more network entities in one or more formats including text formats, image formats, and multimedia formats.
  • the security-related measurements are sent by the one or more network entities in an image format. More specifically, the security-related measurements are sent in a container image that is associated with metadata enabling the entities receiving the security- related measurements to understand the content of the image container and to know how to handle it.
  • a container image is a static file that can not be modified. It comprises executable code to run in isolated process in a given information technology infrastructure.
  • the container image comprises libraries and system tools and other platform settings that are needed to run a software program in a containerization platform.
  • the container image may be created using a build command in a container platform and may be incrementally updated to add features, fix bugs or modify the content.
  • the container image may be created automatically using a continuous integration tool.
  • Scanning the container images enables identifying software vulnerabilities in the container images.
  • Scanning the container images consists in scanning all the files used in building the container image.
  • the container images scan provides a list of scan findings also referred to as a container image scan report.
  • the container image scan report lists all the software vulnerabilities identified in the container image. Each identified software vulnerability is associated with metadata comprising information related to the software vulnerability.
  • the metadata comprises one or more pieces of:
  • a status of the software vulnerability e.g. approved status
  • a severity level e.g. high, medium, low
  • information related to the software package on which the software vulnerability is detected comprises for example a package name and a package version.
  • a security report includes the vulnerabilities detected for a software running in a container or in a virtual machine or in a baremetal node.
  • the security scan report comprises a list of all the vulnerabilities that are detected.
  • Each detected vulnerability may be associated with metadata comprising information related to the vulnerability.
  • the metadata comprises one or more pieces of :
  • the expected operation configuration comprises one or more of:
  • the cross-plane root cause analysis according to the various embodiments disclosed herein relies on an aggregated collection and a combined processing of the root cause analysis data. More specifically, the cross-plane root cause analysis according to the various embodiments disclosed herein is based on data analytics that enables converting the input root cause analysis data produced at the different planes into information (also referred to as ‘root cause analytics’) that can be processed interpreted and used for detailed analysis.
  • root cause analytics also referred to as ‘root cause analytics’
  • Root cause analysis is defined according to a service-oriented approach described as an interaction between a root cause analysis service consumer and a root cause analysis service provider.
  • the root cause analysis service consumer requests root cause analysis services or operations from the root cause analysis service provider by sending a request for root cause analysis to the root cause analysis service provider.
  • the root cause analysis service provider generates root cause analytics from input data comprising the root analysis data and generates a root cause analysis report based on the root cause analytics and provides the root cause analysis report to the root cause analysis service consumer.
  • the root cause analysis report enables identifying the root causes of any abnormal event occurring in the telecommunication network and comprises one or more corrective actions recommended to correct the abnormal event and avoid that the abnormal event happens again.
  • the interaction between the root cause analysis service consumer and the root cause analysis service provider may use a request or subscription model and servicebased interfaces.
  • the aggregated collection and combined processing of the root cause analysis data is coordinated, according to the various embodiments, by the root cause analysis service provider that has received a request for the root cause analysis service from the root cause analysis service consumer.
  • the root cause analysis service provider orchestrates/coordi nates the collection and the combined processing of the root cause analysis data with a data analytics producer such that one of the root cause analysis service provider and the data analytics producer is a control plane data analytics configured to produce root cause analytics at the control plane and the other is a management plane data analytics configured to produce root cause analytics at the management plane.
  • the root cause analysis data which is produced at all the planes forming the plurality of planes of the network architecture, including the user plane, the control plane and the management plane, is processed at the control plane and the management plane by a control plane data analytics entity and a management plane data analytics entity.
  • the control plane data analytics producer At the control plane, the control plane data analytics producer generates root cause analytics from the root cause analysis data and at the management plane, the management plane data analytics producer generates root cause analytics from the root cause analysis data.
  • the root cause analysis service producer which is either a control plane data analytics producer or a management plane data analytics producer
  • the data analytics producer which is either a management plane data analytics producer or a control plane data analytics producer
  • the various embodiments disclosed herein provide thus a production of a root cause analysis report from root cause analytics generated at the control plane and at the management plane such that the collection of the root cause analysis data and the processing of the root cause analysis data for producing combined root cause analytics is coordinated/orchestrated by the root cause analysis service provider, i.e. by the data analytics producer (at the management or control plane) that has been requested by the root cause analysis service consumer to provide the root cause analysis service.
  • FIG. 1 illustrates an exemplary telecommunication network 100 in which exemplary embodiments may be implemented.
  • the telecommunication network 100 may be a digital system part of a communication system, a data processing system, or a data storage system.
  • Exemplary digital systems comprise, without limitations:
  • radio communication systems e.g. radio communication systems, wireless communication systems, optical fiber-based communication systems, optical wireless communication systems, satellite communication systems
  • - storage systems e.g. cloud computing systems
  • the telecommunication network 100 may be or may comprise:
  • wired network e.g. optical fiber-based networks
  • a wireless network e.g. radio communication networks
  • an acoustic network e.g. underwater acoustic communication systems
  • the telecommunication network 100 may be any wireless network involving any type of wireless propagation medium suitable for this type of connectivity.
  • Exemplary wireless communication networks comprise, without limitation, ad-hoc wireless networks used in local area communications, wireless sensor networks, and radio communication networks (e.g. Long Term Evolution or LTE, LTE-advanced, 3G/4G/5G and beyond).
  • Exemplary applications to wireless networks comprise:
  • M2M Machine-To-Machine
  • D2D Device-To-Device
  • loT Internet of Things
  • loT for example vehicle-to-everything communications
  • the telecommunication network 100 may be a wireless loT network representing low energy power-consumption/long battery life/low-latency/low hardware and operating cost/high connection density constraints such as low-power wide area networks and low-power short-range loT networks.
  • the telecommunication network 100 may be any wireless network enabling loT in licensed or license-free spectrum.
  • Exemplary wireless technologies used in loT applications may comprise:
  • - short range wireless networks e.g. Bluetooth mesh networking, Light-Fidelity, Wi-FiTM, and Near-Field communications
  • - medium range wireless networks e.g. LTE-advanced, Long Term Evolution-Narrow Band, NarrowBand loT
  • LPWANs Low-Power Wide Area Networks
  • Very small aperture terminal e.g., Wi-FiTM connectivity
  • LPWANs Low-Power Wide Area Networks
  • Wi-FiTM connectivity e.g. Wi-Fi
  • Exemplary applications of M2M and loT applications comprise, without limitation:
  • the telecommunication network 100 may be any data network in which any optical fiber link is designed to carry data over short or long distances.
  • Exemplary applications using optical fiber links over short distances comprise high-capacity networks such as data center interconnections.
  • Exemplary applications using optical fiber links over long distances comprise terrestrial and transoceanic transmissions.
  • network data generated by the network elements operable in the telecommunication network 100 may be carried by optical signals polarized according to the different polarization states of the optical fiber. The optical signals propagate along the fiberbased link according to one or more propagation modes.
  • Exemplary applications of optical fiber data networks comprise, without limitation, aerospace and avionics, data storage (e.g. in cloud computing systems, automotive, industry, and transportation). Such applications may involve transfer of voice (e.g. in telephony), data (e.g. data supply to homes and offices known as fiber to the home), images or video (e.g. transfer of internet traffic), or connection of networks (e.g. connection of switches or routers and data center connectivity in high-speed local area networks).
  • voice e.g. in telephony
  • data e.g. data supply to homes and offices known as fiber to the home
  • images or video e.g. transfer of internet traffic
  • connection of networks e.g. connection of switches or routers and data center connectivity in high-speed local area networks.
  • the root cause analysis service provider 102 is configured to:
  • the data analytics producer 103 is configured to:
  • discovery and selection procedures may be performed before establishing any communication link between the entities operable in the telecommunication network 100.
  • the root cause analysis service consumer 101 may perform discovery and selection procedures to select the root cause analysis service provider 102 that supports the requested root cause analysis service and the required root cause data analytics capabilities.
  • the root cause analysis service provider 102 may perform discovery and selection procedures to select the data analytics producer 103 that supports the requested root cause data analytics and the required root cause analytics production capabilities.
  • the root cause analysis service provider 102 and the data analytics producer 103 may perform discovery and selection procedures to select the one or more entities 104-i that support the required root cause data collection service.
  • Discovery and selection procedures may be performed using the methods defined in 3GPP standards and are not detailed in the present disclosure.
  • the root cause analysis service provider 102 corresponds to the (control plane or management plane) root cause analysis service provider selected by the root cause analysis consumer 101 during the discovery and selection phase
  • the data analytics producer 103 corresponds to the (management plane or the control plane) data analytics producer selected by the root cause analysis service provider 102 during the discovery and selection phase.
  • the discovery and selection procedures may comprise authentication steps for example to authenticate the root cause analysis consumer 101 and/or to authenticate the root cause analysis service provider 102 and/or to authenticate the data analytics producer 103.
  • the root cause analysis consumer 101 may be any network entity requiring the analysis of the causes of one or more abnormal events occurring at one or more entities in order to perform or to enable the network operator to perform one or more corrective actions.
  • a corrective action may be performed to correct the one or more abnormal events and/or prevent that the one or more abnormal events occur again and/or to provide insights that can be used for the optimization of the network for operational and cost efficiency and/or to find out irregularities and prevent undesired scenarios.
  • the root cause analysis service consumer 101 may implemented as a part of a network entity (hardware or software) in which one or more abnormal events occurred and triggers a root cause analysis service from the root cause analysis service provider in order to identify the cause(s) of the one or more abnormal events.
  • the root cause analysis consumer 101 is or is implemented as a part of an Operation, Administration and Management (OAM) service of the network operator or as a part of a security management entity.
  • OAM Operation, Administration and Management
  • a network entity is network function (e.g. hardware network functions, softwarized network functions, virtualized network functions) deployed on the access network, the transport network, or the core network.
  • network function e.g. hardware network functions, softwarized network functions, virtualized network functions
  • Exemplary network functions comprise, without limitation:
  • control plane data analytics producer is a network data analytics function (NWDAF) defined in current 3GPP standards as a part of the 5G core network and used for performing data collection and providing network analytics information.
  • NWDAAF network data analytics function
  • the management plane data analytics producer is a management data analytics function (MDAF) or a management data analytics service (MDAS).
  • MDAF management data analytics function
  • MDAS management data analytics service
  • the MDAS is defined in current 3GPP standards as a management entity configured to provide management data analytics to support network management and orchestration at the Radio Access Network level or at the Core Network level.
  • FIG. 2 is a connection flow illustrating a root cause analysis service, according to some embodiments.
  • the root cause analysis service is triggered by the root cause analysis service consumer 101 that sends a request for root cause analysis, in step 200, to the root cause data analysis service provider 102.
  • the root cause analysis service may be a proactive or reactive.
  • Proactive root cause analysis service refers to a root cause analysis service that is triggered by the root cause analysis service consumer 101 in a proactive manner, i.e. before any abnormal event is detected.
  • the root cause analysis service consumer 101 may trigger a proactive root cause analysis service to monitor one or more specific network entities 104-i such that as soon as an abnormal event is detected at these network entities 104-i, root cause analysis is performed to identify the root causes of the detected abnormal event.
  • Reactive root cause analysis service refers to a root cause analysis service that is triggered by the root cause analysis service consumer 101 in reaction to the detection or the identification, for example by the root cause analysis service consumer 101 , of one or more abnormal events. This happens for example when the root cause analysis service consumer 101 is implemented as a part of a network function or a management entity or service and one or more abnormal events occur or are detected at or by the network function or at or by the management entity.
  • the root cause analysis service consumer 101 may trigger a reactive root cause analysis service from the root cause analysis service provider 101 upon the detection of one or more abnormal events such as:
  • the metric thresholds may be configured at the root cause analysis service consumer 101 so that the root cause analysis service consumer 101 is able to detect or identify any abnormal metric threshold event when one or more measured metrics deviate from the configured metric thresholds.
  • the reactive root cause analysis service is triggered by the root cause analysis service consumer 101 according to a request for security assessment and/or for operational behavior assessment in relation with the one or more network entities 104-i.
  • the request for security assessment and/or for operational behavior assessment (not illustrated in FIG. 2) may be triggered by a security management entity or by the one or more network entities 104-i that sends a request for a security assessment and/or operational behavior assessment to the root cause analysis service consumer 103.
  • the request for security assessment and/or for operational behavior assessment is triggered (by the one or more network entities 104-i or by a security management entity) depending on performance measurements associated with the one or more network entities 104-i.
  • the security assessment and/or operational behavior assessment is triggered depending on variation on one or more Key Performance Indicators associated with the one or more network entities 104-i.
  • the request for root cause analysis comprises analytics service information indicating specifications related to the root cause analytics based on which the root cause analysis report will be generated.
  • the analysis service information comprises information that enable identifying a usage of the data analytics and/or characterizing the generation and the delivery of the data analytics.
  • the information related to the data analytics comprises one or more piece of the information listed below:
  • the request for root cause analysis may comprise additional information that depends on whether the requested root cause analysis service is proactive or reactive.
  • the request for root cause analysis may further comprise additional information related to a monitoring period during which the one or more network entities 104-i are supervised by the root cause analysis service provider 102 and/or the data analytics producer 103 to detect one or more abnormal events.
  • the additional information may further comprise information related to one or more specific or target network entities 104-i that are to be monitored for the detection of abnormal events.
  • the information related to the one or more target network entities 104-i comprises one or more pieces of the information listed below:
  • the root cause analysis service provider 102 coordinates, at step 201 , the collection and the combined processing of root cause analysis data with the data analytics producer 103. Coordinating the collection and the combined processing of the root cause analytics data consists in setting a root cause analysis mechanism that specifies: - when the root cause analysis service provider 102 and the data analytics producer 103 start collecting the root cause analysis data from the one or more network entities 104-i;
  • the root cause analysis service provider 102 defines the root cause analysis mechanism and informs the data analytics producer 103 about it. This enables the coordination of the collection of root cause analysis data across the control and management planes and the coordination of the correlation of the root cause analysis data collected at the different planes for producing a single root cause analysis report based on root cause analytics generated by performing a combined processing of the root cause analysis data.
  • the root cause analysis service provider 102 sends:
  • a request for root cause analysis data to the one or more network entities 104-i, for i varying from 1 to N.
  • the data analytics producer 103 receives root cause analysis data from the one or more network entities 104-i.
  • the data analytics producer 103 generates root cause analytics from the root cause analysis data it received at step 204.
  • the data analytics producer 103 sends then the generated root cause analytics to the root cause analysis service provider 102 at step 206.
  • the root cause analysis service provider 102 receives root cause analysis data from the one or more network entities 104-i and at step 208, the root cause analysis service provider 102 generates root cause analytics by processing input data, the input data comprising at least: - the root cause analysis data collected and received from the one or more network entities 104-i at step 207, and
  • the root cause analysis service provider 102 is configured to produce root cause analytics according to the specifications and information related to the root cause analytics comprised in the request for root cause analysis received from the root cause analysis service consumer 101 and to generate a root cause analysis report based on the generated root cause analytics.
  • the root cause analysis service provider 102 is configured to process the input data by performing a processing operation comprising data aggregation, data de-duplication, and/or data categorization.
  • the processing operation uses a training-based algorithm or model such as artificial intelligence/machine learning algorithms.
  • the training-based algorithm takes as input the input data and delivers as output the root cause analytics.
  • the training-based algorithm is a supervised machine learning algorithm.
  • supervised machine learning algorithms comprise, without limitation, Support Vector Machines (SVM), linear regression, logistic regression, naive Bayes, linear discriminant analysis, decision trees, k-nearest neighbor algorithm, neural networks, and similarity learning.
  • the root cause analysis service provider 102 sends a response on the request for root cause analysis to the root cause analysis service consumer 101 , the response comprising the root cause analysis report.
  • the response to the request for root cause analysis comprises the generated root cause analytics and information related to the generated analytics.
  • the information related to the analytics comprise one or more pieces of the information listed below:
  • an analytics type specifying the type of the generated root cause analytics (e.g. statistics, predictions, recommendation);
  • the root cause analysis report comprises at least information related to the one or more abnormal events detected (at the control plane or the management plane) on one or more network entities 104-i, information enabling identifying the one or more network entities 104-i, information specifying the one or more abnormal events, and information specifying one or more corrective actions for correcting the one or more abnormal events.
  • the root cause analysis report comprises one or more pieces of the information listed below:
  • - affected locations specifying the geographical areas (e.g. the list of cells) where one or more abnormal events have been detected;
  • - affected network entities specifying the lists of the one or more network entities that were affected by the one or more abnormal events.
  • root cause or root alarm identified or predicted by root cause decision model (e.g. alarms of virtualized resource failure and alarms on faults in a network function);
  • a severity level specifying the severity level (e.g. critical, medium, not important) of the detected abnormal event
  • the recommended actions may comprise replacing one or more hardware units, reconfiguring one or more protocols;
  • cross-plane triggers specifying the alarms that trigger cross-plane root cause analysis according to the root cause analysis mechanism. This information may indicate suspected network entities.
  • step 201 The coordination of the collection and combined processing performed at step 201 depends on whether the requested root cause analysis service is proactive or reactive.
  • FIG. 3 is a connection flow illustrating a proactive root cause analysis service, according to some embodiments.
  • the proactive root cause analysis service is triggered by the root cause analysis consumer 101 in order to supervise the one or more entities and to identify, actively, the root cause(s) of any abnormal event that happens after the root cause analysis requests is sent.
  • the root cause analysis service consumer 101 triggers a proactive root cause analysis service by sending a request for root cause analysis to the root cause analysis service provider 102.
  • Step 300 is similar to step 200 described in relation with FIG. 2.
  • the root cause analysis service provider 102 defines a root cause analysis mechanism according to which it will coordinate the collection and the combined processing of the root cause analysis data with the data analytics producer 103.
  • Step 301 may comprise:
  • step 301 -a during which the root cause analysis service provider 102 sends to the data analytics producer 103 information related to the defined root cause analysis mechanism;
  • step 301 -b during which the root cause analysis service provider 102 receives from the data analytics producer 103 trigger information according to which the root cause analysis service provider 102 triggers the collection of root cause analysis from the one or more network entities 104-i and the production of root cause analytics at the data analytics producer 103 such that the combined processing of the root cause analysis data collected at the management plane and the control plane is performed by the root cause analysis service provider 102.
  • the information related to the defined root cause analysis mechanism sent to the data analytics producer in step 301 -a may comprise one or more of:
  • information related to one or more performance metrics or one or more performance indicators to be measured for detecting an abnormal metric threshold event comprising one or more metric thresholds or performance indicator thresholds; information related to one or more operational behavior (e.g. resource consumption/utilization) and thresholds enabling detecting an abnormal operational behavior on one or more network entities.
  • the information related to the defined root cause analysis mechanism enables the detection, at the control plane or the management plane, of one or more abnormal events occurring on one or more network entities 104-i.
  • the data analytics producer 103 sends the trigger information to the root cause analysis service provider 102 upon detecting one or more abnormal events at the control plane or the management plane (depending on whether the data analytics producer 103 is a control plane data analytics producer or a management plane data analytics producer).
  • the trigger information indicates the one or more abnormal events detected by the data analytics producer 103 (at the control plane or at the management plane).
  • the root cause analysis service provider 102 triggers the collection of root cause analysis data at step 303 and triggers the generation of root cause analytics by the data analytics producer 103 at step 302 depending at least on the trigger information received from the data analytics producer 103 at step 301 -b.
  • Steps 302 to 309 are similar to steps 202 to 209 described in relation with FIG. 2.
  • FIG. 4 is a connection flow illustrating a proactive root cause analysis service, according to some embodiments in which the root cause analysis service provider 102 is a control plane data analytics producer 102 and the data analytics producer 103 is a management plane data analytics producer 103.
  • Steps 400 and 402 to 409 are similar to steps 300 and 302 to 309 described in relation with FIG. 3.
  • control plane data analytics producer 102 defines a root cause analysis mechanism according to which it will coordinate the collection and the combined processing of the root cause analysis data with the management plane data analytics producer 103.
  • Step 401 comprises:
  • step 401 -a during which the control plane data analytics producer 102 sends to the management plane data analytics producer 103 information related to the defined root cause analysis mechanism
  • step 401 -b during which the control plane data analytics producer 102 receives from the management plane data analytics producer 103 trigger information according to which the root control plane data analytics producer 102 triggers the collection of root cause analysis from the one or more network entities 104-i and the production of root cause analytics at the management plane data analytics producer 103 such that the combined processing of the root cause analysis data collected at the management plane and the control plane is performed by the control plane data analytics producer 102.
  • the trigger information received by the control plane data analytics producer 102 at step 401 -b from the management plane data analytics producer 103 indicates one or more abnormal events detected by the management plane data analytics producer 103 at the management plane.
  • the control plane data analytics producer 102 triggers the collection of root cause analysis data at step 403 and triggers the generation of root cause analytics by the management plane data analytics producer 103 at step 402 depending at least on the trigger information received from the management plane data analytics producer 103 at step 401 -b.
  • the control plane data analytics producer 102 generates root cause analytics and generates a root cause analysis report based on the generated root cause analytics.
  • the root cause analytics are generated by processing input data, the input data comprising:
  • the root cause analytics generated by the management plane data analytics producer 103 at step 405 from the root cause analysis data collected and received by the management plane data analytics producer 103 at step 404.
  • control plane data analytics producer 102 triggers the collection of root cause analysis data and the generation of root cause analytics at the management plane (by the management plane data analytics producer 103) depending further on load information and/or one or more exceptional conditions related to the one or more network entities 104-i.
  • FIG. 5 is a connection flow illustrating a proactive root cause analysis service, according to some embodiments in which the root cause analysis service provider 102 is a management plane data analytics producer 102 and the data analytics producer 103 is a control plane data analytics producer 103.
  • Steps 500 and 502 to 509 are similar to steps 300 and 302 to 309 described in relation with FIG. 3.
  • Step 501 the management plane data analytics producer 102 defines a root cause analysis mechanism according to which it will coordinate the collection and the combined processing of the root cause analysis data with the control plane data analytics producer 103.
  • Step 501 comprises:
  • step 501 -a during which the management plane data analytics producer 102 sends to the control plane data analytics producer 103 information related to the defined root cause analysis mechanism
  • step 401 -b during which the management plane data analytics producer 102 receives from the control plane data analytics producer 103 trigger information according to which the management plane data analytics producer 102 triggers the collection of root cause analysis from the one or more network entities 104-i and the production of root cause analytics at the control plane data analytics producer 103 such that the combined processing of the root cause analysis data collected at the management plane and the control plane is performed by the management plane data analytics producer 102.
  • the trigger information received by the management plane data analytics producer 102 at step 501 -b from the control plane data analytics producer 103 indicates one or more abnormal events detected by the control plane data analytics producer 103 at the control plane.
  • the management plane data analytics producer 102 triggers the collection of root cause analysis data at step 503 and triggers the generation of root cause analytics by the control plane data analytics producer 103 at step 502 depending at least on the trigger information received from the control plane data analytics producer 103 at step 501 -b.
  • the management plane data analytics producer 102 generates root cause analytics and a root cause analysis report based on the root cause analytics.
  • the root cause analytics are generated by processing input data, the input data comprising:
  • FIG. 6 is a flowchart depicting a method for activating and consuming a root cause analysis service by a root cause analysis service consumer 101 , according to some embodiments.
  • a request for root cause analysis is sent to a root cause analysis service provider.
  • a response on the request for root cause analysis is received from the root cause analysis service provider, the response comprising a root cause analysis report.
  • FIG. 7 is a flowchart depicting a method for providing a root cause analysis service by a root cause analysis service provider 102, according to some embodiments.
  • a request for root cause analysis is received from a root cause analysis service consumer.
  • the collection and combined processing of root cause analysis data is coordinated by a root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing data analytics at the control plane and the other one being a management plane data analytics producer producing data analytics at the management plane.
  • a root cause analysis report is generated based on root cause analytics that are generated by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data at the root cause analysis service provider.
  • a response on the request for root cause analysis is sent to the root cause analysis service consumer, the response on the request for root cause analysis comprising the generated root cause analysis report.
  • FIG 8 is a block diagram illustrating a data structure 800 used for storage of data related to a root cause analysis report, according to some embodiments.
  • the data structure 800 may be of any data organization, management and storage format that enables access to and/or modification of stored data.
  • Exemplary data structures comprise arrays, linked lists, records, and objects.
  • the data structure 800 comprises data fields (also referred to as ‘data elements’). Each data field comprises an attribute field and a value field.
  • the data fields comprise data fields 801 related to the root cause analytics and fields 802 related to the detected one or more abnormal events.
  • the data fields 801 comprise:
  • the data fields 802 comprise:
  • root cause or root alarm a fifth data field of attribute ‘root cause or root alarm’ and of a value specifying alarms identified or predicted by root cause decision model (e.g. alarms of virtualized resource failure and alarms on faults in a network function);
  • Each described computation function, block, step can be implemented in hardware, software, firmware, middleware, microcode, or any suitable combination thereof. If implemented in software, the computation functions, blocks of the block diagrams and/or flowchart illustrations can be implemented by computer program instructions I software code, which may be stored or transmitted over a computer-readable medium, or loaded onto a general purpose computer, special purpose computer or other programmable processing apparatus and I or system to produce a machine, such that the computer program instructions or software code which execute on the computer or other programmable apparatus, create the means for implementing the functions described herein.
  • the program code or code segments to perform the necessary tasks may be stored in a machine or computer readable medium such as a computer readable storage medium.
  • a processor or processors will perform the necessary tasks.
  • at least one memory may include or store computer program code
  • the at least one memory and the computer program code may be configured to, with at least one processor, cause an apparatus to perform the necessary tasks.
  • the processor, memory and example algorithms, encoded as computer program code serve as means for providing or causing performance of operations discussed herein.
  • the functions described here for the root cause analysis service consumer may be performed by a corresponding apparatus.
  • the functions described here for the root cause analysis service provider may be performed by a corresponding apparatus.
  • the functions described here for the data analytics producer may be performed by a corresponding apparatus.
  • block denoted as "means configured to” perform a certain function or “means for” performing a certain function shall be understood as functional blocks comprising circuitry that is adapted for performing or configured to perform a certain function.
  • a means being configured to perform a certain function does, hence, not imply that such means necessarily is performing said function (at a given time instant).
  • any entity described herein as “means”, may correspond to or be implemented as “one or more modules", “one or more devices”, “one or more units”, etc.
  • the functions may be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which may be shared.
  • processor or “controller” should not be construed to refer exclusively to hardware capable of executing software, and may implicitly include, without limitation, digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), read only memory (ROM) for storing software, random access memory (RAM), and non-volatile storage.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • ROM read only memory
  • RAM random access memory
  • non-volatile storage non-volatile storage.
  • Other hardware conventional or custom, may also be included. Their function may be carried out through the operation of program logic, through dedicated logic, through the interaction of program control and dedicated logic, or even manually, the particular technique being selectable by the implementer as more specifically understood from the context.
  • circuit or “circuitry” may refer to one or more or all of the following:
  • combinations of hardware circuits and software such as (as applicable) : (i) a combination of analog and/or digital hardware circuit(s) with software/firmware and (ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions); and
  • circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and/or firmware.
  • circuitry also covers, for example and if applicable to the particular claim element, an integrated circuit for a network element or network node or any other computing device or network device.
  • circuitry may cover digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), etc.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • the “circuit” or “circuitry” may be or include, for example, hardware, programmable logic, a programmable processor that executes software or firmware, and/or any combination thereof (e.g. a processor, control unit/entity, controller) to execute instructions or software and control transmission and receptions of signals, and a memory to store data and/or instructions.
  • the “circuit” or “circuitry” may also make decisions or determinations, generate frames, packets or messages for transmission, decode received frames or messages for further processing, and other tasks or functions described herein.
  • the circuitry may control transmission of signals or messages over a radio network, and may control the reception of signals or messages, etc., via a radio network (e.g., after being down-converted by radio transceiver, for example).
  • the term “storage medium,” “computer readable storage medium” or “non-transitory computer readable storage medium” may represent one or more devices for storing data, including read only memory (ROM), random access memory (RAM), magnetic RAM, core memory, magnetic disk storage mediums, optical storage mediums, flash memory devices and/or other tangible machine-readable mediums for storing information.
  • ROM read only memory
  • RAM random access memory
  • magnetic RAM magnetic RAM
  • core memory magnetic disk storage mediums
  • optical storage mediums optical storage mediums
  • flash memory devices and/or other tangible machine-readable mediums for storing information.
  • computer-readable medium may include, but is not limited to, portable or fixed storage devices, optical storage devices, and various other mediums capable of storing, containing or carrying instruction(s) and/or data.
  • the methods and devices described herein may be implemented by various means. For example, these techniques may be implemented in hardware, software, or a combination thereof.
  • the processing elements of the different network elements operating in the telecommunication network 100 can be implemented for example according to a hardware-only configuration (for example in one or more FPGA, ASIC, or VLSI integrated circuits with the corresponding memory) or according to a configuration using both VLSI and Digital Signal Processor (DSP).
  • DSP Digital Signal Processor
  • FIG. 9 is a block diagram representing an exemplary hardware/software architecture of a device 900 operating in the telecommunication network 100 such as the root cause analysis service consumer 101 , the root cause analysis service provider 102, the data analytics producer 103, and the network entities 104-i, according to some embodiments.
  • the architecture may include various computing, processing, storage, communication, and displaying units comprising:
  • - communication circuitry comprising a transceiver 902 (e.g. wireless or optical transceiver) configured to connect the device 900 to corresponding links in the telecommunication network 100, and to ensure transmission/reception of data and/or signals.
  • the communication circuitry may support various network and air interface such as wired, optical fiber, and wireless networks;
  • the processing unit 903 configured to execute the computer-executable instructions to run the methods and algorithms according to the various embodiments and perform the various required functions of the device such as data analytics production and any functionalities required to enable the device 900 to operate in the telecommunication network 100 according to the various embodiments.
  • the processing unit 902 may be a general purpose processor, a special purpose processor, a DSP, a plurality of microprocessors, a controller, a microcontroller, an ASIC, an FPGA circuit, any type of integrated circuit, and the like;
  • a power source 904 that may be any suitable device providing power to the device 900 such as dry cell batteries, solar cells, and fuel cells;
  • a localization unit 905 such as a GPS chipset implemented in applications that require information indicating the location of the device 900;
  • a storage unit 906 possibly comprising a random access memory (RAM) or a read-only memory used to store data (e.g. root cause analysis data) and any data required to perform the functionalities of the device 900 according to the embodiments;
  • RAM random access memory
  • read-only memory used to store data (e.g. root cause analysis data) and any data required to perform the functionalities of the device 900 according to the embodiments;
  • Output peripherals 908 comprising communication means such as displays enabling for example man-to-machine interaction between the device 900 and the telecommunication network 100 administrator for example for configuration and/or maintenance purposes.
  • the architecture of the device 900 may further comprise one or more software and/or hardware units configured to provide additional features, functionalities and/or network connectivity.
  • the methods described herein can be implemented by computer program instructions supplied to the processor of any type of computer to produce a machine with a processor that executes the instructions to implement the functions/acts specified herein.
  • These computer program instructions may also be stored in a computer-readable medium that can direct a computer to function in a particular manner. To that end, the computer program instructions may be loaded onto a computer to cause the performance of a series of operational steps and thereby produce a computer implemented process such that the executed instructions provide processes for implementing the functions specified herein.
  • the program comprises instructions stored on the computer-readable storage medium that, when executed by a processor, cause the processor to:
  • - generate a root cause analytics by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by a root cause analytics service provider with a data analytics producer, one of the root cause analytics service provider and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

A root cause analysis service consumer (101) comprising: - means for receiving a root cause analysis report from a root cause analysis service provider (102), the root cause analysis report being generated based on root cause analytics generated by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider (102) with a data analytics producer (103), one of the root cause analysis service provider (102) and the data analytics producer (103) being a control plane data analytics producer and the other being a management plane data analytics producer.

Description

DEVICES AND METHODS FOR ROOT CAUSE ANALYSIS IN TELECOMMUNICATION NETWORKS
TECHNICAL FIELD
[0001] Various example embodiments relate generally to devices, methods, and computer program products for root cause analysis in telecommunication networks.
BACKGROUND
[0002] Root cause analysis (RCA) is a problem-solving method used to identify the root cause(s) of faults or problems or abnormal events occurring in a given device or system. RCA is used in various science and engineering fields such as telecommunications and industrial process control and accident analysis.
[0003] A telecommunication network is a system designed to transfer data from a network entity to one or more network entities. Data transfer involves data collection, data switching, transmission media, and system controls in addition to hardware and/or software resources that need to be deployed for data storage and/or processing.
[0004] The architecture of telecommunication networks is logically separated into a plurality of planes (also referred to as ‘domains’) defining different areas of operations and carrying different types of traffic while being supported by the telecommunication network infrastructure. [0005] In general, the plurality of planes comprises at least a user plane, a control plane and a management plane. The user plane (also referred to as the ‘data plane’ or the ‘forwarding plane’ or ‘carrier plane’ or ‘bearer plane’) carries the network user traffic. The control plane carries signaling traffic. The management plane carries administrative traffic.
[0006] According to this logical separation of the network architecture, each device operable in the telecommunication network is adapted to perform operations in the plurality of planes, i.e. at least by processing the data traffic at the data plane and running the control plane and management plane protocols thereby producing respectively control plane and management plane data.
[0007] Current root cause analysis techniques applied in the telecommunication field rely on the multi-plane architecture of the telecommunication networks. Accordingly, root cause analysis is performed separately at the different planes by analyzing the data collected at each plane separately. This involves network experts who manually analyze and correlate separately the data produced at each domain. Thus, the network experts perform root cause analysis at the control plane by analyzing the control plane data produced at the control plane, perform root cause analysis at the management plane by analyzing the management plane data produced at the management plane, and perform root cause analysis at the user plane by analyzing the user plane data produced at the user plane. [0008] Performing root cause analysis considering each plane separately is suboptimal due at least to the increased time delays and the ping pong effects among the independent analysis performed separately at the different planes and the independent root cause analysis conclusions that are produced independently.
[0009] There is accordingly a need for enhanced root cause analysis techniques for root cause analysis in telecommunication networks.
SUMMARY
[0010] The scope of protection is set out by the independent claims. The embodiments, examples and features, if any, described in this specification that do not fall under the scope of the protection are to be interpreted as examples useful for understanding the various embodiments or examples that fall under the scope of protection.
[0011] In a first aspect, there is provided a root cause analysis service consumer operable in a telecommunication network comprising one or more entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane. The root cause analysis service consumer comprises:
- means for receiving a root cause analysis report from a root cause analysis service provider, the root cause analysis report being generated based on root cause analytics, the root cause analytics being generated by performing a collection of root cause analysis data from the one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing analytics in the control plane and the other being a management plane data analytics producer producing analytics in the management plane.
[0012] In a second aspect, there is provided a root cause analysis service provider operable in a telecommunication network comprising one or more network entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane. The root cause analysis service provider comprises:
- means for generating root cause analytics by performing a collection of root cause analysis data from the one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane; - means for generating a root cause analysis report based on the root cause analytics.
[0013] In an embodiment, the root cause analysis service provider comprises:
- means for receiving a request for root cause analysis from a root cause analysis service consumer;
- means for sending a response on the request for root cause analysis to the root cause analysis service consumer, the response comprising the root cause analysis report.
[0014] In an embodiment, the collection and combined processing of root cause analysis data is coordinated by the root cause analysis service provider upon detecting one or more abnormal events at the management plane or at the control plane, the one or more abnormal events being detected at one or more network entities, the root cause analysis report comprising information for identifying the one or more entities.
[0015] In an embodiment, the root cause analysis report comprises information related to the one or more abnormal events detected at the control plane or at the management plane and information related to one or more corrective actions for correcting the one or more abnormal events.
[0016] In an embodiment, the root cause analysis service provider is a control plane data analytics producer and the data analytics producer is a management plane data analytics producer, the control plane data analytics producer comprising:
- means for receiving trigger information from the management plane data analytics producer, the trigger information indicating one or more abnormal events detected by the management plane data analytics producer at the management plane;
- means for triggering the collection of root cause analysis data and for triggering the generation of root cause analytics at the management plane by the management plane data analytics producer depending at least on the trigger information;
- means for generating root cause analytics by processing input data, the input data comprising the root cause analysis data collected by the control plane data analytics producer and root cause analytics generated by the management plane data analytics producer from the root cause analysis data collected by the management plane data analytics producer, and
- means for generating a root cause analysis report based on the root cause analytics.
[0017] In an embodiment, the triggering of the collection of root cause analysis data and the triggering of the generation of root cause analytics at the management plane depend further on load information and/or one or more exceptional conditions related to the one or more network entities.
[0018] In an embodiment, the root cause analysis service provider is a management plane data analytics producer and the data analytics producer is a control plane data analytics producer, the management plane data analytics producer comprising: - means for receiving trigger information from the control plane data analytics producer, the trigger information indicating one or more abnormal events detected by the control plane analytics producer at the control plane;
- means for triggering the collection of root cause analysis data and for triggering the generation of root cause analytics at the control plane by the control plane data analytics producer depending at least on the trigger information;
- means for generating root cause analytics by processing input data, the input data comprising the root cause analysis data collected by the management plane data analytics producer and root cause analytics generated by the control plane data analytics producer from the root cause analysis data collected by the control plane data analytics producer and
- means for generating a root cause analysis report based on the root cause analytics.
[0019] In an embodiment, the control plane data analytics producer is a network data analytics function and the management plane data analytics producer is a management data analytics function or a management data analytics service.
[0020] In an embodiment, the root cause analysis data comprise at least measurements data generated by the one or more network entities, the measurements data being one or more of performance measurements data, communication measurements data, platform computing measurements data, and security-related measurements data.
[0021] In an embodiment, the communication measurements data comprise traffic measurements data.
[0022] In an embodiment, the platform computing measurements comprise information related to software activity and software resources used by the one or more network entities.
[0023] In an embodiment, the security-related measurements data comprise information related to privileged user activity on the one or more network entities and information related to security mechanisms used in the one or more network entities.
[0024] In a third aspect, there is provided a method for providing a root cause analysis service to a root cause analysis service consumer, comprising:
- generating a root cause analysis report based on root cause analytics generated by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by a root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane. [0025] In a fourth aspect, there is provided a non-transitory computer-readable medium storing computer-executable instructions that, when executed by at least one processor at an apparatus, cause the apparatus to perform the method for providing a root cause analysis service to a root cause analysis service consumer.
[0026] Generally, the computer-executable instructions cause the apparatus to perform one or more or all steps of the method for providing a root cause analysis service to a root cause analysis service consumer.
[0027] In a fifth aspect, there is provided a method for activating and consuming a root cause analysis service by a root cause analysis service consumer, comprising:
- sending a request for root cause analysis to a root cause analysis service provider, and
- receiving a response on the request for root cause analysis from the root cause analysis service provider, the response comprising a root cause analysis report.
[0028] In a sixth aspect, there is provided a non-transitory computer-readable medium storing computer-executable instructions that, when executed by at least one processor at an apparatus, cause the apparatus to perform the method for activating and consuming the root cause analysis service by a root cause analysis service consumer.
[0029] Generally, the computer-executable instructions cause the apparatus to perform one or more or all steps of the method for activating and consuming the root cause analysis service by a root cause analysis service consumer.
[0030] In a seventh aspect, there is provided a root cause analysis service consumer operable in a telecommunication network comprising one or more entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane. The root cause analysis service consumer comprises at least one processor and at least one memory including computer program code. The at least one memory and the computer program code are configured to, with the at least one processor, cause the root cause analysis service consumer to:
- receive a root cause analysis report from a root cause analysis service provider, the root cause analysis report being generated based on root cause analytics, the root cause analytics being generated by performing a collection of root cause analysis data from the one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing analytics in the control plane and the other being a management plane data analytics producer producing analytics in the management plane. [0031] In an eighth aspect, there is provided a root cause analysis service provider operable in a telecommunication network comprising one or more network entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane. The root cause analysis service provider comprises at least one processor and at least one memory including computer program code. The at least one memory and the computer program code are configured to, with the at least one processor, cause the root cause analysis service provider to:
- generate root cause analytics by performing a collection of root cause analysis data from the one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane;
- generate a root cause analysis report based on the root cause analytics.
[0032] In an embodiment, the at least one memory and the computer program code are configured to, with the at least one processor, cause the root cause analysis service provider to:
- receive a request for root cause analysis from a root cause analysis service consumer;
- send a response on the request for root cause analysis to the root cause analysis service consumer, the response comprising the root cause analysis report.
[0033] In an embodiment, the root cause analysis service provider is a control plane data analytics producer and the data analytics producer is a management plane data analytics producer. The control plane data analytics producer comprises at least one processor and at least one memory including computer program code. The at least one memory and the computer program code are configured to, with the at least one processor, cause the control plane data analytics producer to:
- receive trigger information from the management plane data analytics producer, the trigger information indicating one or more abnormal events detected by the management plane data analytics producer at the management plane;
- trigger the collection of root cause analysis data and trigger the generation of root cause analytics at the management plane by the management plane data analytics producer depending at least on the trigger information;
- generate root cause analytics by processing input data, the input data comprising the root cause analysis data collected by the control plane data analytics producer and root cause analytics generated by the management plane data analytics producer from the root cause analysis data collected by the management plane data analytics producer, and
- generate a root cause analysis report based on the root cause analytics.
[0034] In an embodiment, the root cause analysis service provider is a management plane data analytics producer and the data analytics producer is a control plane data analytics producer. The management plane data analytics producer comprises at least one processor and at least one memory including computer program code. The at least one memory and the computer program code are configured to, with the at least one processor, cause the management plane data analytics producer to:
- receive trigger information from the control plane data analytics producer, the trigger information indicating one or more abnormal events detected by the control plane analytics producer at the control plane;
- trigger the collection of root cause analysis data and trigger the generation of root cause analytics at the control plane by the control plane data analytics producer depending at least on the trigger information;
- generate root cause analytics by processing input data, the input data comprising the root cause analysis data collected by the management plane data analytics producer and root cause analytics generated by the control plane data analytics producer from the root cause analysis data collected by the control plane data analytics producer, and
- generate a root cause analysis report based on the root cause analytics.
[0035] In a nineth aspect, there is provided an apparatus comprising at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to perform:
- reception of a root cause analysis report from a root cause analysis service provider, the root cause analysis report being generated based on root cause analytics, the root cause analytics being generated by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing analytics in the control plane and the other being a management plane data analytics producer producing analytics in the management plane.
[0036] In a tenth aspect, there is provided an apparatus comprising at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to perform:
- generation of root cause analytics by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the apparatus with a data analytics producer, one of the apparatus and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane;
- generation a root cause analysis report based on the root cause analytics.
BRIEF DESCRIPTION OF THE DRAWINGS
[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate example embodiments together with the general description given above, and the detailed description given below.
[0038] FIG. 1 is a block diagram illustrating an exemplary telecommunication network implementing a root cause analysis service consumer and a root cause analysis service provider, according to some embodiments.
[0039] FIG. 2 is a connection flow illustrating an exemplary implementation of a root cause analysis service, according to some embodiments.
[0040] FIG. 3 is a connection flow illustrating an exemplary implementation of a proactive root cause analysis service, according to some embodiments.
[0041] FIG. 4 is a connection flow illustrating an exemplary implementation of a proactive root cause analysis service, according to some embodiments in which the root cause analysis service provider is a control plane data analytics producer.
[0042] FIG. 5 is a connection flow illustrating an exemplary implementation of a proactive root cause analysis service, according to some embodiments in which the root cause analysis service provider is a management plane data analytics producer.
[0043] FIG. 6 is a flowchart depicting a method for activating and consuming a root cause analysis service by a root cause analysis service consumer, according to some embodiments. [0044] FIG. 7 is a flowchart depicting a method for providing a root cause analysis service by a root cause analysis service provider, according to some embodiments.
[0045] FIG 8 is a block diagram illustrating a data structure for storing data related to a root cause analysis report, according to some embodiments.
[0046] FIG. 9 is a block diagram illustrating an exemplary structure of a device operable in a telecommunication network, according to some embodiments. [0047] It should be noted that these drawings are intended to illustrate the general characteristics of devices, methods, and structures utilized in certain example embodiments and to supplement the written description provided below. These drawings are not, however, to scale and may not precisely reflect the precise structural or performance characteristics of any given embodiment, and should not be interpreted as defining or limiting the range of values or properties encompassed by example embodiments. The use of similar or identical reference numbers in the various drawings is intended to indicate the presence of a similar or identical element or feature.
DETAILED DESCRIPTION
[0048] Detailed example embodiments are disclosed herein. However, specific structural and functional details disclosed herein are merely representative for purposes of describing example embodiments. The example embodiments may, however, be embodied in many alternate forms and should not be construed as limited to only the embodiments set forth herein. Accordingly, while example embodiments are capable of various modifications and alternative forms, the embodiments are shown by way of example in the drawings and will be described herein in detail. It should be understood, however, that there is no intent to limit example embodiments to the particular forms disclosed.
[0049] Specific details are provided in the following description to provide a thorough understanding of example embodiments. However, it will be understood by one of ordinary skill in the art that example embodiments may be practiced without these specific details. For example, systems may be shown in block diagrams so as not to obscure the example embodiments in unnecessary detail. In other instances, well-known processes, structures and techniques may be shown without unnecessary detail in order to avoid obscuring example embodiments.
[0050] Exemplary embodiments provide devices, methods and computer program products enabling efficient cross-plane root cause analysis for identifying the root cause(s) of one or more abnormal events that occur at one or more network entity operable in a telecommunication network. The telecommunication network has a multi-plane network architecture comprising a plurality of planes. The plurality of planes comprises at least a user plane, a control plane and a management plane. The telecommunication network is managed by a network operator.
[0051] An abnormal event designates any hardware or software fault or problem or abnormal behavior that happens at the one or more network entities. An abnormal event can characterize the functioning of the one or more network entities and may occur due to an internal process within the network entity or due to an external actor that causes the event on the network entity for example in the case of software and/or hardware attacks on the one or more network entities.
[0052] The one or more abnormal events may be categorized into:
- metric threshold events detected when a value of a measured metric crosses a predefined metric threshold. Exemplary measured metrics comprise quality of service indicators (e.g. latency, call drop rate) and Key Performance Indicators (KPIs) such as throughput (uplink or downlink), Signal-to-Noise ratio, Signal to Interference plus Noise Ratio), User Equipment power Headroom, Channel Quality Indicator (uplink or downlink), bit rate (e.g. cell bit rate), and round trip time (uplink and downlink).
- status change events detected when the status of a network entity changes;
- operational behavior-related events detected when a change occurs at the operational behavior of a network entity. The operational behavior may be characterized by operational features or characteristics and/or by the performance of the network entity including for example the resource (e.g. storage and processing) consumption;
- security-related events such as hardware and software attacks.
[0053] Exemplary abnormal events comprise, without limitation:
- Key Performance Indicator degradation;
- shifts in traffic pattern;
- configuration changes of one or more network elements;
- service outages;
- physical changes such as modifications in antenna tilts and locations;
- software and hardware attacks.
[0054] A network entity refers to any physical/hardware device or software function/functionality/application that is part of the telecommunication network and that produces data at the management plane and/or the control plane and/or the user plane.
[0055] Exemplary network entities comprise without limitation:
- end devices (e.g. computers, laptops, tablets, mobile phones, robots, Internet of Things (loT) devices);
- network devices such as routers, switches, base stations (e.g. cellular base stations like eNodeB in LTE and LTE-advanced networks and gNodeB used in 5G networks, and femtocells used at homes or at business centers), control stations (e.g. radio network controllers, base station controllers, network switching sub-sustems), gateways, radio access network entities, core network devices, relay stations, and access points in local area networks or ad-hoc networks;
- network management systems and network automation systems; - network functions/applications/functionalities. A network function/functionality may be virtualized.
[0056] Root cause analysis data designate the data used for root cause analysis. The root cause analysis data, according to the various embodiments, comprise data produced at the different planes forming the logical operational architecture of the telecommunication network. Accordingly, the root cause analysis data comprises at least:
- user data produced by one or more network entities at the user plane;
- control data (also referred to as ‘signaling data’) produced by one or more network entities at the control plane, and
- management data (also referred to as ‘administrative data’) produced by the one or more network entities at the management plane.
[0057] The root cause analysis data may comprise raw root cause analysis data and processed root cause analysis data.
[0058] Raw root cause analysis data designates data that is in its initial state as collected from its data source (that can be the network entities or other data sources operable in the telecommunication network and producing raw data such as sensors and loT devices) and that has not been yet processed or organized or visually presented.
[0059] Processed root cause analysis data designates data that has been converted or processed in any manner or transformed into information useful for further analysis and/or decision-making. Exemplary processed root cause analysis data comprise statistics and data analytics.
[0060] In an embodiment, the root cause analysis data comprises one or more of:
- alarm data;
- measurements data;
- configuration data (e.g. data identifying the hardware and/or software configuration of the one or more network entities);
- network description data (e.g. network topology data, network configuration data, network activity data).
[0061] In an embodiment, the measurements data comprise one or more of:
- network measurements data (e.g. channel state measurements, quality of service measurements);
- fault measurements data;
- performance measurements data;
- communication measurements data;
- platform computing measurements data, and
- security-related measurements data. [0062] In an example, the communication measurements data comprise traffic measurements data, network capacity measurements data, and data related to the communication/transmission protocols and ports.
[0063] For example, traffic measurements data comprise measured current traffic rate. A mean deviation of the current traffic rate with respect to a planned/expected traffic rate may be configured by the network operator such that the one or more network entities report the measured current traffic rates that exceed the mean deviation values.
[0064] In an example, the platform computing measurements comprise information related to software activity and software resources used by the one or more network entities including containerization data. For example, the information related to the software resources comprise open source and operating system related information and/or data comprising hypervisor related information/measurements and logs/data generated by the one or more network entities.
[0065] For example, the open-source related information comprises a list of the used open source components and their release information. This information enables identifying critical bugs associated with the open-source components and predicting issues based on the vulnerable parts of the software that use the open source components.
[0066] For example, the operating system related information comprises one or more of information related to the distribution of the operating system, information related to the release of the operating system, and information related to the configuration of the operating system. The information related to the operating system release enables identifying bugs found in the release and their impacts on the performance or availability or the corresponding functionalities. The information related to the operating system configuration enables identifying any misconfiguration to backtrack potential issues before they occur and/or to find root causes.
[0067] For example, the hypervisor related measurements comprise statistics (e.g. number of active connection openings, number of passive connection openings, number of failed connection attempts) related to used internet protocols (e.g. Transmission Control Protocol or TCP, Internet Protocol or IP, Internet Message Control Protocol or IMCP, and User Datagram Protocol or UDP) collected by the operating system.
[0068] For example, the system activity information comprises information related to the network activity and processor usage, the queue, the load, the swap, the storage resources, and the memory usage.
[0069] In an example, the security-related measurements data comprise one or more of information related to privileged user activity on the one or more network entities and information related to security mechanisms used in the one or more network entities. [0070] The information related to privileged user activity enables identifying any suspicious activity originating from a suspicious user that has violated the access rules established through access controls and role-based access.
[0071] The security mechanisms refer to any hardware and/or software-based protocols, algorithms, methods used to provide confidentiality, integrity, authenticity, and non-repudiation services to the one or more network entities. This includes protecting the one or more network entities against any security-related attack and protecting the data stored and/or processed by the one or more network entities during its storage, processing, or transit. Exemplary security- related mechanisms comprise key-based cryptographic algorithms.
[0072] The root cause analysis data is sent by the one or more network entities in one or more formats including text formats, image formats, and multimedia formats.
[0073] In particular, the security-related measurements are sent by the one or more network entities in an image format. More specifically, the security-related measurements are sent in a container image that is associated with metadata enabling the entities receiving the security- related measurements to understand the content of the image container and to know how to handle it.
[0074] A container image is a static file that can not be modified. It comprises executable code to run in isolated process in a given information technology infrastructure. The container image comprises libraries and system tools and other platform settings that are needed to run a software program in a containerization platform. The container image may be created using a build command in a container platform and may be incrementally updated to add features, fix bugs or modify the content. The container image may be created automatically using a continuous integration tool.
[0075] Scanning the container images enables identifying software vulnerabilities in the container images. Scanning the container images consists in scanning all the files used in building the container image. The container images scan provides a list of scan findings also referred to as a container image scan report.
[0076] The container image scan report lists all the software vulnerabilities identified in the container image. Each identified software vulnerability is associated with metadata comprising information related to the software vulnerability. For example, the metadata comprises one or more pieces of:
- information enabling a unique identification of the software vulnerability (e.g. a name or an identifier);
- a status of the software vulnerability (e.g. approved status);
- a severity level (e.g. high, medium, low); - information related to the software package on which the software vulnerability is detected. This information comprises for example a package name and a package version.
- a description of the software vulnerability.
[0077] A security report includes the vulnerabilities detected for a software running in a container or in a virtual machine or in a baremetal node. The security scan report comprises a list of all the vulnerabilities that are detected. Each detected vulnerability may be associated with metadata comprising information related to the vulnerability. For example, the metadata comprises one or more pieces of :
- a severity level;
- one or more correction actions to remediate to the detected vulnerability;
- information related to the network entity on which the vulnerability has been detected.
[0078] By comparing the security report to expected operational configuration, any deviation on application behavior may be detected. For example, the expected operation configuration comprises one or more of:
- a list of the supported protocols;
- a list of the ports or range of ports corresponding to the supported protocols;
- a list of the supported security mechanisms (e.g. ciphers), and
- a version of the supported transport layer security protocol.
[0079] The cross-plane root cause analysis according to the various embodiments disclosed herein relies on an aggregated collection and a combined processing of the root cause analysis data. More specifically, the cross-plane root cause analysis according to the various embodiments disclosed herein is based on data analytics that enables converting the input root cause analysis data produced at the different planes into information (also referred to as ‘root cause analytics’) that can be processed interpreted and used for detailed analysis.
[0080] Root cause analysis according to the various embodiments is defined according to a service-oriented approach described as an interaction between a root cause analysis service consumer and a root cause analysis service provider. The root cause analysis service consumer requests root cause analysis services or operations from the root cause analysis service provider by sending a request for root cause analysis to the root cause analysis service provider. The root cause analysis service provider generates root cause analytics from input data comprising the root analysis data and generates a root cause analysis report based on the root cause analytics and provides the root cause analysis report to the root cause analysis service consumer. The root cause analysis report enables identifying the root causes of any abnormal event occurring in the telecommunication network and comprises one or more corrective actions recommended to correct the abnormal event and avoid that the abnormal event happens again. The interaction between the root cause analysis service consumer and the root cause analysis service provider may use a request or subscription model and servicebased interfaces.
[0081] The aggregated collection and combined processing of the root cause analysis data is coordinated, according to the various embodiments, by the root cause analysis service provider that has received a request for the root cause analysis service from the root cause analysis service consumer.
[0082] The root cause analysis service provider orchestrates/coordi nates the collection and the combined processing of the root cause analysis data with a data analytics producer such that one of the root cause analysis service provider and the data analytics producer is a control plane data analytics configured to produce root cause analytics at the control plane and the other is a management plane data analytics configured to produce root cause analytics at the management plane.
[0083] This means that the root cause analysis data which is produced at all the planes forming the plurality of planes of the network architecture, including the user plane, the control plane and the management plane, is processed at the control plane and the management plane by a control plane data analytics entity and a management plane data analytics entity. At the control plane, the control plane data analytics producer generates root cause analytics from the root cause analysis data and at the management plane, the management plane data analytics producer generates root cause analytics from the root cause analysis data. It is the role of the root cause analysis service producer (which is either a control plane data analytics producer or a management plane data analytics producer) to coordinate the collection and the combined processing of the root cause analysis data with the data analytics producer (which is either a management plane data analytics producer or a control plane data analytics producer).
[0084] The various embodiments disclosed herein provide thus a production of a root cause analysis report from root cause analytics generated at the control plane and at the management plane such that the collection of the root cause analysis data and the processing of the root cause analysis data for producing combined root cause analytics is coordinated/orchestrated by the root cause analysis service provider, i.e. by the data analytics producer (at the management or control plane) that has been requested by the root cause analysis service consumer to provide the root cause analysis service.
[0085] Exemplary embodiments enable a combination of analytics producers operable at the management plane and the control plane, the analytics producers cooperate to perform a combined processing of the root cause analysis data collected from one or more network entities to identify the root cause of any deterioration occurring in the network service. [0086] FIG. 1 illustrates an exemplary telecommunication network 100 in which exemplary embodiments may be implemented.
[0087] The telecommunication network 100 may be a digital system part of a communication system, a data processing system, or a data storage system. Exemplary digital systems comprise, without limitations:
- communication systems (e.g. radio communication systems, wireless communication systems, optical fiber-based communication systems, optical wireless communication systems, satellite communication systems), and
- storage systems (e.g. cloud computing systems);
[0088] According to some embodiments, the telecommunication network 100 may be or may comprise:
- a wired network (e.g. optical fiber-based networks);
- a wireless network (e.g. radio communication networks);
- an acoustic network (e.g. underwater acoustic communication systems);
[0089] In application to wireless networks, the telecommunication network 100 may be any wireless network involving any type of wireless propagation medium suitable for this type of connectivity. Exemplary wireless communication networks comprise, without limitation, ad-hoc wireless networks used in local area communications, wireless sensor networks, and radio communication networks (e.g. Long Term Evolution or LTE, LTE-advanced, 3G/4G/5G and beyond).
[0090] Exemplary applications to wireless networks comprise:
- Machine-To-Machine (M2M);
- Device-To-Device (D2D);
- Industry 4.0;
- Internet of Things or loT (for example vehicle-to-everything communications) involving networks of physical devices, machines, vehicles, home alliances and many other objects connected to each other and provided with a connectivity to the Internet and the ability to collect and exchange data without requiring human-to-human or human-to-computer interactions.
[0091] In exemplary loT applications, the telecommunication network 100 may be a wireless loT network representing low energy power-consumption/long battery life/low-latency/low hardware and operating cost/high connection density constraints such as low-power wide area networks and low-power short-range loT networks. The telecommunication network 100 may be any wireless network enabling loT in licensed or license-free spectrum.
[0092] Exemplary wireless technologies used in loT applications may comprise:
- short range wireless networks (e.g. Bluetooth mesh networking, Light-Fidelity, Wi-Fi™, and Near-Field communications); - medium range wireless networks (e.g. LTE-advanced, Long Term Evolution-Narrow Band, NarrowBand loT), and
- long range wireless networks (e.g. Low-Power Wide Area Networks (LPWANs), Very small aperture terminal, and long-range Wi-Fi™ connectivity).
[0093] Exemplary applications of M2M and loT applications comprise, without limitation:
- consumer applications (e.g. Internet of Vehicles, home automation, smart cities, wearable technologies, and connected health), and
- commercial applications (e.g. digitalized healthcare connecting medical resources and healthcare services in which special monitors and sensors may be used to enable remote health monitoring and emergency notifications, smart traffic control, and road assistance).
[0094] In another application to optical fiber networks, the telecommunication network 100 may be any data network in which any optical fiber link is designed to carry data over short or long distances. Exemplary applications using optical fiber links over short distances comprise high-capacity networks such as data center interconnections. Exemplary applications using optical fiber links over long distances comprise terrestrial and transoceanic transmissions. In such applications, network data generated by the network elements operable in the telecommunication network 100 may be carried by optical signals polarized according to the different polarization states of the optical fiber. The optical signals propagate along the fiberbased link according to one or more propagation modes.
[0095] Exemplary applications of optical fiber data networks comprise, without limitation, aerospace and avionics, data storage (e.g. in cloud computing systems, automotive, industry, and transportation). Such applications may involve transfer of voice (e.g. in telephony), data (e.g. data supply to homes and offices known as fiber to the home), images or video (e.g. transfer of internet traffic), or connection of networks (e.g. connection of switches or routers and data center connectivity in high-speed local area networks).
[0096] The telecommunication network 100 comprises a root cause analysis service consumer 101 , a root cause analysis service provider 102, a data analytics producer 103 and one or more network entities 104-i with i=1 ,... ,N with N designating the total number of network entities.
[0097] The root cause analysis service provider 102 is configured to:
- communicate with the root cause analysis service consumer 101 for the operations related to the root cause analysis service;
- communicate with the data analytics producer 103 for the operations related to the coordination of the collection and the combined processing of the root cause analysis data;
- communicate with the one or more network entities 104-i with i=1 ,... ,N for the operations related the collection of the root cause analysis data. [0098] The data analytics producer 103 is configured to:
- communicate with the root cause analysis service provider 102 for the operations related to the collection and combined processing of the root cause analysis data;
- communicate with the one or more network entities 104-i, with i=1 ,N, for the operations related to the collection of the root cause analysis data.
[0099] The interactions involving the root cause analysis service consumer 101 , the root cause analysis service provider 102, the data analytics producer 103, and the one or more network entities 104-i, for i=1 ,... ,N, may use a request or subscription model and service-based interfaces.
[0100] In application to 5G and beyond networks, discovery and selection procedures may be performed before establishing any communication link between the entities operable in the telecommunication network 100. For example, the root cause analysis service consumer 101 may perform discovery and selection procedures to select the root cause analysis service provider 102 that supports the requested root cause analysis service and the required root cause data analytics capabilities. Similarly, the root cause analysis service provider 102 may perform discovery and selection procedures to select the data analytics producer 103 that supports the requested root cause data analytics and the required root cause analytics production capabilities. The root cause analysis service provider 102 and the data analytics producer 103 may perform discovery and selection procedures to select the one or more entities 104-i that support the required root cause data collection service.
[0101] Discovery and selection procedures may be performed using the methods defined in 3GPP standards and are not detailed in the present disclosure. In the following description, the root cause analysis service provider 102 corresponds to the (control plane or management plane) root cause analysis service provider selected by the root cause analysis consumer 101 during the discovery and selection phase and the data analytics producer 103 corresponds to the (management plane or the control plane) data analytics producer selected by the root cause analysis service provider 102 during the discovery and selection phase. The discovery and selection procedures may comprise authentication steps for example to authenticate the root cause analysis consumer 101 and/or to authenticate the root cause analysis service provider 102 and/or to authenticate the data analytics producer 103.
[0102] The root cause analysis consumer 101 may be any network entity requiring the analysis of the causes of one or more abnormal events occurring at one or more entities in order to perform or to enable the network operator to perform one or more corrective actions. A corrective action may be performed to correct the one or more abnormal events and/or prevent that the one or more abnormal events occur again and/or to provide insights that can be used for the optimization of the network for operational and cost efficiency and/or to find out irregularities and prevent undesired scenarios.
[0103] For example, the root cause analysis service consumer 101 may implemented as a part of a network entity (hardware or software) in which one or more abnormal events occurred and triggers a root cause analysis service from the root cause analysis service provider in order to identify the cause(s) of the one or more abnormal events.
[0104] In another example, the root cause analysis consumer 101 is or is implemented as a part of an Operation, Administration and Management (OAM) service of the network operator or as a part of a security management entity.
[0105] In application to 5G and beyond networks, a network entity is network function (e.g. hardware network functions, softwarized network functions, virtualized network functions) deployed on the access network, the transport network, or the core network.
[0106] Exemplary network functions comprise, without limitation:
- access and mobility management functions;
- session management functions;
- user plane functions;
- Policy control functions;
- authentication server functions;
- Unified data management functions;
- network exposure functions;
- network repository functions;
- network slice selection functions.
[0107] In application to 5G and beyond networks, the control plane data analytics producer is a network data analytics function (NWDAF) defined in current 3GPP standards as a part of the 5G core network and used for performing data collection and providing network analytics information.
[0108] Still in application to 5G and beyond networks, the management plane data analytics producer is a management data analytics function (MDAF) or a management data analytics service (MDAS). The MDAS is defined in current 3GPP standards as a management entity configured to provide management data analytics to support network management and orchestration at the Radio Access Network level or at the Core Network level.
[0109] FIG. 2 is a connection flow illustrating a root cause analysis service, according to some embodiments.
[0110] The root cause analysis service is triggered by the root cause analysis service consumer 101 that sends a request for root cause analysis, in step 200, to the root cause data analysis service provider 102. The root cause analysis service may be a proactive or reactive. [0111] Proactive root cause analysis service refers to a root cause analysis service that is triggered by the root cause analysis service consumer 101 in a proactive manner, i.e. before any abnormal event is detected. The root cause analysis service consumer 101 may trigger a proactive root cause analysis service to monitor one or more specific network entities 104-i such that as soon as an abnormal event is detected at these network entities 104-i, root cause analysis is performed to identify the root causes of the detected abnormal event.
[0112] Reactive root cause analysis service refers to a root cause analysis service that is triggered by the root cause analysis service consumer 101 in reaction to the detection or the identification, for example by the root cause analysis service consumer 101 , of one or more abnormal events. This happens for example when the root cause analysis service consumer 101 is implemented as a part of a network function or a management entity or service and one or more abnormal events occur or are detected at or by the network function or at or by the management entity.
[0113] For example, the root cause analysis service consumer 101 may trigger a reactive root cause analysis service from the root cause analysis service provider 101 upon the detection of one or more abnormal events such as:
- abnormal network disruptions;
- abnormal traffic disruptions;
- abnormal network or network function or route outage;
- abnormal user or network function communication patterns and mobility;
- abnormal user throughput or network load, and
- abnormal user related repository behavior and risk.
[0114] In case of metric threshold events, the metric thresholds may be configured at the root cause analysis service consumer 101 so that the root cause analysis service consumer 101 is able to detect or identify any abnormal metric threshold event when one or more measured metrics deviate from the configured metric thresholds.
[0115] In an embodiment, the reactive root cause analysis service is triggered by the root cause analysis service consumer 101 according to a request for security assessment and/or for operational behavior assessment in relation with the one or more network entities 104-i. The request for security assessment and/or for operational behavior assessment (not illustrated in FIG. 2) may be triggered by a security management entity or by the one or more network entities 104-i that sends a request for a security assessment and/or operational behavior assessment to the root cause analysis service consumer 103.
[0116] For example, the request for security assessment and/or for operational behavior assessment is triggered (by the one or more network entities 104-i or by a security management entity) depending on performance measurements associated with the one or more network entities 104-i. For example, the security assessment and/or operational behavior assessment is triggered depending on variation on one or more Key Performance Indicators associated with the one or more network entities 104-i.
[0117] In general, the request for root cause analysis (proactive or reactive) comprises analytics service information indicating specifications related to the root cause analytics based on which the root cause analysis report will be generated. For example, the analysis service information comprises information that enable identifying a usage of the data analytics and/or characterizing the generation and the delivery of the data analytics.
[0118] For example, the information related to the data analytics comprises one or more piece of the information listed below:
- an analytics name or identifier;
- an analytics model type specifying the type of the algorithm to be used for data analytics generation (e.g. the type of the ML model or algorithm in ML-based data analytics generation) ; [0119] The request for root cause analysis may comprise additional information that depends on whether the requested root cause analysis service is proactive or reactive.
[0120] For example, in a proactive root cause analysis service, the request for root cause analysis may further comprise additional information related to a monitoring period during which the one or more network entities 104-i are supervised by the root cause analysis service provider 102 and/or the data analytics producer 103 to detect one or more abnormal events.
[0121] The additional information may further comprise information related to one or more specific or target network entities 104-i that are to be monitored for the detection of abnormal events. For example, the information related to the one or more target network entities 104-i comprises one or more pieces of the information listed below:
- performance metrics and/or key performance indicators to be measured on the one or more target network entities 104-i;
- performance metrics thresholds and/or key performance indicators thresholds enabling the detection of abnormal metric threshold-based events ;
- target objects specifying the target network entities 104-i ;
- target geographical area specifying the geographical localization of the target network entities.
[0122] Upon receiving the request for root cause analysis from the root cause analysis service consumer 101 , the root cause analysis service provider 102 coordinates, at step 201 , the collection and the combined processing of root cause analysis data with the data analytics producer 103. Coordinating the collection and the combined processing of the root cause analytics data consists in setting a root cause analysis mechanism that specifies: - when the root cause analysis service provider 102 and the data analytics producer 103 start collecting the root cause analysis data from the one or more network entities 104-i;
- when the data analytics producer 103 generates root cause analytics from the collected root cause analysis data, and
- how the correlation of the root cause analytics produced by the data analytics producer 103 and the root cause analytics produced by the root cause analysis service provider 102 is performed by the root cause analysis service provider 102.
[0123] At step 201 , the root cause analysis service provider 102 defines the root cause analysis mechanism and informs the data analytics producer 103 about it. This enables the coordination of the collection of root cause analysis data across the control and management planes and the coordination of the correlation of the root cause analysis data collected at the different planes for producing a single root cause analysis report based on root cause analytics generated by performing a combined processing of the root cause analysis data.
[0124] According to the defined root cause analysis mechanism, the root cause analysis service provider 102 sends:
- at step 202, a request for producing root cause analytics to the data analytics producer 103;
- at step 203, a request for root cause analysis data to the one or more network entities 104-i, for i varying from 1 to N.
[0125] This means that the production of root cause analytics by the data analytics producer 103 and the collection of root cause analysis data to be used by the data analytics producer 103 and later by the root cause analysis service provider 102 are triggered by the root cause analysis service provider 102.
[0126] At step 204, the data analytics producer 103 receives root cause analysis data from the one or more network entities 104-i.
[0127] At step 205, the data analytics producer 103 generates root cause analytics from the root cause analysis data it received at step 204. The data analytics producer 103 sends then the generated root cause analytics to the root cause analysis service provider 102 at step 206. [0128] It is the role of the root cause analysis service provider 102 to generate a root cause analysis report and send it to the root cause analysis service consumer 101. To do so, the root cause analysis service provider 102 performs a combined processing of the root cause analysis data collected at the management plane and at the control plane (i.e. collected by the root cause analysis service provider 102 and the data analytics producer 103 operating each at a different plane among the control and management planes). Accordingly, at step 207, the root cause analysis service provider 102 receives root cause analysis data from the one or more network entities 104-i and at step 208, the root cause analysis service provider 102 generates root cause analytics by processing input data, the input data comprising at least: - the root cause analysis data collected and received from the one or more network entities 104-i at step 207, and
- the root cause analytics generated by the data analytics producer 103 and received from it at step 206.
[0129] At step 208, the root cause analysis service provider 102 is configured to produce root cause analytics according to the specifications and information related to the root cause analytics comprised in the request for root cause analysis received from the root cause analysis service consumer 101 and to generate a root cause analysis report based on the generated root cause analytics.
[0130] In an exemplary embodiment, the root cause analysis service provider 102 is configured to process the input data by performing a processing operation comprising data aggregation, data de-duplication, and/or data categorization.
[0131] In an exemplary embodiment, the processing operation uses a training-based algorithm or model such as artificial intelligence/machine learning algorithms. For example, the training-based algorithm takes as input the input data and delivers as output the root cause analytics.
[0132] In an exemplary embodiment, the training-based algorithm is a supervised machine learning algorithm. Exemplary supervised machine learning algorithms comprise, without limitation, Support Vector Machines (SVM), linear regression, logistic regression, naive Bayes, linear discriminant analysis, decision trees, k-nearest neighbor algorithm, neural networks, and similarity learning.
[0133] At step 209, the root cause analysis service provider 102 sends a response on the request for root cause analysis to the root cause analysis service consumer 101 , the response comprising the root cause analysis report.
[0134] In an embodiment, the response to the request for root cause analysis comprises the generated root cause analytics and information related to the generated analytics.
[0135] For example, the information related to the analytics comprise one or more pieces of the information listed below:
- a root cause analytics name specifying a name of the provided analytics service;
- a name of the analytics model specifying the name of the analytics model used to generate the root cause analytics;
- an analytics type specifying the type of the generated root cause analytics (e.g. statistics, predictions, recommendation);
- a reporting time specifying a time stamp related to the generated root cause analytics;
- a confidence degree specifying a confidence level related to the generated root cause analytics. [0136] The root cause analysis report comprises at least information related to the one or more abnormal events detected (at the control plane or the management plane) on one or more network entities 104-i, information enabling identifying the one or more network entities 104-i, information specifying the one or more abnormal events, and information specifying one or more corrective actions for correcting the one or more abnormal events.
[0137] For example, the root cause analysis report comprises one or more pieces of the information listed below:
- list of analyzed network entities specifying the network entities that were analyzed for root cause;
- affected locations specifying the geographical areas (e.g. the list of cells) where one or more abnormal events have been detected;
- start time indicating the start time of service deterioration due to the one or more abnormal events;
- stop time indicating the end time of service deterioration due to the one or more abnormal events;
- affected network entities specifying the lists of the one or more network entities that were affected by the one or more abnormal events.
- root cause or root alarm identified or predicted by root cause decision model (e.g. alarms of virtualized resource failure and alarms on faults in a network function);
- a severity level specifying the severity level (e.g. critical, medium, not important) of the detected abnormal event;
- recommended actions specifying one or more recommended actions to clear the faults. The recommended actions may comprise replacing one or more hardware units, reconfiguring one or more protocols;
- cross-plane triggers specifying the alarms that trigger cross-plane root cause analysis according to the root cause analysis mechanism. This information may indicate suspected network entities.
[0138] The coordination of the collection and combined processing performed at step 201 depends on whether the requested root cause analysis service is proactive or reactive.
[0139] In proactive root cause analysis services, the collection and the combined processing of root cause analysis data performed at step 201 is coordinated by the root cause analysis service provider 102 upon the detection of one or more abnormal events at the management plane or at the control plane. The root cause analysis mechanism defined by the root cause analysis service provider 102 at step 202 takes into account the configuration of the detection of abnormal events at the control plane and at the management plane on the root cause analysis service provider 102 and on the data analytics producer 103. [0140] FIG. 3 is a connection flow illustrating a proactive root cause analysis service, according to some embodiments. The proactive root cause analysis service is triggered by the root cause analysis consumer 101 in order to supervise the one or more entities and to identify, actively, the root cause(s) of any abnormal event that happens after the root cause analysis requests is sent.
[0141] At step 300, the root cause analysis service consumer 101 triggers a proactive root cause analysis service by sending a request for root cause analysis to the root cause analysis service provider 102. Step 300 is similar to step 200 described in relation with FIG. 2.
[0142] At step 301 , the root cause analysis service provider 102 defines a root cause analysis mechanism according to which it will coordinate the collection and the combined processing of the root cause analysis data with the data analytics producer 103.
[0143] Step 301 may comprise:
- a step 301 -a during which the root cause analysis service provider 102 sends to the data analytics producer 103 information related to the defined root cause analysis mechanism;
- a step 301 -b during which the root cause analysis service provider 102 receives from the data analytics producer 103 trigger information according to which the root cause analysis service provider 102 triggers the collection of root cause analysis from the one or more network entities 104-i and the production of root cause analytics at the data analytics producer 103 such that the combined processing of the root cause analysis data collected at the management plane and the control plane is performed by the root cause analysis service provider 102.
[0144] For example, the information related to the defined root cause analysis mechanism sent to the data analytics producer in step 301 -a may comprise one or more of:
- information indicating one or more network entities 104-i (e.g. monitored or suspected network entities)
- information related to one or more performance metrics or one or more performance indicators to be measured for detecting an abnormal metric threshold event, the information comprising one or more metric thresholds or performance indicator thresholds; information related to one or more operational behavior (e.g. resource consumption/utilization) and thresholds enabling detecting an abnormal operational behavior on one or more network entities.
[0145] In general, the information related to the defined root cause analysis mechanism enables the detection, at the control plane or the management plane, of one or more abnormal events occurring on one or more network entities 104-i.
[0146] The data analytics producer 103 sends the trigger information to the root cause analysis service provider 102 upon detecting one or more abnormal events at the control plane or the management plane (depending on whether the data analytics producer 103 is a control plane data analytics producer or a management plane data analytics producer). The trigger information indicates the one or more abnormal events detected by the data analytics producer 103 (at the control plane or at the management plane).
[0147] The root cause analysis service provider 102 triggers the collection of root cause analysis data at step 303 and triggers the generation of root cause analytics by the data analytics producer 103 at step 302 depending at least on the trigger information received from the data analytics producer 103 at step 301 -b.
[0148] Steps 302 to 309 are similar to steps 202 to 209 described in relation with FIG. 2.
[0149] FIG. 4 is a connection flow illustrating a proactive root cause analysis service, according to some embodiments in which the root cause analysis service provider 102 is a control plane data analytics producer 102 and the data analytics producer 103 is a management plane data analytics producer 103.
[0150] Steps 400 and 402 to 409 are similar to steps 300 and 302 to 309 described in relation with FIG. 3.
[0151] At step 401 , the control plane data analytics producer 102 defines a root cause analysis mechanism according to which it will coordinate the collection and the combined processing of the root cause analysis data with the management plane data analytics producer 103.
[0152] Step 401 comprises:
- a step 401 -a during which the control plane data analytics producer 102 sends to the management plane data analytics producer 103 information related to the defined root cause analysis mechanism;
- a step 401 -b during which the control plane data analytics producer 102 receives from the management plane data analytics producer 103 trigger information according to which the root control plane data analytics producer 102 triggers the collection of root cause analysis from the one or more network entities 104-i and the production of root cause analytics at the management plane data analytics producer 103 such that the combined processing of the root cause analysis data collected at the management plane and the control plane is performed by the control plane data analytics producer 102.
[0153] More specifically, the trigger information received by the control plane data analytics producer 102 at step 401 -b from the management plane data analytics producer 103 indicates one or more abnormal events detected by the management plane data analytics producer 103 at the management plane.
[0154] The control plane data analytics producer 102 triggers the collection of root cause analysis data at step 403 and triggers the generation of root cause analytics by the management plane data analytics producer 103 at step 402 depending at least on the trigger information received from the management plane data analytics producer 103 at step 401 -b.
[0155] At step 408, the control plane data analytics producer 102 generates root cause analytics and generates a root cause analysis report based on the generated root cause analytics. The root cause analytics are generated by processing input data, the input data comprising:
- the root cause analysis data collected and received by the control plane data analytics producer 102 from the one or more network entities 104-i at step 407, and
- the root cause analytics generated by the management plane data analytics producer 103 at step 405, from the root cause analysis data collected and received by the management plane data analytics producer 103 at step 404.
[0156] In an embodiment, the control plane data analytics producer 102 triggers the collection of root cause analysis data and the generation of root cause analytics at the management plane (by the management plane data analytics producer 103) depending further on load information and/or one or more exceptional conditions related to the one or more network entities 104-i.
[0157] FIG. 5 is a connection flow illustrating a proactive root cause analysis service, according to some embodiments in which the root cause analysis service provider 102 is a management plane data analytics producer 102 and the data analytics producer 103 is a control plane data analytics producer 103.
[0158] Steps 500 and 502 to 509 are similar to steps 300 and 302 to 309 described in relation with FIG. 3.
[0159] At step 501 , the management plane data analytics producer 102 defines a root cause analysis mechanism according to which it will coordinate the collection and the combined processing of the root cause analysis data with the control plane data analytics producer 103. [0160] Step 501 comprises:
- a step 501 -a during which the management plane data analytics producer 102 sends to the control plane data analytics producer 103 information related to the defined root cause analysis mechanism;
- a step 401 -b during which the management plane data analytics producer 102 receives from the control plane data analytics producer 103 trigger information according to which the management plane data analytics producer 102 triggers the collection of root cause analysis from the one or more network entities 104-i and the production of root cause analytics at the control plane data analytics producer 103 such that the combined processing of the root cause analysis data collected at the management plane and the control plane is performed by the management plane data analytics producer 102. [0161] More specifically, the trigger information received by the management plane data analytics producer 102 at step 501 -b from the control plane data analytics producer 103 indicates one or more abnormal events detected by the control plane data analytics producer 103 at the control plane.
[0162] The management plane data analytics producer 102 triggers the collection of root cause analysis data at step 503 and triggers the generation of root cause analytics by the control plane data analytics producer 103 at step 502 depending at least on the trigger information received from the control plane data analytics producer 103 at step 501 -b.
[0163] At step 508, the management plane data analytics producer 102 generates root cause analytics and a root cause analysis report based on the root cause analytics. The root cause analytics are generated by processing input data, the input data comprising:
- the root cause analysis data collected and received by the management plane data analytics producer 102 from the one or more network entities 104-i at step 507, and
- the root cause analytics generated by the control plane data analytics producer 103 at step 505, from the root cause analysis data collected and received by the control plane data analytics producer 103 at step 504.
[0164] FIG. 6 is a flowchart depicting a method for activating and consuming a root cause analysis service by a root cause analysis service consumer 101 , according to some embodiments.
[0165] At step 601, a request for root cause analysis is sent to a root cause analysis service provider.
[0166] At step 602, a response on the request for root cause analysis is received from the root cause analysis service provider, the response comprising a root cause analysis report.
[0167] FIG. 7 is a flowchart depicting a method for providing a root cause analysis service by a root cause analysis service provider 102, according to some embodiments.
[0168] At step 701, a request for root cause analysis is received from a root cause analysis service consumer.
[0169] At step 702, the collection and combined processing of root cause analysis data is coordinated by a root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing data analytics at the control plane and the other one being a management plane data analytics producer producing data analytics at the management plane.
[0170] At step 703, a root cause analysis report is generated based on root cause analytics that are generated by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data at the root cause analysis service provider.
[0171] At step 704, a response on the request for root cause analysis is sent to the root cause analysis service consumer, the response on the request for root cause analysis comprising the generated root cause analysis report.
[0172] FIG 8 is a block diagram illustrating a data structure 800 used for storage of data related to a root cause analysis report, according to some embodiments.
[0173] The data structure 800 may be of any data organization, management and storage format that enables access to and/or modification of stored data. Exemplary data structures comprise arrays, linked lists, records, and objects.
[0174] The data structure 800 comprises data fields (also referred to as ‘data elements’). Each data field comprises an attribute field and a value field. The data fields comprise data fields 801 related to the root cause analytics and fields 802 related to the detected one or more abnormal events.
[0175] For example, the data fields 801 comprise:
- a first data field of attribute ‘root cause analytics ID’ and of a value field indicating an identifier enabling a unique identification of the root cause analytics based on which the root cause analysis report is generated;
- a second data field of attribute ‘list of analyzed network entities’ and of a value field indicating the network entities that have been analyzed for root cause.
[0176] For example, the data fields 802 comprise:
- a first data field of attribute ‘affected locations’ of a value specifying the geographical areas (e.g. the list of cells) where one or more abnormal events have been detected;
- a second data field of attribute ‘start time’ and of a value indicating the start time of service deterioration due to the one or more abnormal events;
- a third data field of attribute ‘stop time’ and of a value indicating the end time of service deterioration due to the one or more abnormal events;
- a fourth data field of attribute ‘affected network entities’ and of a value specifying the lists of the one or more network entities that were affected by the one or more abnormal events;
- a fifth data field of attribute ‘root cause or root alarm’ and of a value specifying alarms identified or predicted by root cause decision model (e.g. alarms of virtualized resource failure and alarms on faults in a network function);
- a sixth data field of attribute ‘severity level’ and of a value specifying the severity level (e.g. critical, medium, not important) of the detected abnormal event;
- a seventh data field of attribute ‘recommended actions’ and of a value specifying one or more recommended actions to clear the faults. - an eight data field of attribute ‘cross-plane triggers’ and of a value specifying the alarms that trigger cross-plane root cause analysis according to the root cause analysis mechanism. This information may indicate suspected network entities.
[0177] It should be appreciated by those skilled in the art that any functions, engines, block diagrams, flow diagrams, state transition diagrams and/or flowcharts herein represent conceptual views of illustrative circuitry embodying the principles of the invention. Similarly, it will be appreciated that any flow charts, flow diagrams, state transition diagrams, pseudo code, and the like represent various processes which may be substantially represented in computer readable medium and so executed by a computer or apparatus, whether such computer or processor is explicitly shown.
[0178] Each described computation function, block, step can be implemented in hardware, software, firmware, middleware, microcode, or any suitable combination thereof. If implemented in software, the computation functions, blocks of the block diagrams and/or flowchart illustrations can be implemented by computer program instructions I software code, which may be stored or transmitted over a computer-readable medium, or loaded onto a general purpose computer, special purpose computer or other programmable processing apparatus and I or system to produce a machine, such that the computer program instructions or software code which execute on the computer or other programmable apparatus, create the means for implementing the functions described herein.
[0179] When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks may be stored in a machine or computer readable medium such as a computer readable storage medium. When implemented in software, a processor or processors will perform the necessary tasks. For example, as mentioned above, according to one or more example embodiments, at least one memory may include or store computer program code, and the at least one memory and the computer program code may be configured to, with at least one processor, cause an apparatus to perform the necessary tasks. Additionally, the processor, memory and example algorithms, encoded as computer program code, serve as means for providing or causing performance of operations discussed herein.
[0180] For example, the functions described here for the root cause analysis service consumer may be performed by a corresponding apparatus. For example, the functions described here for the root cause analysis service provider may be performed by a corresponding apparatus. For example, the functions described here for the data analytics producer may be performed by a corresponding apparatus.
[0181] In the present description, block denoted as "means configured to” perform a certain function or “means for” performing a certain function shall be understood as functional blocks comprising circuitry that is adapted for performing or configured to perform a certain function. A means being configured to perform a certain function does, hence, not imply that such means necessarily is performing said function (at a given time instant). Moreover, any entity described herein as "means", may correspond to or be implemented as "one or more modules", "one or more devices", "one or more units", etc. When provided by a processor, the functions may be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which may be shared. Moreover, explicit use of the term "processor" or "controller" should not be construed to refer exclusively to hardware capable of executing software, and may implicitly include, without limitation, digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), read only memory (ROM) for storing software, random access memory (RAM), and non-volatile storage. Other hardware, conventional or custom, may also be included. Their function may be carried out through the operation of program logic, through dedicated logic, through the interaction of program control and dedicated logic, or even manually, the particular technique being selectable by the implementer as more specifically understood from the context.
[0182] As used in this application, the term “circuit” or “circuitry” may refer to one or more or all of the following:
(a) hardware-only circuit implementations (such as implementations in only analog and/or digital circuitry) and
(b) combinations of hardware circuits and software, such as (as applicable) : (i) a combination of analog and/or digital hardware circuit(s) with software/firmware and (ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions); and
(c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.”
[0183] This definition of “circuit” or “circuitry” applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and/or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, an integrated circuit for a network element or network node or any other computing device or network device. The term circuitry may cover digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), etc.
[0184] The “circuit” or “circuitry” may be or include, for example, hardware, programmable logic, a programmable processor that executes software or firmware, and/or any combination thereof (e.g. a processor, control unit/entity, controller) to execute instructions or software and control transmission and receptions of signals, and a memory to store data and/or instructions. [0185] The “circuit” or “circuitry” may also make decisions or determinations, generate frames, packets or messages for transmission, decode received frames or messages for further processing, and other tasks or functions described herein. The circuitry may control transmission of signals or messages over a radio network, and may control the reception of signals or messages, etc., via a radio network (e.g., after being down-converted by radio transceiver, for example).
[0186] As disclosed herein, the term "storage medium," "computer readable storage medium" or "non-transitory computer readable storage medium” may represent one or more devices for storing data, including read only memory (ROM), random access memory (RAM), magnetic RAM, core memory, magnetic disk storage mediums, optical storage mediums, flash memory devices and/or other tangible machine-readable mediums for storing information. The term "computer-readable medium" may include, but is not limited to, portable or fixed storage devices, optical storage devices, and various other mediums capable of storing, containing or carrying instruction(s) and/or data.
[0187] The methods and devices described herein may be implemented by various means. For example, these techniques may be implemented in hardware, software, or a combination thereof. For a hardware implementation, the processing elements of the different network elements operating in the telecommunication network 100 can be implemented for example according to a hardware-only configuration (for example in one or more FPGA, ASIC, or VLSI integrated circuits with the corresponding memory) or according to a configuration using both VLSI and Digital Signal Processor (DSP).
[0188] FIG. 9 is a block diagram representing an exemplary hardware/software architecture of a device 900 operating in the telecommunication network 100 such as the root cause analysis service consumer 101 , the root cause analysis service provider 102, the data analytics producer 103, and the network entities 104-i, according to some embodiments. As illustrated, the architecture may include various computing, processing, storage, communication, and displaying units comprising:
- communication circuitry comprising a transceiver 902 (e.g. wireless or optical transceiver) configured to connect the device 900 to corresponding links in the telecommunication network 100, and to ensure transmission/reception of data and/or signals. The communication circuitry may support various network and air interface such as wired, optical fiber, and wireless networks;
- a processing unit 903 configured to execute the computer-executable instructions to run the methods and algorithms according to the various embodiments and perform the various required functions of the device such as data analytics production and any functionalities required to enable the device 900 to operate in the telecommunication network 100 according to the various embodiments. The processing unit 902 may be a general purpose processor, a special purpose processor, a DSP, a plurality of microprocessors, a controller, a microcontroller, an ASIC, an FPGA circuit, any type of integrated circuit, and the like;
- a power source 904 that may be any suitable device providing power to the device 900 such as dry cell batteries, solar cells, and fuel cells;
- a localization unit 905 such as a GPS chipset implemented in applications that require information indicating the location of the device 900;
- a storage unit 906 possibly comprising a random access memory (RAM) or a read-only memory used to store data (e.g. root cause analysis data) and any data required to perform the functionalities of the device 900 according to the embodiments;
- Input peripherals 907;
- Output peripherals 908 comprising communication means such as displays enabling for example man-to-machine interaction between the device 900 and the telecommunication network 100 administrator for example for configuration and/or maintenance purposes.
[0189] The architecture of the device 900 may further comprise one or more software and/or hardware units configured to provide additional features, functionalities and/or network connectivity.
[0190] Furthermore, the methods described herein can be implemented by computer program instructions supplied to the processor of any type of computer to produce a machine with a processor that executes the instructions to implement the functions/acts specified herein. These computer program instructions may also be stored in a computer-readable medium that can direct a computer to function in a particular manner. To that end, the computer program instructions may be loaded onto a computer to cause the performance of a series of operational steps and thereby produce a computer implemented process such that the executed instructions provide processes for implementing the functions specified herein.
[0191] For example, the program comprises instructions stored on the computer-readable storage medium that, when executed by a processor, cause the processor to:
- generate a root cause analytics by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by a root cause analytics service provider with a data analytics producer, one of the root cause analytics service provider and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane.
[0192] It will be understood that the configurations and/or approaches described herein are exemplary in nature, and that these specific embodiments or examples are not to be considered in a limiting sense, because numerous variations are possible. The specific routines or methods described herein may represent one or more of any number of processing strategies. As such, various acts illustrated and/or described may be performed in the sequence illustrated and/or described, in other sequences, in parallel, or omitted. Likewise, the order of the above-described processes may be changed.
[0193] The subject matter of the present disclosure includes all novel and non-obvious combinations and sub-combinations of the various processes, systems and configurations, and other features, functions, acts, and/or properties disclosed herein, as well as any and all equivalents thereof.

Claims

35
CLAIMS A root cause analysis service consumer (101) operable in a telecommunication network comprising one or more entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane, wherein the root cause analysis service consumer (101) comprises :
- means for receiving a root cause analysis report from a root cause analysis service provider (102), the root cause analysis report being generated based on root cause analytics, the root cause analytics being generated by performing a collection of root cause analysis data from the one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider (102) with a data analytics producer (103), one of the root cause analysis service provider (102) and the data analytics producer (103) being a control plane data analytics producer producing analytics in the control plane and the other being a management plane data analytics producer producing analytics in the management plane. A root cause analysis service provider (102) operable in a telecommunication network comprising one or more network entities and having a network architecture comprising a plurality of planes, the plurality of planes comprising at least a control plane and a management plane, wherein the root cause analysis service provider (102) comprises: means for generating root cause analytics by performing a collection of root cause analysis data from the one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider (102) with a data analytics producer (103), one of the root cause analysis service provider (102) and the data analytics producer (103) being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane; means for generating a root cause analysis report based on the root cause analytics. The root cause analysis service provider (102) of claim 2, comprising: means for receiving a request for root cause analysis from a root cause analysis service consumer (101); 36 means for sending a response on the request for root cause analysis to the root cause analysis service consumer (101), the response comprising the root cause analysis report. The root cause analysis service provider (102) of any preceding claim 2 to 3, wherein the collection and combined processing of root cause analysis data is coordinated by the root cause analysis service provider (102) upon detecting one or more abnormal events at the management plane or at the control plane, the one or more abnormal events being detected at one or more network entities, the root cause analysis report comprising information for identifying the one or more entities. The root cause analysis service consumer of claim 1 or the root cause analysis service provider (102) of claim 4, wherein the root cause analysis report comprises information related to the one or more abnormal events detected at the control plane or at the management plane and information related to one or more corrective actions for correcting the one or more abnormal events. The root cause analysis service provider (102) of any preceding claim 2 to 5, wherein the root cause analysis service provider (102) is a control plane data analytics producer (102) and the data analytics producer (103) is a management plane data analytics producer (103), the control plane data analytics producer (102) comprising: means for receiving trigger information from the management plane data analytics producer (103), the trigger information indicating one or more abnormal events detected by the management plane data analytics producer (103) at the management plane; means for triggering the collection of root cause analysis data and for triggering the generation of root cause analytics at the management plane by the management plane data analytics producer (103) depending at least on the trigger information; means for generating root cause analytics by processing input data, the input data comprising the root cause analysis data collected by the control plane data analytics producer (102) and root cause analytics generated by the management plane data analytics producer (103) from the root cause analysis data collected by the management plane data analytics producer (103); means for generating a root cause analysis report based on the root cause analytics. The root cause analysis service provider (102) of claim 6, wherein the triggering of the collection of root cause analysis data and the triggering of the generation of root cause analytics at the management plane depend further on load information and/or one or more exceptional conditions related to the one or more network entities. The root cause analysis service provider (102) of any preceding claim 2 to 5, wherein the root cause analysis service provider (102) is a management plane data analytics producer and the data analytics producer (103) is a control plane data analytics producer (103), the management plane data analytics producer (102) comprising : means for receiving trigger information from the control plane data analytics producer (103), the trigger information indicating one or more abnormal events detected by the control plane analytics producer (103) at the control plane; means for triggering the collection of root cause analysis data and for triggering the generation of root cause analytics at the control plane by the control plane data analytics producer (103) depending at least on the trigger information; means for generating root cause analytics by processing input data, the input data comprising the root cause analysis data collected by the management plane data analytics producer (102) and root cause analytics generated by the control plane data analytics producer (103) from the root cause analysis data collected by the control plane data analytics producer (103); means for generating a root cause analysis report based on the root cause analytics. The root cause analysis service consumer (101) of claim 1 or the root cause analysis service provider (102) of any preceding claim 2 to 8, wherein the control plane data analytics producer is a network data analytics function and the management plane data analytics producer is a management data analytics function or a management data analytics service. The root cause analysis service consumer (101) of any preceding claim 1 and 9 or the root cause analysis service provider (102) of any preceding claim 2 to 9, wherein the root cause analysis data comprise at least measurements data generated by the one or more network entities, the measurements data being one or more of performance measurements data, communication measurements data, platform computing measurements data, and security-related measurements data. The root cause analysis service consumer (101) of claim 10 or the root cause analysis service provider (102) of claim 10, wherein the communication measurements data comprise traffic measurements data. The root cause analysis service consumer (101) of any preceding claim 10 to 11 or the root cause analysis service provider (102) of any preceding claim 10 to 11 , wherein the platform computing measurements data comprise information related to software activity and software resources used by the one or more network entities. The root cause analysis service consumer (101) of any preceding claim 10 to 12 or the root cause analysis service provider (102) of any preceding claim 10 to 12, wherein the security-related measurements data comprise information related to privileged user activity on the one or more network entities and information related to security mechanisms used in the one or more network entities. A method comprising: generating (703) a root cause analysis report based on root cause analytics generated by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by a root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by at least one processor at an apparatus, cause the apparatus to perform the method according to claim 14. An apparatus comprising at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to perform:
- reception of a root cause analysis report from a root cause analysis service provider, the root cause analysis report being generated based on root cause analytics, the root cause analytics being generated by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the root cause analysis service provider with a data analytics producer, one of the root cause analysis service provider and the data analytics producer being a control plane data analytics producer producing analytics in the control plane and the other being a management plane data analytics producer producing analytics in the management plane. An apparatus comprising at least one processor; and at least one memory including computer program code; 39 the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to perform:
- generation of root cause analytics by performing a collection of root cause analysis data from one or more network entities and performing a combined processing of the root cause analysis data, the collection and the combined processing of the root cause analysis data being coordinated by the apparatus with a data analytics producer, one of the apparatus and the data analytics producer being a control plane data analytics producer producing data analytics in the control plane and the other being a management plane data analytics producer producing data analytics in the management plane;
- generation a root cause analysis report based on the root cause analytics.
PCT/EP2021/078267 2021-10-13 2021-10-13 Devices and methods for root cause analysis in telecommunication networks WO2023061568A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/EP2021/078267 WO2023061568A1 (en) 2021-10-13 2021-10-13 Devices and methods for root cause analysis in telecommunication networks

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/EP2021/078267 WO2023061568A1 (en) 2021-10-13 2021-10-13 Devices and methods for root cause analysis in telecommunication networks

Publications (1)

Publication Number Publication Date
WO2023061568A1 true WO2023061568A1 (en) 2023-04-20

Family

ID=78134979

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/EP2021/078267 WO2023061568A1 (en) 2021-10-13 2021-10-13 Devices and methods for root cause analysis in telecommunication networks

Country Status (1)

Country Link
WO (1) WO2023061568A1 (en)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200154292A1 (en) * 2018-11-09 2020-05-14 Huawei Technologies Co., Ltd. Method and system of performance assurance with conflict management in provisioning a network slice service
US20200259700A1 (en) * 2019-02-08 2020-08-13 Ciena Corporation Systems and methods for proactive network operations
US20210058302A1 (en) * 2018-05-11 2021-02-25 Huawei Technologies Co., Ltd. Control plane entity and management plane entity for exchaning network slice instance data for analytics

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210058302A1 (en) * 2018-05-11 2021-02-25 Huawei Technologies Co., Ltd. Control plane entity and management plane entity for exchaning network slice instance data for analytics
US20200154292A1 (en) * 2018-11-09 2020-05-14 Huawei Technologies Co., Ltd. Method and system of performance assurance with conflict management in provisioning a network slice service
US20200259700A1 (en) * 2019-02-08 2020-08-13 Ciena Corporation Systems and methods for proactive network operations

Similar Documents

Publication Publication Date Title
US10574512B1 (en) Deep learning architecture for collaborative anomaly detection and explanation
US11797883B2 (en) Using raw network telemetry traces to generate predictive insights using machine learning
US11102219B2 (en) Systems and methods for dynamic analysis and resolution of network anomalies
US11165656B2 (en) Privacy-aware model generation for hybrid machine learning systems
US20210281492A1 (en) Determining context and actions for machine learning-detected network issues
US20190370218A1 (en) On-premise machine learning model selection in a network assurance service
US11212079B2 (en) Seamless rotation of keys for data analytics and machine learning on encrypted data
US11405802B2 (en) Roaming and transition patterns coding in wireless networks for cognitive visibility
US10601676B2 (en) Cross-organizational network diagnostics with privacy awareness
Arnaz et al. Toward integrating intelligence and programmability in open radio access networks: A comprehensive survey
Iyer et al. Automating diagnosis of cellular radio access network problems
US11625241B2 (en) Predicting the impact of network software upgrades on machine learning model performance
US20230262489A1 (en) Apparatuses and methods for collaborative learning
US20230267326A1 (en) Machine Learning Model Management Method and Apparatus, and System
Yang et al. Fog intelligence for network anomaly detection
Lin Artificial intelligence in 3gpp 5g-advanced: A survey
Yu et al. Self‐Organized Cell Outage Detection Architecture and Approach for 5G H‐CRAN
Lee et al. Federated learning-empowered mobile network management for 5G and beyond networks: From access to core
WO2023061568A1 (en) Devices and methods for root cause analysis in telecommunication networks
Yungaicela-Naula et al. Misconfiguration in O-RAN: Analysis of the impact of AI/ML
EP4134848B1 (en) Devices and methods for security and operational behavior assessment of software services
EP4120075A1 (en) Devices and methods for network-related events processing
Apostolou et al. In the fog: Application deployment for the cloud continuum
Zeng et al. Big Data in Smart Grid and Edge Computing of the IoT
US11860744B2 (en) Communication network data fault detection and mitigation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21790888

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE