MULTIVARIATE TIME SERIES UNSUPERVISED ANOMALY DETECTION AND DIAGNOSIS IN 5G NETWORKS

For a variety of reasons (including, for example, increasing cyber security threats, increased network heterogeneity, the increased use of virtualization technologies, etc.) maintaining the fifth generation (5G) networks of tomorrow will be challenging. To address such challenges techniques are presented herein that support a multivariate time series unsupervised method for anomaly detection using Key Performance Indicators (KPIs) that are derived from various infrastructure level metrics collected from all kinds of networking nodes deployed in 5G networks. Multivariate time series unsupervised anomaly detection is the future of anomaly detection with systems generating real-time time series data but this is an area that has not yet been explored with 5G. This invention introduces anomaly detection in 5G networks at the node level or deployment level instead of simply monitoring anomalous behavior in a particular KPI on a particular node. Additionally, aspects of the techniques presented herein provide a semi-automated method for anomaly diagnosis and deep-dive anomaly analytics in support of better systems of the future. The main focus herein lies in anomaly detection in modern 5G network deployments at the complete node or deployment level using infrastructure level data from 5G nodes to detect and prevent network failures. We present a multivariate time-series unsupervised AI algorithm to solve this problem which helps detect anomalous behavior and in turn facilitates better network troubleshooting and capacity forecasting. DETAILED DESCRIPTION Maintaining the 5G networks of tomorrow is set to be a challenging domain due to increasing cyber security threats and widening attack surfaces created by the Internet of Things (IoT), increased network heterogeneity, increased use of virtualization technologies, 2 Ghosh and Kataria: MULTIVARIATE TIME SERIES UNSUPERVISED ANOMALY DETECTION AND DIAGN Published by Technical Disclosure Commons, 2020 2 6570 and distributed architectures with many 5G nodes consuming significant amounts of memory and central processing unit (CPU) capacity. Techniques are presented herein that support a software defined anomaly detection system based on neural networks, a subdomain of artificial intelligence (AI), which focuses on acquiring infrastructure level metrics from nodes used in 5G deployments at the infrastructure level (through, for example, bulk statistics from UPF nodes or Structure of Management Information (SMI) statistics generated from Virtual Network Functions (VNFs) or Simple Network Management Protocol (SNMP) polled metrics from transport nodes), calculating KPIs based on the acquired metrics, and feeding the time series KPIs into complex neural network models for anomaly detection and diagnosis to facilitate the detection of early symptoms and thus network failure prevention. Aspects of the techniques that are presented herein introduce an unsupervised multivariate time series anomaly detection mechanism in support of maintaining and preventing failure in nodes used in 5G network deployments. This technique introduces monitoring anomalous behavior in 5G networks on the complete node level or deployment level by monitoring/using multiple KPIs from a single node or a combination of various KPIs from multiple nodes deployed in the network. Learning complex dependencies between multiple time series in high frequency data is a difficult task demanding complex AI algorithms. While such an approach is the future of anomaly detection in systems generating time series data, it is an area which has not yet been explored in 5G network anomaly detection and analysis. Aspects of the techniques that are presented herein pave the way for improved anomaly diagnosis with the help of better root cause analysis, anomaly severity identification through more accurate anomaly scoring, which when combined with smart rules pave the way for network failure prevention using an semiautomated approach. We can achieve this for example by introducing rules to trigger network orchestration services for node configuration management Further, this approach paves the way for deep dive anomaly analytics which facilitates future capacity forecasting and better systems of tomorrow. Aspects of the techniques presented herein encompass a number of elements that are of particular interest and note. Various of those elements will be described and discussed below. At multiple places the words nodes, system and deployment are used 3 Defensive Publications Series, Art. 3873 [2020] https://www.tdcommons. org/dpubs_series/3873 3 6570 interchangeably. A node would mean a particular node in the 5G network deployed. A deployment would mean the entire deployment comprising of various nodes. Our approach can also be used for a combination of KPIs from multiple nodes. Thus, collectively all 3 are referred to as “system” at places in the document. A first element of interest and note concerns the algorithmic approach to the particular use case. Aspects of the techniques presented herein apply multivariate time series anomaly detection techniques to metrics that are accumulated from each 5G node that is deployed in a network operator’s broad network. This departs from the traditional univariate anomaly detection system which demands separately monitoring every individual component of a 5G node in the deployment(e.g., separately monitoring, among other things, each CPU, random access memory (RAM) usage, etc.), which in turn adds significant confusion to whether just a single component showing anomalous behavior would require any action to be taken on the system. With multivariate anomaly detection the system as a whole is checked to determine if it is showing anomalous behavior which would demand quick actions to be taken before the node, and in turn the network, breaks down. By incorporating a time series approach, anomalies may be detected based on the patterns found in previous time steps and not in, for example, a single time step. This becomes useful in systems producing data which is time-dependent (e.g., CPU usage over the last time steps helps to detect whether the CPU usage at the current time step is anomalous). See, e.g., Figure 1, below. Figure 1: Illustrative Example of Multivariate Time series data 4 Ghosh and Kataria: MULTIVARIATE TIME SERIES UNSUPERVISED ANOMALY DETECTION AND DIAGN Published by Technical Disclosure Commons, 2020 4 6570 Further, aspects of the techniques presented herein employ an unsupervised approach to the learning algorithm. Modern networks have a very low positive anomaly rate. However, a single failure can cost the carrier a significant amount of money. But the low number of positive anomaly cases makes it difficult for supervised AI algorithms to learn the patterns behind an anomaly. Most previous anomaly detection systems in cellular networks are supervised and require the manual labelling of anomalies by experts and a significant number of positive anomaly cases so that the network can learn what anomaly and non-anomaly data points look like. This is due to the absence of complex and advanced algorithms that are capable of learning. The unsupervised nature of the algorithm that is employed under aspects of the techniques presented herein mitigates the need for manual labelling of the data and the need for a high number of positive anomaly cases in the data. The nature and the complexity of the algorithm helps find complex dependencies and correlations between multiple variables in time series data which, in turn, helps to create a strong representation of the input data with anomalies scored based on the reconstruction error. The model is trained on just non-anomalous data points and the main task here for the model is to recreate the same. Whenever a new data point comes in, the algorithm weights recreate the data point and if it is not well re-created it is deemed to be an anomaly. Further still, aspects of the techniques presented herein address robustness to noise, anomaly scoring, and root cause identification. From the manner in which the AI algorithm and neural network are framed, the raw data is first converted into signatures using pairwise correlations and then feed into the network. This specific methodology makes the algorithm robust to all kinds of input noise that are very prevalent in real-time data in largescale systems, also facilitates better anomaly detection/scoring and root cause identification. Well-established multivariate anomaly detection algorithms like the Auto Regressive Integrated Moving Average (ARIMA) perform well when the correlation among multiple features is linear and the input process is strictly ergodic. Multivariate time series anomaly detection with unsupervised AI algorithms, although a rapidly emerging field, has not been explored in cellular networks, especially in 5G networks where high volumes of time series data are generated by various components of a node or by various actions of end users. The instant algorithmic approach is mostly a compilation 5 Defensive Publications Series, Art. 3873 [2020] https://www.tdcommons. org/dpubs_series/3873 5 6570 of prior research made in the AI-based anomaly detection space but its application to 5G networks with infrastructure level node KPIs and it’s application to complete node/deployment level anomaly detection is something that has yet been unexplored. Also, the neural network architecture from the number of layers and components used, and the type of layers used at various points, which is mostly dependent on the type of input data in most cases, is novel and fits well to the current use case as described herein. A second element of interest and note concerns the detection of early symptoms and semi-automated troubleshooting. Aspects of the techniques presented herein detect early symptoms of network failure or outage and inform a network engineer of the root cause of the anomaly and anomaly severit