Intelligent data analytics collectors

Aspects of the subject disclosure may include, for example, generating a instruction set according to a data analytics collection strategy and identifying first and second network devices adapted to perform first and second types of network functions, respectively, within a communications network, wherein the first and second types of network functions are different. First and second collectors are instantiated in association with the first and second network devices, respectively, and the instruction set is provided to each of the first and second collectors. The first and second collectors are adapted to autonomously execute first and second segments of the instruction set according to the first and second types of network function to obtain first and second collection results, respectively, wherein network analytic functions are adapted to process the first and second collection results. Other embodiments are disclosed.

FIELD OF THE DISCLOSURE

The subject disclosure relates to intelligent data analytics collectors.

BACKGROUND

Network resiliency is of critical importance to network operators, service providers, and associated end users. Everyone expects “always on” network connectivity and any down time can result in lost revenue, opportunities, etc. As such, various operations, administration, and maintenance (OAM) instrumentation techniques are available at one or more network levels. Operators intently monitor OAM at the different network levels. Use cases include network monitoring, network security monitoring, Network optimization, business process optimization.

Network monitoring products are available to collect data from a network, analyze it, and present actionable information to a network manager. Example monitoring tools include packet-monitors, network flow collectors, and device-metric monitors. The process of collecting and analyzing network data often includes data obtained by proprietary methods of various equipment vendors. Ideally, each vendor would provide the necessary data, at the right time, the appropriate scale and in the right format. Unfortunately, this is often not the case. The various vendor monitoring techniques produce metadata, that when processed at scale can burden operation of the network.

Providers of communication services are currently implementing network function virtualization (NFV), in which network functions are ported to virtualized environments to enable a migration of services to a cloud-based infrastructure. In some implementations, a software defined network (SDN) controller supports virtualized network functions. Accordingly, network monitoring products can be used in physical, virtualized or combinations of physical and virtualized network applications.

DETAILED DESCRIPTION

The subject disclosure describes, among other things, illustrative embodiments for an infrastructure and process that implements a customizable data collection strategy among a variety of different devices and/or subsystems of a network. In particular, data analytics functionality is implemented by way of a common instruction set that provided to all of the different network devices and/or subsystems for which data is to be collected during a data collection interval. According to the infrastructure, the same instructions are implemented differently, according to the target device and/or subsystem. Other embodiments are described in the subject disclosure.

One or more aspects of the subject disclosure include a process that includes determining, by a processing system including a processor, a data analytics collection strategy. A common machine-readable instruction set is generated by the processing system a according to the data analytics collection strategy. A first network device is identified by the processing system and adapted to perform a first type of network function within a communications network. Likewise, a second network device is also adapted to perform a second type of network function within the communications network, wherein the first type of network function and the second type of network function are different. A first analytics collection device in association with the first network device is instantiated by the processing system. Likewise, a second analytics collection device in association with the second network device is also instantiated by the processing system. The common machine-readable instruction set is forwarded by the processing system to the first analytics collection device and to the second analytics collection device according to a first collection period. The first analytics collection device is adapted to autonomously execute a first group of instructions of the common machine-readable instruction set according to the first type of network function to obtain first collection results during the first collection period. Likewise, the second analytics collection device is also adapted to autonomously execute a second group of instructions of the common machine-readable instruction set according to the second type of network function to obtain second collection results during the first collection period. Network analytic functions are adapted to process the first collection results and the second collection results according to the data analytics collection strategy.

One or more aspects of the subject disclosure include a non-transitory, machine-readable medium that includes executable instructions that, when executed by a processing system including a processor, facilitate performance of operations. The operations include identifying a data analytics strategy and generating a common instruction set according to the data analytics strategy. A first network device adapted to perform a first type of network function within a communications network is identified. Likewise, a second network device adapted to perform a second type of network function within the communications network is also identified, wherein the first type of network function differs from the second type of network function. A first analytics collector is instantiated in association with the first network device and a second analytics collector in association with the second network device. The common instruction set is provided to the first analytics collector and to the second analytics collector, wherein the first analytics collector is adapted to autonomously execute a first subset of the common instruction set according to the first type of network function to obtain first collection results and the second analytics collector is adapted to autonomously execute a second subset of the common instruction set according to the second type of network function to obtain second collection results. Network analytic functions are adapted to process the first collection results and the second collection results according to the data analytics strategy.

One or more aspects of the subject disclosure include a device having a processing system that includes a processor and a memory that stores executable instructions. The executable instructions, when executed by the processing system, facilitate performance of operations. The operations include determining a data analytics strategy and generating an instruction set according to the data analytics strategy. A first network device adapted to perform a first type of network function is identified. Likewise, a second network device adapted to perform a second type of network function is also identified, wherein the first type of network function differs from the second type of network function. A first collector is provided in association with the first network device and a second collector is also provided in association with the second network device. The instruction set is provided to the first collector and to the second collector, wherein the first collector is adapted to execute a first segment of the instruction set according to the first type of network function to obtain first collection results and the second collector is adapted to execute a second segment of the instruction set according to the second type of network function to obtain second collection results. A network analytic function is adapted to process the first collection results and the second collection results according to the data analytics strategy.

The present disclosure broadly discloses devices, computer-readable media and methods for instantiating and/or adapting virtual machines of a network function virtualization infrastructure to perform tasks in accordance with a common set of instructions to collect network analytic in support of functional network analytics in a telecommunications network. For instance, examples of the present disclosure provide a platform to instruct a group of data analytics collectors according to a common instruction set to perform data analytics collection tasks in association with network devices in support of network analytics functions in a telecommunication network. In particular, examples of the present disclosure provide a robust environment for emerging and scalable deep observability that is structured in a unified and collaborative abstraction model. In one example, a data analytics collection (DAC) strategy provides a unified instruction set to enable a network analytics application (or an administrator) to instrument DAC devices to collect network control plane data in association with target network devices, to correlate or to otherwise process the control plane data, and to transport results to collection devices or to a network analytics application in a meaningful way. For instance, a network analytics application may generate a set of DAC instructions to configure different DAC collectors to collect control plan data in association with target network-based devices and in at least some applications, to perform real-time analytics that are dynamic and programmable. In one example, the DAC collectors and/or network-based devices can include one or more of configurable virtual machines (VMs), general purpose smart network interface cards (NICs), routers, switches, network edge devices, mobile communications devices, radios, radio controllers, network accessible devices, that in at least some instances participate in machine-type or machine-to-machine (M2M) communications, e.g., according to an Internet of Things (IoT) scenario, compute or storage environments, and so forth.

Big data approaches to network analytics may lack real-time capabilities, e.g., due to the sheer volume of data. Such approaches may also lack scalability, e.g., as a result of being customized for specific applications. In contrast, examples of the present disclosure provide a unified approach to network analytics to instruct and configure network devices to perform diverse network analytics functions in real time. For example, in accordance with the present disclosure, network analytics applications can use a common set of instructions promulgated to the same or different devices to implement DAC operations in association with the same or different network devices that operate according to the same or different network functions.

The common set of instructions can be implemented by different devices or similar devices of different vendors, according to an abstraction interface, e.g., an application programming interface (API), to define a DAC function, e.g., a set of instructions including a series of parameters, conditions, actions, etc., at a high level, and compile the high level set of instructions into a DAC instruction set that provides “n” instruction categories. For instance, the categories include instructions for input flow data acquisition, e.g., the types of control plane data desired, how to collect the data, e.g., divert the data, make a copy of the data, etc., the target network devices, or instantiate, enlist or otherwise utilize other “agents,” to participate in the collection of network information in support of network analytics functions, and so forth. The categories can also include instructions to configure network devices to process the collected control plane data, instructions on how the processing is to be adapted in response to certain conditions, and instructions on how results are distributed or abstracted for consumption by the requesting network analytics application or another recipient device.

In one example, a network analytics application defines a set of instructions via a functional network analytics (FNA) platform API. The instructions are compiled into a FNA platform-based instruction set (also referred to herein as a “set of FNA instructions”) that is understandable to network devices/agents that are FNA platform enabled. The network analytics application then selects one or more available agents for execution of the FNA platform-based instruction set. For example, the FNA platform-based instruction set may include a device plug-in for configuring one or more FNA platform-enabled agents. The agent(s) is/are then responsible for execution of the FNA platform-based instruction set into actionable triggers. In one example, the agent(s) may select one or more “worker” devices to execute specific tasks as part of the FNA-platform based instruction set. In one example, the “worker” devices may be selected based upon the particular capabilities, locations, and access to different types of control plane data which may be called for by the FNA platform-based instruction set. For instance, an agent may select a first network device as a “worker” to collect a first type of control plane data and a second network device as a “worker” to collect a second type of control plane data. The first and second network devices may then forward the first and second types of control plane data to the agent, where the agent may then correlate and otherwise process the first and second types of control plane data as part of an overall network analytics function defined in the FNA platform-based instruction set. Thus, in one example, the worker device(s) are configured with specific skills for the durations of the respective tasks by the agent(s). In one example, the agent(s) are open interface and their performance is managed via the FNA platform-based instruction set. In one example, the worker devices may also include virtual machines (VMs), e.g., operating on a host devices/network function virtualization infrastructure (NFVI). In one example, the host devices may primarily be configured to provide VMs for various functions, or may include devices which are primarily dedicated to performing a particular network function, e.g., a router, switch, etc., but which may have a portion of the hardware resources set aside for being configured and reconfigured as VM(s).

In one example, the FNA platform provides a library with various network analytics function primitives. The primitives may have boundaries that are limited in scope (such as a primitives for an adder, a subtraction counter, a jitter sensor, an inter-arrival average rate measurement, a round trip delay measurement, etc.) but which can be made dynamic through instructions entered via the API. In one example, the library of primitives may grow as it is enhanced through repeated creation of FNA platform-based instruction sets. In addition, the capabilities of agents and workers may be enhanced within the context of performance/execution of one or more tasks in accordance with a particular FNA platform-based instruction set. For instance, the FNA platform-based instruction set may provide instructions to perform differently depending upon various triggers/conditions which may be encountered. Thus, the agent and/or the worker devices may adapt to the changing network conditions.

Examples of the present disclosure may operate in a highly scalable environment, such as a telecommunication network data center, with a large number of dedicated servers, switches, storage devices, smart NICs and so forth that are enabled with computing and memory hardware for execution of algorithms in a trusted execution environment. In one example, a hypervisor provides security to authenticate the agent(s) requesting the services of worker devices, e.g., virtual machines (VMs). The benefits extend to support large number of vertical markets including automation, and control over a large number of resources that are unified in skills and capabilities and with programmability across various servers, storage devices, and networking equipment. Examples of the present disclosure therefore enable real-time and collaborative network analytics. The devices utilized in examples of the present disclosure may also capitalize on open technologies such as hypervisors, operating systems, communication protocols, and the like, as well as the present open FNA platform as described herein. These and other aspects of the present disclosure are discussed in greater detail below in connection with the examples ofFIGS. 1-4.

Referring now toFIG. 1, a block diagram is shown illustrating an example, non-limiting embodiment of a communications network100in accordance with various aspects described herein. For example, communications network100can facilitate in whole or in part a distributed analytics collection system180adapted to collect information related to operation and/or maintenance of all or one or more portions, segments and/or devices of the communications network100. In particular, a communications network125is presented for providing broadband access110to a number of data terminals114via access terminal112, wireless access120to a number of mobile devices124and vehicle126via base station or access point122, voice access130to a number of telephony devices134, via switching device132and/or media access140to a number of audio/video display devices144via media terminal142. In addition, communication network125is coupled to one or more content sources175of audio, video, graphics, text and/or other media. While broadband access110, wireless access120, voice access130and media access140are shown separately, one or more of these forms of access can be combined to provide multiple access services to a single client device (e.g., mobile devices124can receive media content via media terminal142, data terminal114can be provided voice access via switching device132, and so on).

In some embodiments, the distributed analytics collection system180includes a collector controller182and one or more collector devices184a-184i, generally184. The collector devices184can be positioned at predetermined locations within the network100. Locations can include physical locations, e.g., at a data center, at a base transceiver station, and/or at any other network device, including without limitation network nodes and network-enable devices, such as end user devices and/or terminals. Alternatively or in addition, the collector devices184can be positioned at a predetermined network location according to an architecture of the network100.

According to the illustrative embodiment, collector devices184a,184bare respectively configured in association with, within and/or adjunct to network elements156,152. Other data collectors184iare configured within the communications network125, but not configured in association with, within and/or adjunct to any particular network element. For example, network elements150,154are not associated with and/or adjunct to any particular collection devices184. It is understood that in at least some embodiments, only a subset of network elements are monitored. Alternatively or in addition,

The collector devices184are adapted to obtain, gather and/or otherwise collect information. According to a communication network application, the collected information can include information obtained from monitoring of one or more of equipment or device parameters, environmental parameters, control plane or signaling messaging and data plane or data content. In general, network traffic can be abstracted into data traffic and signaling traffic. The data traffic can be referred to as occurring within a data plane; whereas, signaling traffic that supports the exchange of data traffic can be referred to as occurring within a control plane. Equipment device parameters can include, without limitation, power, e.g., power consumption, and/or capacity, radio transmitted and/or received signal power, processing, e.g., processing utilization and/or capacity, and port utilization and/or capacity. Environmental parameters can include, without limitation, thermal load and/or ambient temperature. Control plane or signaling messaging can include, without limitation, error rates, error correction, jitter, delay, e.g., packet delay, round trip delay, quality of service (QoS) and priority status. Data plane or data messaging can include, without limitation, data type, e.g., voice, video, file transfer, message service, and data size.

In some embodiments, the network includes an analytics processor186(shown in phantom). In some embodiments, the analytics processor186is hosted on a server platform that may be collocated with the collector controller182, or accessible via a network connection, e.g., within the cloud. The analytics processor186can be in communication with the collector controller182. In at least some embodiments, the analytics processor186can be in further communication with one or more of the collector devices184.

FIG. 2Ais a block diagram illustrating an example data analytics collection system200in accordance with various aspects described herein. The collection system200includes a data analytics controller201in communication with first and second root collectors205,207. The first root collector205is associated with a first device203and the second root collector207is associated with a second device206. One or more of the devices203,206can be a host device, such as might be provided according to a network function virtualization infrastructure (NFVI). In such instances, one or more of the root collectors205,207can be implemented as virtual machines hosted by the NFVI203,206, e.g., according to a software defined network (SDN) architecture. Alternatively or in addition, one or more of the devices203,206can be physical device, such as a host processor that supports operation of the root collector205,207, or a function added to or otherwise implemented within the devices203,206. In other applications, one or more of the devices203,206can be a network element, such as a router, a switch, a gateway, a core network element, a network capable end user device, or more generally, any of the various network and/or end user devices disclosed herein. It is envisioned that for a particular device203, say a router, the root collector205may be implemented as a set of functions inside a control plane of the device203. Alternatively or in addition, the instructions may be adjunct to the device, e.g., in a common virtual machine of a SDN architecture, or as an independent network collection device, e.g., an independent physical node.

The data analytics controller201generates a computer-readable instruction set202aand forwards, pushes, injects or otherwise provides the instruction set202ato each of the root collectors205,207. In general, the instruction set202includes a common set of instructions that are disseminated by the data analytics controller201to an arbitrary number of root collectors. The same instruction set is disseminated without particular regard to functionality of a particular target device and/or a particular vendor or source of the target device. Namely, the same instruction set is sent to a network router of a first vendor, a network router of a second vendor, a first switch of a first vendor, a second switch of a second vendor, a first mobile terminal of a first vendor, a second vendor of a second mobile terminal and so on. Despite this common set of instructions being applied to all root data collectors, regardless of target functionality or source, execution of the instruction set causes the recipient root collector to respond or otherwise react differently according to the particular target with which the root collector is affiliated.

The same instruction set can facilitate synchronization by injecting the same instructions to different collectors205,207at the same time. The instructions, once injected by the controller201, can executed autonomously by each of the root collectors205,207. Each collector autonomously executing the common instruction set can exhibit synchronized behavior. For example, execution of the instructions may result in updates according to some time interval or some instruction in the instructions that results in a start of execution of a portion of a function in response to an event, e.g., a trigger, or at certain time of day. Similarly, the collectors can be adapted to execute a different function, or a different part of the injected common instruction according to a condition, such a certain load/condition.

In this regard, the instruction set202acan be analogized to “DNA,” whereas the root collectors205,207and/or the devices203,206are analogous to cells of different parts of a body. It is generally understood that all cells in a multicellular organism contain the same DNA. Information carried by DNA is held in sequences of pieces of DNA called genes. The DNA accumulates molecular changes that educate the cell about its eventual role. Just as cells of a foot and cells of an eye receive the same DNA, different portions of the DNA are responsible for determining whether a particular cell functions as part of a foot or part of an eye. Likewise, the same instruction set202a, i.e., DNA, can be provided to all root collectors205,207, i.e., cells, whereas different segments204of the instruction set202a, i.e., genes, are operative according to a location and/or function of a target of the root collector205,207.

In at least some applications, the same instruction set202ais forwarded to both of the root collectors205, without regard to roles, applications, types, and/or vendors of the devices203,206. According to the illustrative example, the instruction set202aincludes a number of different segments, partitions, sections, and/or modules204a,204b,204c,204d,204e, referred to collectively as segments204. As a consequence of the forwarding of the same instruction set202a, the first root collector205is injected or otherwise provided with a first copy of the instruction set202a′ and the second root collector207is injected or otherwise provided with a second copy of the instruction set202a″. According to the illustration, each copy of the instruction set202a′,202a″ includes copies of all of the same modules204provided by the data analytics controller201.

It is envisioned that the same and/or different segments204′,204″ of the injected copies of the instruction sets202a′,202a″ may be operative according to the first and second root collectors205,207. Precisely which segments204are operative in or on a particular root collector205,207can be a consequence of one or more of a function performed by the particular root collector205,207, a type of machine hosting the particular root collector205,207, a vendor of the particular root collector205,207, a function, type and/or vendor of the particular device203,206.

According to the illustrative embodiment, a first segment204a′ of the first copy of the instruction set202a′ is operative within the first root collector205. The other segments, namely segments204b′,204c′,204d′,204e′, are not operative according to the illustrative example. Likewise, a third segment204c″ of the second copy of the instruction set202a″ is operative within the second root collector207, while the other segments, namely segments204a″,204b″,204d″,204e″, are not operative according to the illustrative example. It is understood that more than one segments204′,204″ may be operative at any given time and there may be partial and/or complete overlap of the particular groups of operative segments204′,204″ implemented by the first and second root collectors207.

Different root collectors205,207are provided at different targeted network device203,206and/or different network locations. These target devices are configured, adapted or otherwise responsible for implementing a particular functionality by way of the common instruction set202. The different root collectors205,207are driven by the same instructions during the same collection interval. The same or common instruction sets202passed to the targeted collectors205,207to enable the collection of the right amount of information, in the format, with the right filtering, and to pass collected information upward, e.g., to a functional network analytics (FNA) engine208. What determines the “right” amount of information, the “right” format and the “right” filtering can depend upon one or more of the type of target device203, network conditions, triggering events, and the like.

By way of example, operative segments204of the common instruction set can cause the root collectors205,207to implement one or more of capturing states, e.g., of a device and/or segment of the network, creating counters, adding some values, measuring other values. For example, the instruction set can inject functionality into the root collector to measure a power level of a radio at a certain temperature or certain environmental condition as may be described within the common instruction set. In another example, execution of the common instruction set can cause the collector to start measuring inter arrival time of packets or buffer overload responsive to a determination that the network is congested at a certain point.

It is envisioned that in at least some embodiments, the instruction segments204can be classified, identified and/or otherwise arranged into groups that are applicable to particular devices and/or applications. Such an arrangement provides some measure of distinguishability among the different types of segments204. For example, a segment can be associated with a machine-readable tag or identification (ID), e.g., an alphanumeric code. Such codes can be dictated and/or determined according to an industry standardization process. Thus, while some groups, e.g., some types or IDs might be applicable to routers, or switches, other groups, types or IDs might be relevant to end user devices. Accordingly, each different type of device can be configured to interpret and/or otherwise implement only those segments that are applicable to the particular device and/or function. Accordingly, each device203,206receives the same instruction set202a, but interprets and/or otherwise implements only those segments that are applicable to the type and/or function of the associated device203,206. In at least some embodiments, other segments204of the common instruction set202athat would not apply to the type of device or function can be essentially ignored.

Each instruction set202operates in a collection interval. Beneficially, the instruction set202allows collector instructions can change for different collection intervals. Namely, the SDC defines what the DNA should do in the next interval. Intervals allow collectors to operate in a harmonized and/or synchronous manner. In some embodiments, the DAC controller201generates a first instruction set202aand provides the first instruction set202ato the root collectors205,207according to a first data analytics collection period or interval. Each of the root collectors205,207having received the same instruction set202a, enacts to implement the instruction set202aaccording to the device203,206and/or applicable function. The root collectors205,207proceed to collect and in at least some instances, pre-process and/or analyze collected results according to the applicable segments204of the instruction set202a. Implementation of the instruction set202aproduces sets of data analytics collection results at each of the root collectors207. The root collectors207can be adapted to forward and/or otherwise provide their respective results to a predetermined destination, such as a network address of a data analytics processor208. The data analytics processor208, in turn, can further process and/or interpret the data analytics collection results from among the different root collectors205,207.

The DAC controller201can be adapted to generate a second, subsequent instruction set202band provide the second instruction set202bto the root collectors205,207according to a second data analytics collection period or interval. Each of the root collectors205,207having received the same second instruction set202b, enacts to implement the second instruction set202baccording to the device203,206and/or applicable function. The root collectors205,207proceed to collect and in at least some instances, pre-process and/or analyze collected results according to the applicable segments of the second instruction set202b. Implementation of the second instruction set202bproduces second sets of data analytics collection results at each of the root collectors207. The root collectors207can be adapted to forward and/or otherwise provide their respective results as before to a predetermined destination, such as the data analytics processor208. The data analytics processor208, in turn, can further process and/or interpret the data analytics collection results obtained during the second collection period from among the root collectors205,207.

In some embodiments, the first and second instruction sets202a,202bcan be independent, e.g., as in entirely separate data analytic missions implemented during different data collection periods. The data collection periods can be sequential and/or overlap partially or entirely. In some embodiments, the first instruction set202acan be provided to a first set of root collectors205,207, whereas the second instruction set202bcan be provided to a second set of root collectors that may be the same or different than the first set. In at least some embodiments, a data analytics collection process includes identifying one or more of the number, location or type of root collector. Providing for a selection of root collectors as well as the particular instruction set implemented thereby, offers flexibility and adaptability to overall data analytics functionality.

In some embodiments, the second instruction set202brepresents a refinement, improvement, enhancement and/or extension of the first instruction set202a. For example, data analytic collection results obtained in response to execution of the first instruction set202aby the first group of root collectors205,207can be analyzed and/or interpreted. The second instruction set202bcan be generated based on a result of the analysis and/or interpretation and forwarded to the same and/or different group of root collectors205,207to obtain further collection results. Collected data can be shared by using metadata. Details about the network can be learned from the metadata provided by collectors. It is envisioned that such learning may result in a conclusion that adjustments are necessary or would be at least beneficial. For example, it may be determined that a running average interval be adjusted from 1 minute to 1 minutes, or 1 second to 2 seconds. Such adjustments can be implemented by injecting a new instruction set adapted to implement the adjustments.

The illustrative embodiment includes an optional machine learning processor213(shown in phantom). The machine learning processor213can be in communication with the data analytics processor208, to obtain data analytics processing results. The machine learning processor213can evaluate one or more aspects of the results, such as the size of the results, the processing time and/or processing resources used to obtain the results, the number, type and/or location of data collectors used in obtaining the results, accuracy of the results, comparison of results to other results, such as results obtained from different groups of collectors implementing the same and/or different instruction sets, historical records, and the like.

The machine learning processor213may determine from the evaluation of results obtained during the first data analytics collection period that the data analytics strategy should be changed, adjusted or otherwise refined. In response, one or more of the identification of the root collectors205,207and the generation of the instruction set202acan be changed, adjusted or otherwise refined. The learning process can be applied selectively and/or repeatedly.

The instruction sets202a,202bcan be stored in an instruction set repository211. The illustrative example includes an instruction database211that can be adapted to store and/or catalog complete instruction sets. Alternatively or in addition, the instruction database211can be adapted to store and/or catalog individual instruction segments and/or groups of segments. Building or otherwise maintaining an instruction repository211can facilitate roll outs of new instruction sets. It is envisioned that in at least some instances, instruction sets can be injected into root collectors during collection periods that occur in rapid succession. In some embodiments, the instruction sets are stored in association with additional information, such as a data collection strategy, an associated or preferred network configuration and/or condition, a ranking, an effectiveness, a measure of network loading, and so on, that can be used to differentiate between instruction sets when considered for future application. Thus, the data analytics controller201may choose to select a predetermined or otherwise preconfigured instruction set202from the instruction repository211. Alternatively or in addition, the data analytics controller201may choose to generate a completely new instruction set, to modify an existing instruction set and/or to combine portions of different instruction sets.

In some embodiments, the data analytics collection system200includes one or more sub-collector or worker devices209,210. The sub-collector devices209,210can be initiated, directed and/or otherwise controlled by one or more of the root collectors207. According to the illustrative embodiment, the second root collector207associated with the second device206receives the same instruction set202aprovided to the first root collector205associated with the first device203. The second root collector207, responsive to executing respective segments of the instruction set202a, initiates two sub-collectors209,210. In at least some embodiments, the second root collector207provides and/or injects a first sub-instruction set214to the first sub-collector device209and second sub-instruction set215to the second sub-collector device210. The sub-instruction sets214,215may be the same or different. The sub-collector devices209,210execute their respective sub-instruction sets214,215in support of data analytics collection functionality executed at the second root collector. Data analytics results obtained from the sub-collector devices209,210can be passed to one or more of the second root collector207, the data analytics processor208and/or the data analytics controller201and/or the machine learning processor213.

In at least some embodiments, the root collectors205,207and/or sub-collectors209,210are implemented on virtual machines according to a software defined network (SDN) architecture. A SDN controller can be adapted to instantiate one or more of the devices203,206and the root collectors205,207. In some embodiments the SDN controller can include functionality of the data analytics controller201, referred to herein as a software defined collector (SDC) controller. The SDC controller can be adapted to provide distributed intelligence across network infrastructure equipment by using the common instruction set approach disclosed herein.

Beneficially, the use of a common instruction set relieves target device vendors from having to implement a proprietary approach towards data collection. Large telecommunication networks may use hundreds of different types of equipment from multiple different vendors. Without the use of the common instruction set, implementation of a data analytics collection strategy would require dealing with different interfaces, and/or different collection information, very likely in different formats based on whatever private or proprietary means a vendor might provide for a particular piece of equipment. Instead, a requirement can be levied on vendors to simply implement the common instruction set. Features of the single instruction set approach may be dictated by a network service provider, and/or determined according to adoption of an industry standard.

The single instruction set approach in lieu of proprietary data collection methods, allows for a faster innovation by manipulating what can be collected. It is foreseeable that the flexibility of the single instruction set approach would very likely extend lifecycles of equipment. Such standardization would also likely allow for improvements in observability of network operations in a cohesive manner through the instruction set refinements disclosed herein.

In some embodiments, the common instructions202received from the data analytics controller201provide the functionality to the root controller205,207and or the devices203,207. The devices being adapted to execute respective portions of the common instructions202. Alternatively or in addition, the common instructions202provide access and/or control of an equipment vendor's own collection functions. Thus, the vendor's own collection of functions may be accessed, controlled or used according to the common instructions202. The common instructions can be applied to facilitate data analytic collection across very larger number of devices or equipment in a network, e.g., thousands or tens of thousands of devices.

Since it may not be necessary to collect information from all switches in a network, a data analytics collection strategy can identify a sample population of “check points” inside a network. For example collectors on some devices can be effectively turned off, while collectors on other devices are turned on to allow for control of a behavior of the network as a whole. In at least some embodiments, a turning on and off of the collectors can be accomplished by selectively injecting the common instructions. For example, the same instructions are injected to a selected sample set of devices, while no instruction set is injected into others. Execution of the instruction set in a data collection period is thus controlled by the injection of the instruction set.

It is envisioned that some devices and/or root collectors may not be active in a given data collection period. In some embodiments, previously injected instructions, e.g., provided in an earlier data collection period may be purged, deleted, or otherwise deactivated. In some embodiments, the data analytics controller201provides a deactivation command or instruction. Alternatively or in addition, instruction sets are provided with a self-termination feature, such as a time out according to a time and/or an event, such as a trigger.

In at least some embodiments the collectors205,207,209,210can be arranged according to a multi-layer arrangement. In a multi-layer intelligent analytics arrangement, a set of software agents can be installed according software defined methods here known as “Software Defined Collectors” (SDC). T High-level, or root collectors are under control of a data analytics controller201, but once they are instantiated, or “spun-off” and installed as agents inside or adjunct to a VNF or as physical collector node, they can be autonomous. The collectors' autonomousity are driven from the common instruction set or “DNAs” injected to them according to the SDC, e.g., by the data analytics controller201. Some or all collectors continue to be in some measure of synchronization with their respective common instruction set for execution of functions, filter, and algorithms until a new assignment is received in the next interval. The synchronization across the root collectors25,207provides a structured mesh communications among the collectors to guarantee collaboration and interworking among the collectors in atomic time. Each root collector depending on the collected events and associated instruction sets may spin off internal analytics workers, e.g., workers209,210with its locally assigned instruction sets. The root collectors are ultimately responsible for their local thread actions, execute locally but adhere to multi-layer relationships that exist between the collectors.

The coordinated self-structured mesh forming collectors205,207,209,210enable dynamic configuration of workers209,210to match the instruction sets received in each collection period from a Software Defined Collector controller, e.g., the data analytics controller201. The collectors' behaviors are tied to the SDC applications compiled from application data models. Capabilities and behaviors of the collectors205,207,209,210can be managed via simple control APIs such as spin-up/down of collectors can be managed by higher-layer controllers. The collectors can be programed to perform functions such as synchronization of virtual probes for reporting, and or actuation, chaining of the probes for collaborative efforts.

The disclosed techniques support a unified approach for Software Defined collectors (SDC) that can span across both software VNFs as well as hardware components. The SDC can be a subset of a SDN controller which are enforcing application demands and policies for right and lite data collection analytic. Moreover, the techniques support “zero-touch” operation by way of distributed design analytics data collectors that can collaborate, load balance and create an environment for self-organizing measures, e.g., to prevent network anomalies. Local distributed collators that can act as proxy controllers and interact with SDN for dynamic instructions are the basis for adaptive probing. Consistence data collection and alarm correlation distributed across thousands of data collectors for large networks.

FIG. 2Bdepicts an illustrative embodiment of a data analytics process220in accordance with various aspects described herein.

A data analytics collection (DAC) strategy is identified at221. The DAC strategy may be the result of an integrated functional network analytics (FNA) approach, e.g., according to the FNA engine208(FIG. 2A). Alternatively or in addition, the DAC strategy can be determined by the DAC controller201. In at least some embodiments, the DAC strategy is initiated, defined, and/or requested by a network operator, e.g., via an operation and maintenance application and/or through an operator terminal or portal.

Having determined the DAC strategy, a common DAC instruction set is generated at222according to the strategy. In some embodiments, generation of the common DAC instructions includes selection of a previously determined and/or pre-stored instruction, e.g., obtained via an instruction repository211(FIG. 2A). Alternatively or in addition, generation of the common DAC instruction can include modification of a predetermined instruction and/or generation of a completely new common DAC instruction.

One or more DAC targets are identified at223. Identification of the DAC targets can be determined according to an integrated FNA approach, e.g., according to the FNA engine208, by the DAC controller201, e.g., according to a DAC strategy initiated, defined, and/or requested by a network operator, as a result of machine learning improvements to prior collection periods, and the like.

To the extent that the DAC collectors do not already exist in association with identified DAC targets, then the DAC collectors are initiated, instantiated, or otherwise placed and/or activated at224. For SDN applications, the DAC collectors can be instantiated in the identified target devices, as an adjunct device to the target device, or as a completely stand along device.

A common DAC instruction set including all of the same instruction segments is forwarded or otherwise injected or provided to all of the DAC collectors at225. Each of the DAC collectors selectively execute one or more sub-segments, sections or modules of the common DAC instruction set at each DAC collector based on associated target at226. This common instruction set, which includes the same machine readable instructions, when executed by the respective DAC collectors, results in different data analytics functionality according to the target device.

FIG. 2Cdepicts an illustrative embodiment of another data analytics process230in accordance with various aspects described herein. According to the example process230, a data analytics collection (DAC) strategy is determined at231. A common DAC instruction set is generated at232according to DAC strategy. The DAC targets are identified at233, the DAC instructions are forwarded to the DAC targets at234, and the instructions are selectively executed at235according to associated target devices.

Analytics results obtained by the collectors can be provided to another device, such as a functional network analytics engine at236. The DAC collected results can include raw collected data and/or pre-processed data obtained by a pre-processing functionality provided in the common instruction set. In some embodiments, the collected results are passed to the FNA engine via message traffic, e.g., within metadata. Alternatively or in addition, the results can be passed through dedicated messages and/or through other communication paths. For example, collected data analytics may relate to a network adapted to handle Internet data traffic, whereas the collected data analytics can be passed to the FNA engine via another network, e.g., a circuit switched network, such as plain old telephone service, or a backbone of a mobile communications network, and the like.

A determination is made at237aas to whether the initial DAC strategy should be revised. To the extent it is determined at237athat the strategy should not be revised, the process230continues at235, by continuing with selective execution of the DAC instructions at the targets and evaluating the analytics results at236. To the extent it is determined at237athat the DAC strategy should be revised, a revision of the DAC instructions is obtained at238.

A further determination is made at237bas to whether there are any different targets associated with the revised instructions. To the extent there are no different targets, the process230continues at235by selectively executing the revised DAC instructions at the DAC targets, and evaluating analytics results at236. To the extent it is determined at237bthat there are different targets, the process230continues from233, by identifying the different DAC targets, then by selectively executing the revised DAC instructions at the different DAC targets at235, and evaluating analytics results at236, and so on.

In at least some embodiments, a machine learning and/or artificial intelligence can be applied at239(shown in phantom). The machine learning can analyze evaluations of the analytics results obtained at236and determine whether improvements and/or modifications should be implemented to the data analytics strategy and/or the common instruction itself.

FIG. 2Ddepicts an illustrative embodiment of a data analytics process240in accordance with various aspects described herein. According to the process240, a common DAC instruction set is received at a data analytics collector associated with target at241. For example, the common instruction set is received at a first root collector205(FIG. 2A) associated with a target device, e.g., of a telecommunications network.

Depending upon the associated target device, an applicable subset(s) of DAC instruction set is identified at242. The identified subset(s) are processed or otherwise executed by the root collector at243. A determination is made at244as to whether an updated and/or new common DAC instruction set has been received. To the extent that an updated and/or new common DAC instruction set was received, the process240continues from242, identifying target applicable subset(s) of updated/new DAC instruction set, according to the associated target. To the extent that an updated and/or new common DAC instruction set was not received, the process240continues from243, executing the already identified subset(s) of the DAC instruction set.

It is understood that in at least some embodiments, execution of the applicable subsets of the common DAC instructions may terminate. Such terminations can be the result of expiration of a timer, an event, such as a trigger, e.g., obtaining a balanced load, reducing network congestion, reducing network errors below an error threshold, and so on.

FIG. 2Edepicts an illustrative embodiment of another data analytics process250in accordance with various aspects described herein. A common or uniform DAC instruction set is received at251at a collector associated with a target device. A target applicable segment of the DAC instruction set is identified at252, based on an identity of the target. The identified subset of the DAC instructions are executed at253at the collector associated with the target device.

A determination is made at254as to whether the DAC collector requires enlistment of one or more sub-collector agents. To the extent it is determined that an enlistment of one or more sub-collector agents is necessary, a further determination is made255as to whether any of the sub-collector agents already exists. To the extent that any of the sub-collector agents do not already exist, the sub-collector agent(s) are initiated at256. To the extent that it is determined at255that the sub-collector agent(s) do already exist and/or that the sub-collector agent(s) have been initiated at256, the process240proceeds according to the DAC collectors providing instructions to the sub-collector agent(s) at257. The sub-collector agent(s), having received instructions from the DAC collector, proceed to execute the instructions at258.

To the extent it is determined at254that the enlistment of one or more sub-collector agents is unnecessary, or that sub-collectors proceed to execute the instructions at258, a determination is made at259as to whether updated and/or new DAC instructions were received. To the extent it is determined at259that updated and/or new DAC instructions were received, the process250continues from identifying at252, the target-applicable segments of DAC instructions based on the target. To the extent it is determined at259that updated and/or new DAC instructions were not received, the process250continues from executing identified segments of the DAC instructions at253.

To the extent an updated and/or new common DAC instruction set was received, continue the process240from242, identifying target applicable subset(s) of DAC instruction set at242, according to the target. To the extent an updated and/or new common DAC instruction set was not received, continue the process240from243, executing identified subset(s) of the DAC instruction set.

To further aid in understanding the present disclosure,FIG. 2Fillustrates a block diagram depicting one example of a network, or system270suitable for performing or enabling the steps, functions, operations, and/or features described herein. The overall communications system270may include any number of interconnected networks which may use the same or different communication technologies. As illustrated inFIG. 2F, system270may include a network297, e.g., a core telecommunication network. In one example, the network297may include a backbone network, or transport network, such as an Internet Protocol (IP)/multi-protocol label switching (MPLS) network, where label switched routes (LSRs) can be assigned for routing Transmission Control Protocol (TCP)/IP packets, User Datagram Protocol (UDP)/IP packets, and other types of protocol data units (PDUs) (broadly “traffic”). However, it will be appreciated that the present disclosure is equally applicable to other types of data units and network protocols. For instance, the network297may alternatively or additional include components of a cellular core network, such as a Public Land Mobile Network (PLMN), a General Packet Radio Service (GPRS) core network, and/or an evolved packet core (EPC) network, an Internet Protocol Multimedia Subsystem (IMS) network, a Voice over Internet Protocol (VoIP) network, and so forth. In one example, the network297uses network function virtualization infrastructure (NFVI), e.g., servers in a data center or data centers, or elsewhere, that are available as host devices to host virtual machines (VMs) including virtual network functions (VNFs). In other words, at least a portion of the core telecommunications network297may incorporate software-defined network (SDN) components.

In this regard, it should be noted that as referred to herein, “traffic” may include all or a portion of a transmission, e.g., a sequence or flow, including one or more packets, segments, datagrams, frames, cells, PDUs, service data unit, bursts, and so forth. The particular terminology or types of data units involved may vary depending upon the underlying network technology. Thus, the term “traffic” is intended to refer to any quantity of data to be sent from a source to a destination through one or more networks. In addition, as used herein, the terms “configured” and “reconfigured” may refer to programming or loading a computing device with computer-readable/computer-executable instructions, code, and/or programs, e.g., in a memory, which when executed by a processor of the computing device, may cause the computing device to perform various functions.

In one embodiment, the network297may be in communication with one or more other networks291. The other networks291may include a wireless network (e.g., an Institute of Electrical and Electronics Engineers (IEEE) 802.11/Wi-Fi network and the like), a cellular access network (e.g., a Universal Terrestrial Radio Access Network (UTRAN) or an evolved UTRAN (eUTRAN), and the like), a circuit switched network (e.g., a public switched telephone network (PSTN)), a cable network, a digital subscriber line (DSL) network, a metropolitan area network (MAN), an Internet service provider (ISP) network, and the like. In one example, the other networks291may include different types of networks. In another example, the other networks291may be the same type of network. The other networks291may be controlled or operated by a same entity as that of network297or may be controlled or operated by one or more different entities. In one example, the other networks291may represent the Internet in general.

In one example, the network297is also in communication with a network operations center (NOC) network289. For example, the network297may be operated by a telecommunications service provider. The NOC network289may host various operator devices, monitoring devices, and so on for use by network personnel of the telecommunications service provider in operating the network297. For instance, device290may include an operator computing terminal for use by personnel in managing the network297. In another example, device290may include a server hosting one or more automated network analytics applications, e.g., a “network analytics device,” and may be configured to perform one or more operations or functions for generating a set of instructions in accordance with a functional network analytics platform application programming interface, in accordance with the present disclosure and as described in greater detail below. Although the NOC network289and the network297may be operated by the same entity, in one example, the NOC network289may include a separate domain, e.g., a separate routing domain as compared to the core telecommunications network297. In one example, network297may transport traffic to and from user devices281-283. For instance, the traffic may relate to communications such as voice telephone calls, video and other multimedia, text messaging, email, and so forth among the user devices281-283, or between the user devices281-283and other devices that may be accessible via other networks291. User devices281-283may include, for example, cellular telephones, personal computers, other wireless and wired computing devices, private branch exchanges, customer edge routers, media terminal adapters, cable boxes, home gateways and/or routers, and so forth.

In accordance with the present disclosure, user devices281-283may access network297in various ways. For example, user device281may include a cellular telephone which may connect to network297via other networks291, e.g., a cellular access network. For instance, in such an example other networks291may include one or more cell sites, e.g., including, a base transceiver station (BTS), a NodeB, an evolved NodeB (eNodeB), or the like (broadly a “base station”), a remote radio head (RRH) and baseband unit, a base station controller (BSC) or radio network controller (RNC), and so forth. In addition, in such an example, components294and295in network297may include a serving gateway (SGW), a mobility management entity (MME), or the like. In one example, user device282may include a customer edge (CE) router which may provide access to network297for additional user devices (not shown) which may be connected to the CE router. For instance, in such an example, component296may include a network edge device, such as a provider edge (PE) router.

As mentioned above, various components of network297may include VNFs which may physically include hardware executing computer-readable/computer-executable instructions, code, and/or programs to perform various functions. As illustrated inFIG. 2F, the units274and275may reside on a NFVI272, which is configurable to perform a broad variety of network functions and services. For example, the NFVI272may include shared hardware, e.g., one or more host devices including line cards, central processing units (CPUs), or processors, memories to hold computer-readable/computer-executable instructions, code, and/or programs, and so forth. For instance, in one example unit274may be configured to be a firewall, a media server, a Simple Network Management protocol (SNMP) trap, etc., and unit275may be configured to be a PE router, e.g., a virtual provider edge (VPE) router, which may provide connectivity to the network297for the user devices282and283. In one example, the NFVI272may represent a single computing device. Accordingly, the units274and275may physically reside on the same host device. In another example, the NFVI272may represent multiple host devices such that the units274and275may reside on different host devices. In one example, the unit274and/or unit275may have functions that are distributed over multiple host devices. For instance, the unit274and/or unit275may be instantiated and arranged (e.g., configured/programmed via computer-readable/computer-executable instructions, code, and/or programs) to provide for load balancing between two processors and several line cards that may reside on separate host devices.

In one example, the network297may also include an additional NFVI271. For instance, the unit273may be hosted on the NFVI271, which may include host devices having the same or similar physical components as the NFVI272. In addition, the NFVI271may reside in a same location or in different locations from the NFVI272. As illustrated inFIG. 2F, the unit273may be configured to perform functions of an internal component of network297. For instance, due to the connections available to the NFVI271, unit273may not function as a PE router, a SGW, a MME, a firewall, etc. Instead, the unit273may be configured to provide functions of components that do not utilize direct connections to components external to network297, such as a call control element (CCE), a media server, a domain name service (DNS) server, a packet data network gateway (PGW), a gateway mobile switching center (GMSC), a short message service center (SMSC), etc.

In one example, the NFVI271and the unit273, and the NFVI272and the other units274and275may also be controlled and managed by a software defined network (SDN) controller286. For instance, in one example, the SDN controller286is responsible for such functions as provisioning and releasing instantiations of the VNFs to perform the functions of routers, switches, and other devices, provisioning routing tables and other operating parameters for the VNFs, and so forth. In one example, the SDN controller286may maintain communications with the VNFs and/or the host devices/NFVI via a number of control links which may include secure tunnels for signaling communications over an underling IP infrastructure of network297. In other words, the control links may include virtual links multiplexed with transmission traffic and other data traversing network297and carried over a shared set of physical links. For ease of illustration the control links are omitted fromFIG. 2F. In one example, the SDN controller286may also include a virtual machine operating on the NFVI/host device(s), or may include a dedicated device. For instance, the SDN controller286may be collocated with one or more of the VNFs, or may be deployed in a different host device or at a different physical location.

In one example, the SDN controller286may include a computing system or server, such as computing system400depicted inFIG. 4, and may be configured to provide one or more operations or functions in accordance with the present disclosure, such as functions of the processes220,230,2340,250illustrated inFIGS. 2B-2E. For example, the functions of the SDN controller286may include the selection of an NFVI from among various NFVI available in the network297(e.g., the NFVI271or272) to host various devices, such as routers, gateways, switches, etc., and the instantiation of such devices. For example, with respect to the units274and275, the SDN controller286may download computer-executable/computer-readable instructions, code, and/or programs (broadly “configuration code”) for the units274and275respectively, which when executed by a processor of the NFVI272, may cause the NFVI272to perform as a PE router, a gateway, a route reflector, a SGW, a MME, a firewall, a media server, a DNS server, a PGW, a GMSC, a SMSC, a CCE, and so forth. In one example, the SDN controller286may download the configuration code to the NFVI272. In another example, the SDN controller286may instruct the NFVI272to load the configuration code previously stored on the NFVI272and/or to retrieve the configuration code from another device in network297that may store the configuration code for one or more of the VNFs. The functions of the SDN controller286may also include releasing or decommissioning one or more of the unit274and/or the unit275when no longer required, the transferring of the functions of the units274and/or275to different NFVI, e.g., when the NFVI272is taken offline, and so on.

As illustrated inFIG. 2F, the network297may also include internal nodes276-280, which may include various components, such as routers, switches, route reflectors, etc., cellular core network, IMS network, and/or VoIP network components, and so forth. In one example, these internal nodes276-280may also include VNFs hosted by and operating on additional NFVIs. For instance, as illustrated inFIG. 2F, internal nodes276and280may include VNFs residing on additional NFVI (not shown) that are controlled by the SDN controller286via additional control links. However, at least a portion of the internal nodes276-280may include dedicated devices or components, e.g., non-SDN reconfigurable devices. Similarly, the network297may also include components292and293, e.g., PE routers interfacing with the NOC network289, and the component296, e.g., a PE router which may interface with the user device282. For instance, in one example, the network297may be configured such that the user device282(e.g., a CE router) is dual-homed. In other words, the user device282may access the network297via either or both of the unit275and the component296. As mentioned above, the components294and295may include a serving gateway (SGW), a mobility management entity (MME), or the like. However, in another example, the components294and295may also include PE routers interfacing with other network(s)291, e.g., for non-cellular network-based communications. In one example, the components292-296may also include VNFs hosted by and operating on additional NFVI. However, in another example, at least a portion of the components292-296may include dedicated devices or components.

In one example, the network297further includes agent devices284,287, and288. The agent devices284,287, and288may reside within the network297and may be made available to network analytics devices and/or applications of such network analytics devices, for performing various functions in connection with examples of the present disclosure for selecting a number of network devices to perform a number of tasks in accordance with a set of functional network analytics (FNA) instructions. In some embodiments, the agent devices284,287can provide root collector functionality. Alternatively or in addition, one or more of the agent devices284can provide sub-collector functionality, e.g., under the control of a root collector. For example, a device290in the NOC network289may create a set of FNA instructions and may then seek to assign the set of FNA instructions to an agent device in network297for execution. For instance, creating a set of FNA instructions may include first generating a set of instructions in accordance with a FNA platform API. In one example, the set of instructions in accordance with the FNA platform API includes a text-based programming language script, or program that sets forth network analytics operations in accordance with the FNA platform, e.g., operations that are defined and/or permitted by the FNA platform. The set of instructions in accordance with the FNA platform API may, for example: identify at least one type of control plane data, specify a manner to collect control plane data of the at least one type of control plane data, identify a number of network devices from which to collect the control plane data, define operations to manipulate the control plane data to create resulting data, and specify at least one recipient device to receive the resulting data. Creating the set of FNA instructions may further include compiling the set of instructions in accordance with the FNA platform API into the set of FNA instructions, which may be then deployed to an agent device in network297for execution.

In one example, the set of FNA instructions includes a smaller data volume as compared to the set of instructions in accordance with the FNA platform API. For example, the set of FNA instructions may include a series of fields corresponding to different operations defined by the FNA platform. In one example, entries in each field of the set of fields of the set of functional network analytics instructions includes a series of computer/machine-readable alphanumeric codes representative of respective operations of the different operations defined by the FNA platform. In one example, the machine-readable alphanumeric codes are understandable to devices which are enabled in accordance with the FNA platform. For example, agent devices284,287, and288may be configured with software which enables agent devices284,287, and288to determine the type of operations and to execute the operations which are represented by the machine-readable alphanumeric codes.

In one example, the device290may communicate with the agent devices284,287, and/or288respectively to determine the capabilities and availability of the respective agent devices to perform the set of FNA instructions. In another example, one or more of agent devices284,287, and288may include VNFs hosted in NFVI/host device(s) of the network297and managed by the SDN controller286. Accordingly, in such an example, the device290may communicate with the SDN controller286to determine the capabilities and availability of the respective agent devices284,287, and288to perform the set of FNA instructions. Alternatively, or in addition, the device290may instruct or request the SDN controller286to select any available agent device that is capable of performing the functions in accordance with the set of FNA instructions. In one example, the agent devices284,287, and288may each include a computing system or server, such as computing system400depicted inFIG. 4, and may be configured to provide one or more functions for selecting a number of network devices to perform a number of tasks in accordance with a set of FNA instructions, as described herein. For ease of illustration, various links between the agent devices284,287, and288, and the SDN controller286and other links for the device290to communicate with such components are omitted fromFIG. 2F.

For illustrative purposes, in the example ofFIG. 2F, the agent device284may be selected by the device290, by the SDN controller286, and/or by the device290in conjunction with the SDN controller286, to execute the set of FNA instructions. As such, various control links285between the agent device284and other components of network297are shown inFIG. 2F. For example, the control links285for the agent device284may similarly include secure tunnels for signaling communications over an underling IP infrastructure of network297, e.g., virtual links multiplexed with transmission traffic and other data traversing network297and carried over a shared set of physical links, in a similar manner to control links between the SDN controller286and the various NFVI of network297mentioned above. In one example, the agent device284may be selected from among the group of agent devices284,287, and288based upon criteria such as: a location of the agent device284, an access to one of the at least one type of control plane data, a capability of the agent device284to perform operations defined in the set of FNA instructions, an available processor and/or a memory capacity, and so on.

In one example, the device290, or the device290via the SDN controller286, may send the set of FNA instructions to the agent device284after the agent device284is selected. The agent device284may then begin performing operations in accordance with the set of FNA instructions. To illustrate, the agent device284may select a number of network devices to perform a number of tasks in accordance with the set of FNA instructions, send the number of tasks to the number of network devices, receive control plane data from the number of network devices in accordance with the set of FNA instructions, correlate the control plane data in accordance with the operations defined in the set of FNA instructions to create resulting data, and forward the resulting data to at least one recipient device in accordance with the set of FNA instructions.

For instance, the agent device284may select any one or more components of the network297as “worker” devices to perform tasks in accordance with the set of FNA instructions, such as the internal nodes276-280, the components292-296, the units273,274, and275, etc. The tasks may include, for example: collecting particular types of control plane data, storing the control plane data, extracting portions of the control plane data, correlating the control plane data, anonymizing the control plane data, forwarding the control plane data to other devices, such as to the agent device284, or to other worker devices for aggregation and forwarding to the agent device284, and so on. In one example, the tasks may be explicitly specified in the set of FNA instructions. In another example, the agent device284may generate the tasks in accordance with the FNA instructions and distribute the tasks to the worker devices when generated.

In one example, the agent device284may select the worker devices based upon the same or similar criteria as may be used to select the agent device284, e.g., a location of a worker device, an access of the worker device to one of the at least one type of control plane data, a capability of the worker device to perform tasks in accordance with the set of FNA instructions, an available processor and/or memory capacity, and so on. Alternatively, or in addition, worker devices may be selected based upon the worker device including a type of worker device that is specified in the set of FNA instructions. For instance, as mentioned above, the set of FNA instructions may include instructions identifying a number of network devices from which to collect the control plane data. Thus, in one example the worker devices may include such network devices, where each worker device may be tasked with collecting the control plane data passing through or generated therein.

The control plane data may relate to various communications for the user devices281-283, or for components of the network297, other networks291, and so on. For instance, the control plane data may relate to: a source address or a destination address of a packet, a packet data session, etc., a source telephone number and/or a destination telephone number in a call signaling message, a packet inter-arrival time for a flow, a network link, or a component of the network297, a packet size, a protocol utilized for a communication, an application type associated with the communication, an indication of whether a file, a service, or a storage volume is accessed, a number of requests to a server, call detail record(s), particular fields within call detail record(s), such as a call connection status, a call disposition code, etc., a number of blocked calls or dropped calls for a particular telephone number, account, trunk, switch, etc., an average signal-to-noise ratio reported by mobile endpoint devices with respect to a base station and recorded by a network-based component, and so forth. Control plane data may also include out-of-band signaling traffic (e.g., which may take a different path through the network297than payload traffic to which the out-of-band signaling traffic may relate), or other types of network management traffic, such as Simple Network Management Protocol (SNMP), Network Configuration Protocol (NETCONF), and ConfD flows, and the like, which may be conveyed via Telnet, Secure Shell (SSH) sessions, and the like, and which may be used to manage devices, such as to deploy configuration updates, to decommission a device, to retrieve settings and usage logs, and so on.

As mentioned above, the worker devices may collect control plane data and perform other tasks with respect to the control plane data in accordance with the FNA instructions. The tasks for the worker devices may define a manner to collect the control plane data, e.g., in accordance with instructions in the set of FNA instructions. For instance, in accordance with the FNA instructions, the task(s) for one or more worker devices may specify that a first type of control plane data should be taken from five second samples, while another type of control plane data should be taken from a one minute weighted average of continuous data. The worker devices may also send the control plane data to agent device284, or to other worker devices for eventual forwarding to agent device284. To illustrate, in one example, the instructions in the set of FNA instructions specifying a manner to collect the control plane data may define that worker devices are to collect the control plane data and store the control plane data until requested by the agent device284. In another example, the instructions specifying a manner to collect the control plane data may define that a worker device is to forward the control plane data to the agent device284as the control plane data is generated, received or detected by the worker device.

In any case, the agent device284receives the control plane data from the worker devices, where the control plane data that is received may or may not have been subject to various processing via the tasks assigned to the worker devices. In one example, the agent device284may perform further operations with respect to the control plane data. For instance, at a minimum, the agent device284may correlate the control plane data received from the number of worker devices. In one example, the correlating may include segregating or grouping the control plane data by time, source and/or destination IP address, source and/or destination telephone number, area code, numbering plan area-exchange (NPA-NXX), etc.

The operations of the agent device284in accordance with the set of FNA instructions may further include extracting data from a selected field or fields of CDRs after the CDRs are collected, performing a hash or a similar operation to anonymize customer proprietary network information, and so forth. In one example, the worker devices and the agent device284may be capable of performing the same or similar operations, or tasks, with respect to the control plane data. Thus, in one example, a division of tasks/operations for manipulating or otherwise processing the control plane data may be set forth in the set of FNA instructions. For instance, tasks/operations may be allocated for execution by an agent device or by one or more of the worker devices by the network analytics application generating the set of FNA instructions. In another example, the compiling of the set of instructions in accordance with a FNA platform API may result in the automatic division of operations/tasks between an agent device and one or more worker devices. For instance, the nature of an operation defined in the set of instructions in accordance with a FNA platform API may dictate to a compiler of the FNA platform (without explicit specification by the network analytics application) whether the operation is for the agent device, or whether the operation is for assignment to, or can be assigned as a task for one or more worker devices.

The control plane data may therefore be collected by the agent device284and further processed via operations in accordance with the FNA instructions. As referred to herein, control plane data that has been subjected to operations by an agent device in accordance with a set of FNA instructions may be referred to as “resulting data.” Continuing with the above example, the agent device284may send the resulting data to the device290when operations in accordance with the FNA instructions are completed. The agent device284may release any worker devices that were implicated in the performance of tasks in accordance with the set of FNA instructions. In addition, the device290and or the SDN controller286may release the agent device284for reassignment or for deactivation, if not needed to execute other FNA instruction sets for the same or a different requesting device. Notably, the control plane data may be collected and processed in a tiered fashion, e.g., at the worker devices, at an agent device, and at a requesting device and/or the network analytics application. This is in contrast to big data approaches in which, for example, an application may access a large volume of data collected and stored in a mass data storage platform and search through voluminous records looking for control plane data which matches one or more requesting criteria, where only a small portion of the records may actually be relevant. For instance, examples of the present disclosure are able to collect and process relevant control plane data at or near the source and as the control plane data is generated in the network. The control plane data is therefore already filtered and may be pre-processed to have greater relevance to the network analytics application when delivered.

It should be noted that the system270has been simplified. In other words, the system270may be implemented in a different form than that illustrated inFIG. 2D. For example, the system270may be expanded to include additional networks, such as additional NOC networks, and additional network elements (not shown) such as border elements, routers, switches, policy servers, security devices, gateways, a content distribution network (CDN) and the like, without altering the scope of the present disclosure. In addition, the system270may be altered to omit various elements, substitute elements for devices that perform the same or similar functions and/or combine elements that are illustrated as separate devices. For example, the agents287and288may be integrated into a single host device/NFVI. In still another example, the SDN controller286, the agents284,287, and288, and/or other network elements may include functions that are spread across several devices that operate collectively as a SDN controller, an agent device, etc. Thus, these and other modifications of the system270are all contemplated within the scope of the present disclosure.

Referring now toFIG. 3, a block diagram is shown illustrating an example, non-limiting embodiment of a virtualized communication network300in accordance with various aspects described herein. In particular a virtualized communication network is presented that can be used to implement some or all of the subsystems and functions of communication network100, the subsystems and functions of system270, and processes220and240presented inFIGS. 1, 2A, 2B, 2C, and 2D. For example, the virtualized communication network300can facilitate in whole or in part a data analytics infrastructure that implements a customizable data collection strategy among a variety of different network devices and/or subsystems. In particular, implementation of the data analytics functionality is implemented by way of a common instruction set that when provided to different network devices and/or subsystems, is implemented differently, according to the target device and/or subsystem.

The virtualized communication network300can include an SDN controller381that facilitates implementation of virtual network functionality, e.g., by instantiating, managing and/or controlling operation of virtual machines according to the virtualized network function cloud325and/or other cloud computing environments375. The virtualized communication network300also includes a data analytics controller382and a functional network analytics (FNA) platform or engine383. The data analytics controller382identifies a number of target devices330,332,334,350, which may include target devices utilized within one or more different access technologies110,130,120,140,175and initiates corresponding data analytics collectors390a,390b,390c,390d,390e,390f,390g,390h,390i, generally390. The data analytics controller382injects, forwards or otherwise provides the same instruction set to the data analytics collectors390, which may be incorporated into and/or adjunct to the target devices. Each of the respective data analytics collectors390implements respective segments of the common instruction set to realize different functionality among the different collectors390as dictated by the associated target device.

Identification of the target devices, determination of a data analytics collection strategy, and in at least some instances, generation of the common instruction set can be performed by the FNA engine383. For example, the FNA engine identifies a strategy. The strategy is passed to the data analytics controller that forwards the same instruction set to the appropriate data collectors390according to the strategy. The data analytics collectors390, once receiving the instruction set, can operate autonomously, e.g., until the instruction set expires, is turned off, or replaced by a subsequent instruction set. Collected results can be passed to the FNA engine383directly and/or by way of the data analytics controller382. In at least some embodiments, the results are passed through network message traffic according to metadata. In some embodiments, the data analytics collectors390can communicate with each other, e.g., according to a mesh network. In this regard, synchronization and/or harmonization resulting from injection of the common set of instructions during a common data analytics collection interval facilitates communication and/or interoperation between different data analytics collectors390.

Turning now toFIG. 4, there is illustrated a block diagram of a computing environment in accordance with various aspects described herein. In order to provide additional context for various embodiments of the embodiments described herein,FIG. 4and the following discussion are intended to provide a brief, general description of a suitable computing environment400in which the various embodiments of the subject disclosure can be implemented. In particular, computing environment400can be used in the implementation of network elements150,152,154,156, access terminal112, base station or access point122, switching device132, media terminal142, and/or VNEs330,332,334, etc. Each of these devices can be implemented via computer-executable instructions that can run on one or more computers, and/or in combination with other program modules and/or as a combination of hardware and software. For example, computing environment400can facilitate in whole or in part an infrastructure and/or process that implements a customizable data collection strategy among a variety of different devices and/or subsystems of a network. In particular, data analytics functionality is implemented by way of a common instruction set that provided to all of the different network devices and/or subsystems for which data is to be collected during a data collection interval. According to the infrastructure, the same instructions are implemented differently, according to the target device and/or subsystem.

Computing devices typically include a variety of media, which can include computer-readable storage media and/or communications media, which two terms are used herein differently from one another as follows. Computer-readable storage media can be any available storage media that can be accessed by the computer and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer-readable storage media can be implemented in connection with any method or technology for storage of information such as computer-readable instructions, program modules, structured data or unstructured data.

With reference again toFIG. 4, the example environment can include a computer402, the computer402including a processing unit404, a system memory406and a system bus408. The system bus408couples system components including, but not limited to, the system memory406to the processing unit404. The processing unit404can be any of various commercially available processors. Dual microprocessors and other multiprocessor architectures can also be employed as the processing unit404.

The computer402further includes an internal hard disk drive (HDD)414(e.g., EIDE, SATA), which internal HDD414can also be configured for external use in a suitable chassis (not shown), a magnetic floppy disk drive (FDD)416, (e.g., to read from or write to a removable diskette418) and an optical disk drive420, (e.g., reading a CD-ROM disk422or, to read from or write to other high capacity optical media such as the DVD). The HDD414, magnetic FDD416and optical disk drive420can be connected to the system bus408by a hard disk drive interface424, a magnetic disk drive interface426and an optical drive interface428, respectively. The hard disk drive interface424for external drive implementations includes at least one or both of Universal Serial Bus (USB) and Institute of Electrical and Electronics Engineers (IEEE) 1394 interface technologies. Other external drive connection technologies are within contemplation of the embodiments described herein.

A number of program modules can be stored in the drives and RAM412, including an operating system430, one or more application programs432, other program modules434and program data436. All or portions of the operating system, applications, modules, and/or data can also be cached in the RAM412. The systems and methods described herein can be implemented utilizing various commercially available operating systems or combinations of operating systems.

A user can enter commands and information into the computer402through one or more wired/wireless input devices, e.g., a keyboard438and a pointing device, such as a mouse440. Other input devices (not shown) can include a microphone, an infrared (IR) remote control, a joystick, a game pad, a stylus pen, touch screen or the like. These and other input devices are often connected to the processing unit404through an input device interface442that can be coupled to the system bus408, but can be connected by other interfaces, such as a parallel port, an IEEE 1394 serial port, a game port, a universal serial bus (USB) port, an IR interface, etc.

Turning now toFIG. 5, an embodiment500of a mobile network platform510is shown that is an example of network elements150,152,154,156, and/or VNEs330,332,334, etc. For example, platform510can facilitate in whole or in part an infrastructure and a process that implements a customizable data collection strategy among a variety of different devices and/or subsystems of a network. In particular, data analytics functionality is implemented by way of a common instruction set that provided to all of the different network devices and/or subsystems for which data is to be collected during a data collection interval. According to the infrastructure, the same instructions are implemented differently, according to the target device and/or subsystem. In one or more embodiments, the mobile network platform510can generate and receive signals transmitted and received by base stations or access points such as base station or access point122. Generally, mobile network platform510can include components, e.g., nodes, gateways, interfaces, servers, or disparate platforms, that facilitate both packet-switched (PS) (e.g., internet protocol (IP), frame relay, asynchronous transfer mode (ATM)) and circuit-switched (CS) traffic (e.g., voice and data), as well as control generation for networked wireless telecommunication. As a non-limiting example, mobile network platform510can be included in telecommunications carrier networks, and can be considered carrier-side components as discussed elsewhere herein. Mobile network platform510includes CS gateway node(s)512which can interface CS traffic received from legacy networks like telephony network(s)540(e.g., public switched telephone network (PSTN), or public land mobile network (PLMN)) or a signaling system #7 (SS7) network560. CS gateway node(s)512can authorize and authenticate traffic (e.g., voice) arising from such networks. Additionally, CS gateway node(s)512can access mobility, or roaming, data generated through SS7 network560; for instance, mobility data stored in a visited location register (VLR), which can reside in memory530. Moreover, CS gateway node(s)512interfaces CS-based traffic and signaling and PS gateway node(s)518. As an example, in a 3GPP UMTS network, CS gateway node(s)512can be realized at least in part in gateway GPRS support node(s) (GGSN). It should be appreciated that functionality and specific operation of CS gateway node(s)512, PS gateway node(s)518, and serving node(s)516, is provided and dictated by radio technology(ies) utilized by mobile network platform510for telecommunication over a radio access network520with other devices, such as a radiotelephone575.

It is to be noted that server(s)514can include one or more processors configured to confer at least in part the functionality of mobile network platform510. To that end, the one or more processor can execute code instructions stored in memory530, for example. It is should be appreciated that server(s)514can include a content manager, which operates in substantially the same manner as described hereinbefore.

Turning now toFIG. 6, an illustrative embodiment of a communication device600is shown. The communication device600can serve as an illustrative embodiment of devices such as data terminals114, mobile devices124, vehicle126, display devices144or other client devices for communication via either communications network125. For example, computing device600can facilitate in whole or in part an infrastructure and process that implements a customizable data collection strategy among a variety of different devices and/or subsystems of a network. In particular, data analytics functionality is implemented by way of a common instruction set that provided to all of the different network devices and/or subsystems for which data is to be collected during a data collection interval. According to the infrastructure, the same instructions are implemented differently, according to the target device and/or subsystem.

Although the example embodiments are directed to data analytics applications, it is understood that the techniques disclosed herein can be applied more generally, e.g., as autonomous applications, sometimes referred to as “zero touch” operations.