Patent Description:
In particular, they apply to a Radio Access Network (RAN) of a mobile communication system, for example a <NUM> (fifth generation) system using the <NUM> NR (New Radio) as radio access technology (RAT) defined by 3GPP.

A radio access network comprises a base station configured with network configuration parameters to communicate with one or more a user equipment over-the-air by using a radio access technology.

Before deploying a new base station release in a radio access network, the release shall go through a test and validation phase. This test and validation phase includes configuring the base station with test network configuration parameters, operating the network like a customer with commercial devices, end-to-end applications and realistic scenarii, measuring network performance indicators (KPIs), and optimizing the network configuration parameters to ensure best-in-class performances in over-the-air conditions and in customers configurations.

Anomalies can occur during the tests for various reasons (e.g. software problem, device not well configured. Traces are collected as a result of the tests that need to be processed to identify anomalies. The investigation of the collected traces is time consuming and the process is long from analysis, anomalies identification and feedback to the teams in charge of establishing the network configuration.

In addition when an anomaly is detected, it is not straightforward to figure out if the cause is related or not to the network configuration parameters. Conventionally, a kind of 'trial and error' policy is performed on the network configuration parameters where there is no guarantee that the raised anomalies can be solved with a change in the network configuration parameters and more specifically which one(s). This generally requires an expert intervention.

<CIT> discloses a method and a system for anomaly detection and network deployment based on quantitative assessment. <CIT> discloses a method for analyzing performance of a telecommunications network and detecting an anomalous behavior of the network. <CIT> relates to node profiling based on key performance indicators to determine the health of a wireless ecosystem in real time.

The scope of protection is set out by the independent claims. The embodiments, examples and features, if any, described in this specification that do not fall under the scope of the protection are to be interpreted as examples useful for understanding the various embodiments or examples that fall under the scope of protection.

According to a first aspect, a method for anomaly detection in a network is disclosed, using an autoencoder comprising an encoder and a decoder, the method comprising:.

According to a second aspect, a method is disclosed which further comprises:.

According to another aspect an apparatus is disclosed for anomaly detection in a network, using an autoencoder comprising an encoder and a decoder, the apparatus comprising at least one processor and at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to perform:.

According to another aspect, an apparatus is disclosed wherein the at least one memory and the computer program code are further being configured to, with the at least one processor, cause the apparatus at least to perform:.

According to another aspect, a computer program product is disclosed, comprising a set of instructions which, when executed on an apparatus, is configured to cause the apparatus to carry out a method for anomaly detection in a network, using an autoencoder comprising an encoder and a decoder, the method comprising:.

According to another aspect, a computer program product is disclosed, comprising a set of instructions which, when executed on an apparatus, is configured to cause the apparatus to carry out a method for anomaly detection in a network, the method further comprising :.

According to another aspect the disclosed computer program product is embodied as a computer readable medium or directly loadable into a computer.

One or more example embodiments of the present disclosure provide an apparatus for anomaly detection in a network, using an autoencoder comprising an encoder and a decoder, the apparatus comprising means for:.

According to another example embodiment, the apparatus may further include means for:.

According to another aspect, a method, an apparatus and a computer program product are disclosed wherein selecting a preferred value for the given network configuration parameter comprises:.

According to another aspect, the disclosed method, apparatus and computer program product are intended to be used in a system comprising a user equipment and a base station, wherein the base station is configured with the network configuration parameters and the network performance indicators are measured at the user equipment or at the base station.

According to another aspect of the disclosed method, apparatus and computer program product, the network configuration parameters are test configuration parameters or post-deployment configuration parameters.

According to another aspect of the disclosed method, apparatus and computer program product, the autoencoder is trained to estimate network configuration parameters from network performance indicators and reconstruct network performance indicators from the estimated network configuration parameters, by minimizing:.

Generally, the apparatus comprises means for performing one or more or all steps of a method for anomaly detection in a network as disclosed herein. The means may include circuitry configured to perform one or more or all steps of the method for anomaly detection as disclosed herein. The means may include at least one processor and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus to perform one or more or all steps of the method for anomaly detection as disclosed herein.

Generally, the computer-executable instructions / program code cause the apparatus to perform one or more or all steps of a method for anomaly detection as disclosed herein.

Example embodiments will become more fully understood from the detailed description given herein below and the accompanying drawings, which are given by way of illustration only and thus are not limiting of this disclosure.

Detailed example embodiments are disclosed herein. However, specific structural and functional details disclosed herein are merely representative for purposes of describing example embodiments. The example embodiments may, however, be embodied in many alternate forms and should not be construed as limited to only the embodiments set forth herein. Accordingly, while example embodiments are capable of various modifications and alternative forms, the embodiments are shown by way of example in the drawings and will be described herein in detail. It should be understood, however, that there is no intent to limit example embodiments to the particular forms disclosed.

<FIG> shows a schematic diagram illustrating a system where the disclosed method and apparatus is intended to be used. The system comprises a radio access network RAN with a user equipment <NUM> and a base station <NUM>. It also comprises an apparatus <NUM> for anomaly detection and an interface <NUM> between the apparatus <NUM> and the base station <NUM>. The interface <NUM> is used for loading network configuration parameters in the base station <NUM>.

The apparatus <NUM> may be used for test and validation before deployment of a new release of the base station. It may also be used after the deployment of the base station to differentiate configuration issues from product issues in the field and optimize the network configuration of the deployed base station.

In both instances, the base station <NUM> is configured with given network configuration parameters CPBS and scenarii are run for example with different user equipment or different locations. As the result of these scenarii, data are measured at the user equipment <NUM> and/ or at the base station <NUM>. Network performance indicators KPIC are calculated based on measured data also referred to as traces. The calculated network performance indicators KPIC and the corresponding network configuration parameters CPBS are provided to the apparatus <NUM>. Based on the calculated network performance indicators KPIc and the corresponding network configuration parameters CPBS, the apparatus <NUM> detects anomalies, and additionally detects whether or not the anomalies are related to the network configuration parameters. When an anomaly is related to the network configuration parameters CPBS, a configuration update is done by loading updated network configuration parameters CPBS' to the base station <NUM> via the interface <NUM>.

Examples of network performance indicators are SINR (Signal to Interference and Noise Ratio) or RSRP (Reference Signal Received Power) metrics. Examples of network configuration parameters are pMax (Base station maximum output power), prachConfigurationlndex (Physical Random Access Channel Configuration index), ssbScs (Synchronization Signal Block SubCarrier Spacing).

In a first embodiment, apparatus <NUM> uses machine learning to automate the detection of anomalies and the detection of the cause of the anomalies. It provides the decision whether or not there is a need to change the network configuration parameters. In a second embodiment, apparatus <NUM> also provides information on which specific network configuration parameter(s) need to be changed. In a third embodiment, apparatus <NUM> also uses machine learning to provide recommended values for the specific network configuration parameter(s) requiring a change. It predicts the network performance for candidate values of the network configuration parameter(s) for each network configuration parameter requiring a change and selects the candidate value with the best network performance prediction. The selected candidate value is then used to update the configuration of the base station <NUM>.

Machine learning allows fast and efficient resolution of anomalies. Instead of raising the alarms "manually" by comparing the measurements with predefined thresholds, the analysis is automated. This results in significant time savings.

Also, the network configuration parameters at the base station are updated only when necessary and useful. Anomalies that are not related to the network configuration parameters are identified straightforwardly and processed through conventional root cause analysis functions to identify to which factors the anomaly is mostly related (for example software bugs).

Additionally guidance may be provided on which network configuration parameters to change and how to change them.

The disclosed machine learning assisted approach uses an autoencoder. An autoencoder is a neural network that aims to copy its input to its output: more specifically an autoencoder compresses its input into a latent space representation and then reconstructs an output from the latent space representation.

<FIG> is a schematic representation of an example embodiment of an autoencoder AE for use in the disclosed method and apparatus. As depicted in <FIG>, the autoencoder AE comprises an encoder <NUM> and a decoder <NUM>. The layer <NUM> between the encoder <NUM> and the decoder <NUM> is referred to as latent space. The encoder <NUM> receives network performance indicators KPIC as input and applies an encoding function f to generate estimates CPAE of the network configuration parameters used to obtain the network performance indicators KPIC. The decoder <NUM> receives the estimated network configuration parameters CPAE as input and applies a decoding function g to generate reconstructed network performance indicators KPIAE from the estimated network configuration parameters CPAE.

The autoencoder AE is trained by using data known as without anomalies, specifically network performance indicators KPIC, for example from previous tests, and the corresponding network configuration parameters CPes. The encoder <NUM> and the decoder <NUM> are trained simultaneously by minimizing:.

Using an autoencoder has the advantage that it doesn't require high amount of labelled data to reach a well-trained machine model which can be used afterwards in inference.

Once the autoencoder is trained it can be used in real time fashion with test data in the disclosed method and apparatus.

<FIG> is a block diagram depicting a first embodiment of a method for anomaly detection based on an autoencoder. After the realization of a test with given network configuration parameters CPBS, network performance indicators KPIC are measured and provided to the apparatus <NUM> together with the network configuration parameters CPBS used for the test as described above by reference to <FIG>. The network configuration parameters CPBS and the calculated network performance indicators KPIC are stored in apparatus <NUM> at step <NUM>. At step <NUM>, the network configuration parameters CPBS are made input to the decoder function <NUM> of apparatus <NUM> and the decoder function <NUM> generates reconstructed network performance indicators KPIAE. At step <NUM>, the reconstructed network performance indicators KPIAE are compared with the calculated network performance indicators KPIC obtained from the test. When they are comparable (for example when their difference is below a first threshold TKPI) the decision is made at step <NUM> that there is no anomaly in the test. On the contrary when a deviation is observed between the reconstructed network performance indicators KPIAE and the calculated network performance indicators KPIc, an anomaly is detected at step <NUM>. For example a deviation is observed when the difference between the reconstructed network performance indicators KPIAE and the calculated network performance indicators KPIC is higher than the first threshold TKPI. The next steps <NUM> and <NUM> aim at detecting whether the anomaly is related or not to the network configuration parameters that have been used for the test.

At step <NUM> the calculated network performance indicators obtained from the test are made input to the encoder function <NUM> of apparatus <NUM> and the encoder function <NUM> generates an estimation CPAE of the network configuration parameters corresponding to the calculated network performance indicators KPIC. At step <NUM>, the estimated network configuration parameters CPAE are compared with the network configuration parameters used for test CPBS. When they are comparable (for example when their difference is below a second threshold TCP) the decision is made at step <NUM> that the detected anomaly is not related to the network configuration parameters used for the test (for example it may related to software bugs). On the contrary when a deviation is observed between the estimated network configuration parameters CPAE and the network configuration parameters used for the test CPBS, detection is made at step <NUM> that the anomaly is related to the network configuration parameters used for test.

As will be understood from the above description, the two components of the autoencoder AE, namely the encoder <NUM> and the decoder <NUM>, which have been trained simultaneously, are used separately when implementing the disclosed method. The anomaly detection is performed by using the decoder <NUM> of the autoencoder AE and the encoding <NUM> of the autoencoder AE is used to detect whether or not the anomaly is related to the network configuration parameters used for the test.

For example the comparisons performed at steps <NUM> and <NUM> are global comparisons of the sets (or vectors) of network performance indicators and network configuration parameters respectively. <FIG> is a block diagram depicting a second embodiment of the disclosed method comprising additional steps <NUM> and <NUM>. Additional step <NUM> aims at detecting which specific parameter(s) is/are causing the anomaly. For example this is done by comparing each estimated network configuration parameter CPi_AE with the corresponding network configuration parameters CPi_BS used for the test (where i = <NUM>,. , M with M the total number of parameters). When a deviation is observed for one or more given parameter(s), a decision is made at step <NUM> that the given parameter(s) is/are causing the anomaly. As a result guidance is obtained on which parameters to change in the base station configuration.

<FIG> is a block diagram of a third embodiment of the disclosed method including additional steps <NUM>, <NUM> and <NUM>. Steps <NUM>, <NUM> and <NUM> aim at selecting a preferred value for given network configuration parameter(s) causing an anomaly in order to optimize network performance. At step <NUM>, a plurality of candidate values {x<NUM>,. XN} is retrieved for each of the given network configuration parameter that causes an anomaly. For example the plurality of candidate values are obtained from a look-up-table LUT stored in the apparatus <NUM> and containing all possible values for each network configuration parameter. At step <NUM>, a machine learning approach, for example a neural network, is used to predict the performance {P<NUM>,. , PN} that would be obtained with each candidate value {x<NUM>,. For example this can be achieved by going again through the decoder <NUM>. At step <NUM>, the candidate value xq with the best network performance prediction is selected (xq=argmax<NUM>≤k≤N(Pk)). Then the base station <NUM> may be updated with the selected value(s) xq through the interface <NUM> as described above in relation to <FIG>.

While the steps are described in a sequential manner, the man skilled in the art will appreciate that some steps may be omitted, combined, performed in different order and / or in parallel.

<FIG> depicts a high-level block diagram of an apparatus <NUM> suitable for implementing various aspects of the disclosure. Although illustrated in a single block, in other embodiments the apparatus <NUM> may also be implemented using parallel and distributed architectures. Thus, for example, various steps such as those illustrated in the method described above by reference to <FIG> may be executed using apparatus <NUM> sequentially, in parallel, or in a different order based on particular implementations.

According to an exemplary embodiment, depicted in <FIG>, apparatus <NUM> comprises a printed circuit board <NUM> on which a communication bus <NUM> connects a processor <NUM> (e.g., a central processing unit "CPU"), a random access memory <NUM>, a storage medium <NUM>, an interface <NUM> for connecting a display <NUM>, a series of connectors <NUM> for connecting user interface devices or modules such as a mouse or trackpad <NUM> and a keyboard <NUM>, a wireless network interface <NUM> and a wired network interface <NUM>. Depending on the functionality required, the apparatus may implement only part of the above. Certain modules of <FIG> may be internal or connected externally, in which case they do not necessarily form integral part of the apparatus itself. display <NUM> may be a display that is connected to the apparatus only under specific circumstances, or the apparatus may be controlled through another device with a display, i.e. no specific display <NUM> and interface <NUM> are required for such an apparatus. Memory <NUM> contains software code which, when executed by processor <NUM>, causes the apparatus to perform the methods described herein. Storage medium <NUM> is a detachable device such as a USB stick which holds the software code which can be uploaded to memory <NUM>.

The processor <NUM> may be any type of processor such as a general purpose central processing unit ("CPU") or a dedicated microprocessor such as an embedded microcontroller or a digital signal processor ("DSP").

Memory <NUM> may store test data including measured performance indicators KPIc and their corresponding network configuration parameters CPes, estimated / reconstructed data including estimated network configuration parameters CPAE and reconstructed network performance indicators KPIAE, reference data e.g. one or more threshold values intended to be used for detection purposes as described above, a look up table LUT which contains candidate values for the network configuration parameters, etc..

In addition, apparatus <NUM> may also include other components typically found in computing systems, such as an operating system, queue managers, device drivers, or one or more network protocols that are stored in memory <NUM> and executed by the processor <NUM>.

Although aspects herein have been described with reference to particular embodiments, it is to be understood that these embodiments are merely illustrative of the principles and applications of the present disclosure. It is therefore to be understood that numerous modifications can be made to the illustrative embodiments and that other arrangements can be devised without departing from the spirit and scope of the disclosure as determined based upon the claims and any equivalents thereof.

For example, the data disclosed herein may be stored in various types of data structures which may be accessed and manipulated by a programmable processor (e.g., CPU or FPGA) that is implemented using software, hardware, or combination thereof.

It should be appreciated by those skilled in the art that any block diagrams herein represent conceptual views of illustrative circuitry embodying the principles of the disclosure. Similarly, it will be appreciated that any flow charts, flow diagrams, state transition diagrams, and the like represent various processes which may be substantially implemented by circuitry.

Each described function, engine, block, step can be implemented in hardware, software, firmware, middleware, microcode, or any suitable combination thereof. If implemented in software, the functions, engines, blocks of the block diagrams and/or flowchart illustrations can be implemented by computer program instructions / software code, which may be stored or transmitted over a computer-readable medium, or loaded onto a general purpose computer, special purpose computer or other programmable processing apparatus and / or system to produce a machine, such that the computer program instructions or software code which execute on the computer or other programmable processing apparatus, create the means for implementing the functions described herein.

In the present description, block denoted as "means configured to perform. " (a certain function) shall be understood as functional blocks comprising circuitry that is adapted for performing or configured to perform a certain function. A means being configured to perform a certain function does, hence, not imply that such means necessarily is performing said function (at a given time instant). Moreover, any entity described herein as "means", may correspond to or be implemented as "one or more modules", "one or more devices", "one or more units", etc. When provided by a processor, the functions may be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which may be shared. Moreover, explicit use of the term "processor" or "controller" should not be construed to refer exclusively to hardware capable of executing software, and may implicitly include, without limitation, digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), read only memory (ROM) for storing software, random access memory (RAM), and non-volatile storage.

Claim 1:
A method for anomaly detection for use in an apparatus (<NUM>) in a network system comprising a base station (<NUM>) and a user equipment (<NUM>), wherein the apparatus (<NUM>) is configured to use an autoencoder comprising an encoder (<NUM>) and a decoder (<NUM>), the method comprising:
- providing the decoder (<NUM>) with network configuration parameters used to obtain calculated network performance indicators, wherein the base station (<NUM>) is configured with the network configuration parameters and the calculated network performance indicators are calculated based on measured data at the user equipment (<NUM>) and/or at the base station (<NUM>);
- obtaining reconstructed network performance indicators from the decoder (<NUM>) based on the network configuration parameters,
- comparing the reconstructed network performance indicators with the calculated network performance indicators,
- detecting an anomaly when observing a deviation between the reconstructed network performance indicators and the calculated network performance indicators,
- obtaining estimated network configuration parameters from the encoder based on the calculated network performance indicators,
- detecting that the anomaly is related to the network configuration parameters when observing a deviation between the estimated network configuration parameters and the network configuration parameters used to obtain the calculated network performance indicators;
wherein the autoencoder has been trained using data known as without anomalies to estimate network configuration parameters from network performance indicators and reconstruct network performance indicators from the estimated network configuration parameters, such that a first error between the network performance indicators and the reconstructed network performance indicators, and a second error between the network configuration parameters and the estimated network configuration parameters are minimized.