Patent Description:
With the increasing level of manufacturing digitalization, automation and flexibilization, the wireless telecommunications networks start to play increasingly critical role in factory operation. One of the main concerns in such critical wireless networks is the intrusion of external unwanted entities as well as jamming of the wireless spectrum.

From the communication service perspective, and more specifically, the wireless communication service, successful transmission of data depends on a plethora of parameters like the transmit power, environment, channel conditions, etc. Due to the large number of these parameters and the interrelations between them, it is difficult to generate models that closely approximate real conditions, especially for highly varying environments. For that reason, the network needs to be designed under certain assumptions of normal operation. If during operation, these normal conditions are not present, errors in the communication take place, which are then corrected by the communication system by reactive means such as the usage of retransmissions. These reactive means represent, however, less available resources for other applications or, in the worst case, a complete failure of the application.

<CIT> discloses a method, system and computer program product for learning representations or embeddings of networkflow traffic. The key aspect is operating on network flow data which are then used as inputs to a deep-learning architecture that learns to embed the data into a vector space.

The problems of the prior art are solved by an anomaly identifier according to claim <NUM>, a telecommunications network comprising an anomaly identifier according to a further claim, a method for identifying an abnormal activity according to a further claim, a model determination unit according to a further claim, a system according to a further claim, and a method for determining a prediction model according to a further claim.

Claim <NUM> is directed to an anomaly identifier for identifying an abnormal activity in a telecommunications network, wherein the anomaly identifier comprises.

The anomaly identifier is configured to differentiate between normal "bad" behaviour, e.g., expected bad channel impulse response due to fading, and abnormal "bad" behaviour due to unknown reasons. The abnormal bad behaviour is identified as abnormal activity. The proposed approach can be used to predict anomalies whose presence is predictable before their harmful actions. This is because the proposed approach does not limit to detect unexpected anomalies, but it predicts their occurrence in the future by identifying patterns, among others, such that reactive measure can be carried out. Moreover, complicated manual expert analysis of an attack is avoided as quickly activated countermeasures prevents damage.

The described anomaly identification allows prediction of abnormal activity in the telecommunications network. Subsequent reaction to any predicted local network disturbances taking place in the telecommunications network is therefore possible. For example, wireless <NUM> networks in a factory being part of the telecommunications network benefit as abnormal activity caused by active intruders or infected abnormal acting network entities can be predicted in order to take countermeasures.

In summary, telecom operators for private and public networks will benefit as the provided approach guarantees a reliable operation of the telecommunications network by reacting appropriately upon predicting an anomaly via the anomaly prediction indicator.

Furthermore, the prediction model is trained to predict the radio environment at a prospective measurement time slot, and the anomaly prediction indicator is provided in dependence to a comparison of network measurements and the predicted radio environment.

Prediction of the radio environment comprises for example prediction of quantities such as spectrum, signal strength, channel impulse response, signal-to-interference-plus-noise ratio, SINR.

According to an advantageous example, the comparison between the predicted radio environment and the network measurements is evaluated using an applicable distance measure, for example a distance based on an applicable Lp norm. The applicable distance measure is based for example on the network measurements and/or on the predicted radio environment.

According to an advantageous example, the anomaly identifier comprises a neural classification network, and the neural classification network is trained to classify a consistency between the network measurements and the predicted radio environment. Advantageously the neural classification network is used instead of using a handcrafted evaluation metric, for example the Lp distance.

According to a further advantageous example, the prediction model is trained to directly predict an abnormal activity. In this case, the output of the prediction model provides the anomaly detection indicator directly to the output unit.

According to an advantageous example, the output unit or a further output unit of the anomaly identifier is configured to provide a reliability indicator. The reliability indicator provides a measure of the reliability of the anomaly prediction indicator. If the prediction is not reliable, the anomaly prediction indicator is ignored and no countermeasures are prepared. If the prediction is reliable, the anomaly prediction indicator is taken into account and countermeasures are prepared to make the communication in the telecommunication network more robust before the anomaly occurs.

According to a further advantageous example the model based mapping unit or a further model-based mapping unit of the anomaly identifier is configured to map the received plurality of network measurements via a machine-trained anomaly detection model to an anomaly detection indicator, and the output unit or a further output unit is configured to provide the anomaly detection indicator, which indicates the detection of the abnormal activity in the telecommunications network. By combining a detection and a prediction model in the anomaly identifier both steps, namely prediction and detection and therefore the advantages of both steps, can be combined.

Claim <NUM> relates to a computer-implemented method for identifying an abnormal activity in a telecommunications network, wherein the method comprises the steps of.

Claim <NUM> refers to a telecommunications network comprising an anomaly identifier according to any of the embodiments, a plurality of network probes, a network controller and a plurality of communication devices.

According to an advantageous example, an interface between the anomaly identifier and the network controller for communication is provided. According to one embodiment, the functionality of the anomaly identifier is implemented at least partly at the network side. According to another embodiment, the functionality of the anomaly identifier is implemented at least partly at the communication device side. The interface between the anomaly identifier and the network controller is defined in order to provide application-specific alarms, in particular based on the anomaly prediction indicator, and to inform how reliable the alarms are, in particular based on a/the reliability indicator. If the alarm is not reliable, the network controller ignores the alarm and does not prepare countermeasures. If the alarm is reliable, the alarm is taken into account and countermeasures are prepared to make the communication in the telecommunication network more robust before the anomaly occurs.

According to a further advantageous example, in particular if a functionality of the anomaly identifier is implemented at least partly at the communication device side, the channel state information, CSI, report method is used to provide application-specific alarms, in particular based on the anomaly prediction indicator. This would mean that the CSI reporting method considers the alarms to reflect a worse CSI in the future.

Claim <NUM> refers to computer-implemented-method of operating a telecommunications network according to any of the embodiments, wherein the method comprises at least the steps of.

Advantageously, by taking reactive measures based on the anomaly prediction indicator allows to react before the abnormal activity actually occurs thereby avoiding communication errors. The alarm may comprise or consist of the anomaly prediction indicator.

Claim <NUM> refers to a model determination unit for determining a prediction model, wherein the model determination unit comprises:.

According to one embodiment, aggregating training data comprises collecting data by recording data of the radio environment of interest, for example by performing a plurality of network measurements in relation to a telecommunications network of interest. According to another embodiment, the training data is collected by means of simulation, in particular by simulating envisioned abnormal activity.

According to an advantageous example, aggregating training data comprises labelling the collected data, in particular by using an anomaly detection model to detect anomalies in the data. For example, the training data is labelled as normal and abnormal activity. According to one embodiment, the training data is labelled manually. According to a further embodiment, the training data is labelled using a/the anomaly detection model. The anomaly detection model can be used for labelling the radio environment records thereby reducing and/or avoiding manual labelling effort.

According to an advantageous example the model determination unit is configured to train a neural classification network, wherein the neural classification network is trained to classify a consistency or an inconsistency between network measurements and predicted radio environment. Advantageously training data for training the neural classification network contains data relating to abnormal activity. The training of the neural classification network can be supervised and unsupervised. In the supervised setting, with the labeled normal and abnormal cases, a neural network classification network can be trained to detect if the predicted and measured radio environment at the prospective time slot are similar or not. In the unsupervised setting, the similarity between the predicted and measured radio environment at the prospective time slot can be quantified by distance measures, such as Lp norm or perceptual loss.

Claim <NUM> refers to a computer-implemented method for determining a prediction model during operation of a telecommunications network, wherein the method comprises:.

By determining the prediction model during operation of a telecommunications network using an anomaly detection model, the prediction model does not need to be intensely trained beforehand, but can be trained during operation. Advantageously the prediction model improves over time. According to one embodiment, the prediction feature of the anomaly identifier can be used in the telecommunications network in some point of time, in particular when the prediction is reliable enough.

According to a further aspect, a computer-implemented method for determining a prediction model is adapted to operate a model determination unit according to the embodiments.

Claim <NUM> refers to a system comprising an anomaly identifier according to the embodiments and a model determination unit according to the embodiments.

According to a further preferred embodiment, the system is part of a communication network according to the above described embodiments.

The proposed approach can be used in any telecommunication system, which needs to satisfy requirements for a proper operation, for example, a telecommunication system comprising an automated guided vehicle, AGV. The AGV needs for example to transmit its status to a controller entity which, based on this status, adjusts the movement of the AGV (e.g., trajectory, speed, etc.). For the AGV application, the communication can take place with a given cycle time, in which a status message is sent from the AGV and a corresponding control message is sent from the controller.

Further advantageous embodiments are derived from the following description and the drawings. In the drawings.

<FIG> depicts a schematic block diagram of an anomaly identifier <NUM>, which is configured for identifying an abnormal activity in a telecommunications network <NUM>. The telecommunications network <NUM> is described below with regard to <FIG>.

The anomaly identifier <NUM> is configured to differentiate between normal "bad" behaviour, e.g., expected bad channel impulse response due to fading, and abnormal "bad" behaviour due to unknown reasons. The abnormal bad behaviour is identified as abnormal activity.

The anomaly identifier <NUM> comprises a receiver unit <NUM>, which is configured to receive a plurality of network measurements NM in relation to an observed telecommunications network, for example, the telecommunications network <NUM>. The anomaly identifier <NUM> comprises a model-based mapping unit <NUM> which is configured to map the received plurality of network measurements NM via a machine-trained prediction model <NUM> to an anomaly prediction indicator API. The anomaly identifier <NUM> comprises an output unit <NUM> which is configured to provide the anomaly prediction indicator API, which indicates the prediction of the abnormal activity in the observed telecommunications network.

The network measurements NM in relation to the telecommunications network comprise measurements like throughput, signal strength, QoS, radio usage, wire usage, etc. sensed by network probes which are distributed over the telecommunications network. The network measurements NM can comprise network measurements from a radio domain and network measurements from a wired domain. Under normal condition, the radio environment, for example spectrum, signal strength, channel impulse response, is expected to continuously vary over the time. Anomalies will cause abrupt changes. The inconsistency between consecutive time slots can be used for anomaly prediction.

<FIG> depicts different variants for anomaly prediction.

According to a first variant, the prediction model <NUM> is trained to directly predict an abnormal activity. In this case, an output of the prediction model <NUM> provides the anomaly detection indicator API directly to the output unit <NUM>.

According to a second variant, the prediction model <NUM> is trained to predict the radio environment PRE at a prospective measurement time slot. According to the embodiment, the anomaly identifier <NUM> comprises a classification entity <NUM>, which is displayed with dashed lines. For example, a comparison between the predicted radio environment PRE and the network measurements NM is evaluated by the classification entity <NUM> using an applicable distance measure, for example a distance based on an applicable Lp norm. The applicable distance measure is based for example on the network measurements NM and/or on the predicted radio environment PRE.

According to a third variant, the classification entity <NUM> is a neural classification network <NUM>. The neural classification network <NUM> is trained to classify a consistency between the network measurements NM and the predicted radio environment PRE. Advantageously, the neural classification network <NUM> is used instead of using a handcrafted evaluation metric, for example the Lp distance.

According to the embodiment displayed in <FIG>, the output unit <NUM> is configured to provide a reliability indicator RI. The reliability indicator RI provides a measure of the reliability of the anomaly prediction indicator API. If the prediction is not reliable, the anomaly prediction indicator is ignored and no countermeasures are prepared. If the prediction is reliable, the anomaly prediction indicator is taken into account and countermeasures are prepared to make the communication in the telecommunication network more robust before the anomaly occurs. The reliability indicator RI can be calculated by an entity of the model-based mapping unit <NUM> or another entity of the anomaly identifier <NUM>.

According to another embodiment the anomaly identifier <NUM> can comprise a further output unit for providing the reliability indicator RI.

According to the depicted embodiment of <FIG>, the anomaly identifier <NUM> comprises a further receiver unit <NUM>, which is configured to receive a plurality of network measurements NM in relation to an observed telecommunications network. Further, the anomaly identifier <NUM> comprises a further model-based mapping unit <NUM>, which is configured to map the received plurality of network measurements NM via a machine-trained anomaly detection model <NUM> to an anomaly detection indicator ADI. Further, according to the embodiment, the anomaly identifier <NUM> comprises a further output unit <NUM>, which is configured to provide the anomaly detection indicator ADI, which indicates the detection of the abnormal activity in an observed telecommunications network. By combining a detection and a prediction model in the anomaly identifier <NUM> both steps, namely prediction and detection and therefore the advantages of both steps, are combined in the anomaly identifier <NUM>.

According to another embodiment the functionality of the further receiver unit <NUM> and/or the further model based mapping <NUM> unit and/or the further output unit <NUM> can be implemented in the receiver unit <NUM> and/or the model based mapping unit <NUM> and/or the output unit <NUM> of the anomaly detector, such that the further receiver unit <NUM> and/or the further model based mapping <NUM> unit and/or the further output unit <NUM> are not required.

<FIG> depicts an exemplary telecommunications network <NUM>.

The telecommunications network <NUM> comprises an anomaly identifier <NUM> according to any of the described embodiments for identifying an abnormal activity in the telecommunications network <NUM>. Further, the telecommunications network <NUM> comprises a plurality of network probes P which are configured to sense the network measurements NM in relation to the telecommunications network <NUM>, the network measurements NM comprising measurements like throughput, signal strength, QoS, radio usage, wire usage. The network probes P are distributed over the telecommunications network <NUM>. According to the embodiment, three network probes P1, P2 and P3 are depicted. The network probes P could be independent units or part of communication devices.

Further, the telecommunications network <NUM> comprises a network controller <NUM> and a plurality of communication devices D. According to the embodiment, three communication devices D1, D2 and D3 are depicted.

According to an advantageous example, an interface between the anomaly identifier and the network controller for communication is provided. According to one embodiment, the functionality of the anomaly identifier is implemented at least partly at the network side. According to another embodiment, the functionality of the anomaly identifier is implemented at least partly at the communication device side. The interface between the anomaly identifier and the network controller is defined in order to provide application-specific alarms, in particular based on the anomaly prediction indicator API, and to inform how reliable the alarms are, in particular based on a/the reliability indicator RI.

According to a further advantageous example, in particular if a functionality of the anomaly identifier is implemented at least partly at the communication device side, the channel state information, CSI, report method is used to provide application-specific alarms, in particular based on the anomaly prediction indicator. This would mean that the CSI reporting method considers the alarms to reflect a worse CSI in the future. This is depicted with the dotted line between the communication device D3 and the network controller.

<FIG> depicts a schematic flow diagram of a computer-implemented method <NUM> of operating a telecommunications network <NUM> according to an embodiment. At least some of the steps are performed at the anomaly identifier <NUM>.

During operation of the telecommunications network <NUM> communication takes place in the telecommunications network <NUM>.

The method <NUM> comprises at least the steps of:.

<FIG> depicts a schematic block diagram of a model determination unit <NUM> for determining a prediction model. According to the embodiment the model determination unit <NUM> comprises an aggregator unit <NUM> which is configured to aggregate training data TD comprising a plurality of network measurements NM of a telecommunications network, for example a telecommunications network <NUM> according to the embodiments.

The model determination unit <NUM> comprises further a training unit <NUM>, which is configured to train the prediction model <NUM> in dependence on the training data TD. The prediction model <NUM> is trained to predict the radio environment at a prospective time slot and/or to predict an abnormal activity.

Advantageously, the prediction model <NUM> learns a temporal correlation in the radio environment from training data TD and exploits the temporal correlation for prediction during operation of the anomaly identifier. The prediction model is trained to differentiate between normal and abnormal activity in the radio environment.

According to one embodiment, aggregating training data TD comprises collecting data by recording data of the radio environment of interest, for example by performing a plurality of network measurements in relation to a telecommunications network of interest. According to another embodiment, the training data TD is collected by means of simulation, in particular by simulating envisioned abnormal activity.

According to an advantageous example, aggregating training data TD comprises labelling the collected data, in particular by using an anomaly detection model <NUM> to detect anomalies in the data. For example, the training data TD is labelled as normal or abnormal activity. According to one embodiment, the training data TD can be labelled manually. According to a further embodiment, the training data TD can be labelled using the anomaly detection model <NUM>. The anomaly detection model <NUM> being already trained for detecting anomalies does not require labelled data. Therefore, the anomaly detection model <NUM> can be used for labelling the radio environment records thereby reducing and/or avoiding manual labelling effort.

According to an advantageous example, the model determination unit <NUM> is configured to train a neural classification network <NUM>, wherein the neural classification network <NUM> is trained to classify a consistency or an inconsistency between network measurements NM and predicted radio environment PRE. Advantageously, training data TD for training the neural classification network <NUM> contains data relating to abnormal activity.

<FIG> depicts schematically a system <NUM> comprising an anomaly identifier <NUM> according to the embodiments and a model determination unit <NUM> according to the embodiments. According to a further preferred embodiment, the system is part of a communication network <NUM> according to the above described embodiments.

<FIG> depicts schematically a training method <NUM> of a prediction model <NUM> according to an embodiment.

The method <NUM> for determining the prediction model <NUM> is performed during operation of the telecommunications network <NUM>. According to the embodiment the telecommunications network comprises an anomaly identifier <NUM> and a model determination unit <NUM>, for example a system <NUM> comprising both the anomaly identifier <NUM> and the model determination unit <NUM>.

By determining the prediction model <NUM> during operation of the telecommunications network <NUM> using an anomaly detection model, the prediction model <NUM> does not need to be intensely trained beforehand, but can be trained during operation. Advantageously, the prediction model <NUM> improves over time. According to an embodiment, the prediction feature of the anomaly identifier <NUM> can be used in the telecommunications network <NUM> in some point of time, in particular when the prediction is reliable enough.

The method <NUM> comprises the steps of
aggregating <NUM> training data TD comprising a plurality of network measurements NM of a telecommunications network <NUM> at the aggregator unit <NUM> of the model determination unit <NUM>.

The step of aggregating <NUM> training data TD comprises collecting data by receiving a plurality of network measurements NM in relation to the telecommunications network <NUM>. The network measurements NM are sensed by the network probes P of the telecommunications network <NUM>. The network measurements NM can be received directly at the aggregating unit or can be transmitted via the receiver unit <NUM> of the anomaly identifier <NUM>. The step of aggregating <NUM> training data TD comprises further labelling the collected data, in particular by using an anomaly detection model <NUM> to detect anomalies in the data. According to the embodiment, during operation of the telecommunication network <NUM> the anomaly detection model <NUM> is used to detect anomalies. The further model-based mapping unit of the anomaly identifier <NUM> maps received plurality of network measurements via the machine-trained anomaly detection model <NUM> to an anomaly detection indicator, and the further output unit provides the anomaly detection indicator, which indicates the detection of the abnormal activity in the telecommunications network. At the same time, output of the anomaly detection model <NUM> can be used as labelled data relating to network measurements and therefore as training data.

The method comprises further a step of training <NUM> the prediction model <NUM> in dependence on the training data TD.

The proposed approach can be used to predict anomalies whose presence is detectable before their harmful actions. For instance, if a jammer enters the monitored telecommunications network <NUM>, it will create a change in the channel propagation condition. The anomaly identifier <NUM> can detect the existence of the jammer based on the change of channel impulse response before the jammer starts transmitting signals to block the communication channel. Another example would be an obstacle blocking the transmission either for a short time, also called moving obstacle, or for a prolonged time, also called static obstacle.

Referring now to <FIG> exemplary embodiments of usage of the present disclosure is described. <FIG> depict different sequences of network measurements, in particular signal-to-interference-plus-noise ratio, SINR, over time.

<FIG> depicts for example a detection phase, which is used to train the prediction model <NUM>. The prediction model <NUM> learns to differentiate between normal and abnormal activity, for instance by observing the signal-to-interference-plus-noise ratio, SINR, over time. Under normal condition, the radio environment, for example spectrum, signal strength, channel impulse response, is expected to continuously vary over the time. Anomalies, as an intrusion of external unwanted entities as well as jamming of the wireless spectrum cause abrupt changes, and can therefore be detected as a severe change in the SINR. For example in the case of a jammer, the SINR decreases due to the increase of the interfering power caused by the jammer. In the case of an obstacle, the received signal power decreases, also causing a decrease of the SINR. In both cases, the anomaly is progressive over time.

Claim 1:
An anomaly identifier (<NUM>) for identifying an abnormal activity in a telecommunications network (<NUM>), wherein the anomaly identifier comprises
a receiver unit (<NUM>) configured to receive a plurality of network measurements (NM) in relation to the telecommunications network (<NUM>);
a model-based mapping unit (<NUM>) configured to map the received plurality of network measurements (NM) via a machine-trained prediction model (<NUM>) to an anomaly prediction indicator (API), wherein the prediction model (<NUM>) is trained to predict the radio environment (PRE) at a prospective measurement time slot, and
an output unit (<NUM>) configured to provide the anomaly prediction indicator (API), which indicates the prediction of the abnormal activity in the telecommunications network (<NUM>), wherein the anomaly prediction indicator (API) is provided in dependence to a comparison of network measurements (NM) and the predicted radio environment (PRE).