Patent Description:
In Network Operation Centers of mobile networks, basic network key performance indicators (KPIs) are continuously being monitored. The KPIs are based on node and network counters. Node counters are implemented in network nodes and collected periodically by the performance monitoring (PM) systems. Counters are aggregated in time for network node or other dimensions. KPIs can indicate node or network failures but usually they are not detailed enough for troubleshooting, and they are not suitable for identifying end-to-end, user-perceived service quality issues. Troubleshooting is typically performed by investigating more detailed network logs collected from different network nodes and domains.

Advanced analytics systems, such as the Ericsson Expert Analytics (EEA) are based on collecting and correlating atomic network events. These type of passive monitoring solutions are suitable for session-based troubleshooting and analysis of network issues as well as for monitoring service quality and end-to-end customer experience.

Event-based analytics requires real-time collection and correlation of characteristic node and protocol events from different radio and core nodes, probing signaling interface and sampling of the user-plane traffic as well. In addition to data collection and correlation functions, the system requires an advanced database, rule engine, and a big data analytics platform as well.

In view of the introduction of Fifth Generation (<NUM>) mobile networks, it is expected that mobile networks will serve (and provide quality of service, quality of experience) a large variety of new service types as well as serve a much higher number of devices or user equipment (UEs) than previous network technologies. The expected traffic will significantly increase the incoming event rate to be processed by network analytics systems.

One of the major issues with the event-based monitoring methods is the large amount of data which needs be processed, and consequently the large hardware requirement of the solution. For adequate end-to-end analysis of sessions, events are collected per UE from radio and core nodes, which includes heavy radio environment measurements (especially periodic measurements) and the registration and re-registration messages. The other major data source is related to the user-plane traffic which can be as much as <NUM>-<NUM> terabytes per second (Tbps) and the corresponding processing and storage capacity in cloud environment.

Document <CIT> discloses a technique pertaining to optimization of mobile telecommunications service during a power outage at one or more base stations. Said optimization includes identifying one or more of a plurality of base stations to which non-emergency electrical power has been interrupted, determining an initial number of users in areas corresponding to the one or more of the plurality of base stations, generating a user location probability model and a user call probability model, scheduling initial battery power operation for the plurality of base stations, monitoring user calls and user movement after the battery power operation has started, updating the user location probability model and the user call probability model based on the monitoring, and updating battery power operation scheduling for the plurality of base stations.

Document <CIT> discloses a method and a system of identifying and determining degradation of the quality of service (QoS) perceived by a subscriber in a network such as the Internet. Traffic of individual applications of the subscriber and aggregate traffic of a subscriber are monitored, captured, and processed to produce QoS statistics. End-to-end QoS metrics are provided for TCP connections based on the observation of packet flows at a single monitoring point. The QoS metrics include, for example, packet loss internally and externally to the monitoring point, detection of stalled periods and estimation of path delay.

Document "<NPL>, discloses a mobility model of people in urban areas for mobile wireless network simulation. A <NUM>-layer hierarchical approach is taken where the highest layer is an activity model that determines the high level activity that the node is performing (e.g., working). The second level is a task model that models the specific task within an activity (e.g., meeting with three people). The third level is an agent model that determines how the person moves from one location to another. These three models are based on a number of surveys and data sources. The activity model is based on a recent US Department of Labor Bureau of Labor Statistics time use study. Such time use studies gather detailed information about how the interviewees spent their time. The task model mostly focuses on mobility of office workers and is based on the current findings from research on meetings analysis. The agent model is based on the work from urban planning that has collected extensive knowledge of pedestrian flow. The models presented are implemented in a mobility simulator that is integrated with a wireless propagation model.

Document <CIT> discloses a communication analytics engine that executes in conjunction with a data collection platform that may provide a unified and scalable solution for call data aggregation and processing. A data collection platform may establish a communication connection with a wireless carrier network. The data collection platform may collect call data of multiple user devices via the communication connection, in which the multiple user devices may use the wireless carrier network to initiate and receive calls to one or more additional devices. The data collection platform may convert the call data into a format that is readable by the communication analytics engine. The communication analytics engine may analyze the call data to generate analytic results that includes one or more key performance indicators (KPIs).

Document <CIT> discloses methods, computer-readable media and devices for selecting a plurality of network devices to perform a plurality of tasks in accordance with a set of functional network analytics instructions. For example, a processor deployed in a telecommunication network may receive a set of functional network analytics instructions compiled from a set of instructions in accordance with a functional network analytics platform application programming interface. The processor may further, in accordance with the set of functional network analytics instructions, select a plurality of network devices to perform a plurality of tasks, send the plurality of tasks to the plurality of network devices, receive control plane data from the plurality of network devices, correlate the control plane data in accordance with operations defined in the set of functional network analytics instructions to create resulting data, and forward the resulting data to at least one recipient device.

According to the present disclosure, a method, a network analysis system, a computer program and a carrier according to the independent claims are provided. Developments are set forth in the dependent claims.

According to one aspect of the disclosure, event-based network analytics system is provided for monitoring KPIs. The event-based analytics system implements an adaptive approach for network performance monitoring to reduce the required hardware resources of event-based network analytics system. In exemplary embodiments, performance monitoring is performed for a subset of KPIs, which are used for symptom detections, for a representative subset of subscribers. Dynamic filtering is performed in the different event data sources in order to ensure the statistically required samples for calculating KPIs for symptom detection. In addition, the monitoring of the limited set of events is only performed for an adaptively selected subset of the total subscriber base that is estimated to cover the geographical area of the mobile network in a statistically reliable way.

Referring now to the drawings, an exemplary embodiment of the disclosure will be described in the context of a <NUM> wireless communication network. Those skilled in the art will appreciate that the methods and apparatus herein described are not limited to use in <NUM> networks but may also be used in wireless communication networks operating according to other standards.

<FIG> illustrates a wireless communication network <NUM> according to one exemplary embodiment. The wireless communication network <NUM> comprises a radio access network (RAN) <NUM> and a core network <NUM> employing a service-based architecture. The RAN <NUM> comprises one or more base stations <NUM> providing radio access to UEs <NUM> operating within the wireless communication network <NUM>. The base stations <NUM> are also referred to as gNodeBs (gNBs). The core network <NUM> provides a connection between the RAN <NUM> and other packet data networks, such as the IMS or the Internet.

In one exemplary embodiment, the core network <NUM> comprises a plurality of network functions (NFs), such as a User Plane Function (UPF) <NUM>, an Access And Mobility Management Function (AMF) <NUM>, a Session Management Function (SMF) <NUM>, a Policy Control Function (PCF) <NUM>, a Unified Data Management (UDM) function <NUM>, a Authentication Server Function (AUSF) <NUM>, a Unified Data Repository (UDR) <NUM>, a Network Exposure Function (NEF) <NUM>, a Network Repository Function (NRF) <NUM> and a Network Slice Selection Function <NUM>. The core network <NUM> additionally includes a NWDAF <NUM> for generating and distributing analytics reports. These NFs comprise logical entities that reside in one or more core network nodes, which may be implemented by one or more processors, hardware, firmware, or a combination thereof. The functions may reside in a single core network node or may be distributed among two or more core network nodes. The network <NUM> may further include one or more Application Functions (AFs) <NUM> providing services to the network and or subscribers. The AFs <NUM> may be located in the core network <NUM> or be external to the core network <NUM>.

In conventional wireless communication network, the various NFs (e.g., SMF <NUM>, AMF <NUM>, etc.) in the core network <NUM> communicate with one another over predefined interfaces. In the service-based architecture shown in <FIG>, instead of predefined interfaces between the control plane functions, the wireless communication network <NUM> uses a services model in which the NFs query the NRF <NUM> or other NF discovery node to discover and communicate with each other.

According to one aspect of the disclosure, an event-based network analytics system <NUM> (<FIG>) is provided for network performance monitoring. The network analytics system <NUM> can be implemented by one or more instances of a NWDAF <NUM>, application function (AF) <NUM>, or some combination thereof. The event-based network analytics system <NUM> implements an adaptive approach to reduce the required hardware resources for event-based network analytics system. During a monitoring period, network performance monitoring is limited to a subset of events, which are used for symptom detection, for a representative subset of subscribers. Dynamic filtering in the different event data sources is performed in order to ensure the statistically required samples for calculating KPIs for symptom detection. In addition, the monitoring of the limited set of events is only performed for an adaptively chosen small subset of the total subscriber base that is estimated to cover the geographical entirety of the mobile network in a statistically reliable way.

The network is divided into monitoring areas, each covering multiple cells or the serving areas of several base stations. The network analytics system continuously collects and updates location and activity data for the subscribers in the monitoring areas and maintains a list of the active subscribers in these monitoring areas. Using statistical methods, the number of active subscribers that are required for symptom detection is determined per monitoring area and per event source. Based on the statistical methods, the analytical system selects the subscribers for which the event collection should be activated in each data sources. The selected number of subscribers is much lower than the total number of active subscribers. The user selection is done in representative way.

In case degradation is detected by the symptom KPIs in a monitoring area, additional troubleshooting KPIs are activated for the monitoring area and the data collection is activated for all or an increased number of active subscribers located in the monitoring area.

Optionally, the symptom KPIs can be monitored for other dimensions as well, such as per terminal, per service provider, etc. In this case, the analytics system collects subscriber information related to usage in these dimensions. If the symptom KPIs show degradation in another dimension, the number of monitored subscribers in the relevant dimension is increased to the troubleshooting level.

It is assumed that in majority of the time, the wireless network operates correctly and provides good service quality in most monitoring areas. The network analytics systems as herein described uses much lower hardware resources to monitor session in these areas than for sessions in monitoring areas where service quality degradation and network or node issues are detected. This reduction is achieved by monitoring only a limited number of symptoms KPIs per monitoring area for a subset of all the active users in the network. The network analytics system automatically detects and localizes issues where more detailed monitoring is needed and automatically increases the event rate or changes the event filtering settings to enable detailed troubleshooting and root cause analysis for the areas where service quality degradation or network issues are detected. Thus, the network analytics system can reduce hardware resources (processing capacity, memory and disk) by <NUM>%-<NUM>% compared to full monitoring.

The number of subscribers at different times can be different and change dynamically over time in the different monitoring areas. The network analytics system maintains a list of active subscribers per monitoring area. At any time, it can select explicitly the list of subscribers per area and for the whole network for which event collection should be performed and set automatically subscriber filters at each event source. Therefore, event collection is performed only for the required number of subscribers.

The symptom KPIs are calculated per monitoring area, which enables detecting cell related, i.e., radio issues. The symptom KPIs can be monitored in other dimension as well, which enables detecting other issues such as terminal or service-related issues.

<FIG> illustrates an exemplary process flow <NUM> for event-based network analytics as herein described. The process flow includes a learning loop <NUM> and an operational loop <NUM>. Both loops are in action continuously. The learning loop <NUM> implements a learning algorithm <NUM> that is continuously working to infer the currently best model of the subscribers' location and activity patterns. After initial subscriber location and activity models <NUM> have been inferred by the learning loop <NUM>, the operational loop <NUM> is continuously working to enable network performance monitoring and analytics for a suitable subset of representative subscribers based on the location and activity models <NUM>, who are identified by International Mobile Subscriber Identities (IMSIs). The main functions performed by the operational loop <NUM> comprises computing an optimal or representative set of subscribers to be monitored based on the location and activity models (<NUM>) , enforcing performance monitoring for the representative set of subscribers (<NUM>), computing symptom KPIs and detecting service degradation and/or network and node failures (<NUM>), expanding performance monitoring when service quality degradation and/or failure is detected (<NUM>), and determining root cause and corrective actions for any service quality degradation or failure (<NUM>).

<FIG> illustrates an overall architecture for event and data collection according to an embodiment of the present disclosure. The network analytics system <NUM> includes a mobility and activity manager <NUM>, a filtering manager <NUM>, user plane (UP) analyzer <NUM>, correlator <NUM> and network analyzer <NUM>. As will be hereinafter described in greater detail, the mobility and activity manager <NUM> implements the learning loop <NUM> and generates the location and activity models <NUM> for individual subscribers. The filtering manager <NUM>, user plane (UP) analyzer <NUM>, correlator <NUM> and network analyzer <NUM> implement the operational loop <NUM>. The filtering manager <NUM> determines the representative set of subscribers for which basic KPI monitoring is performed based on the location and activity models provided by the mobility and activity manager <NUM>. The filtering manager <NUM> also interacts with various network nodes in the network <NUM> to enforce the data collection for the representative set of subscribers. The UP analyzer <NUM> computes the basic KPIs based on a filtered user plane traffic stream provided by a packet filer in the network. The correlator <NUM> correlates event streams provided by various network nodes (e.g., AMF <NUM>, SMF <NUM>, gNB <NUM>) with corresponding packets in the user plane traffic. The network analyzer <NUM> detects service degradation and/or network and node failures, and performs root cause analysis when service quality degradation or failure is detected by the UP analyzer. When service quality degradation is detected, the network analyzer <NUM> signals the filtering manager to add additional subscribers and root cause analysis (RCA) events for monitoring areas where service degradation is detected to enable root cause analysis by the network analyzer <NUM>.

Referring back to <FIG>, the input data sources for the learning loop <NUM> comprise mobility events that can signal a new location for a subscriber and activity signaling events that can signal activity of the subscriber. A mobility event stream and activity event stream are preferably collected for all subscribers, or as many as is practical. The term input event is used herein to refer to both mobility events and activity signaling events. An input event typically comprises a subscriber identifier (e.g., IMSI), which can be used for correlating mobility events with activity signaling events and user plane traffic flows.

The following mobility events, for example, can be used to identify the location of a subscriber in Fourth Generation (<NUM>) and <NUM> networks:.

An activity signaling event is generated for a given time resolution (e.g., once per hour) if there is any data traffic during the time bin. Signaling traffic is captured independently from the sampling performed by the operational loop <NUM>. The activity signaling event contains a subscriber identifier (e.g., IMSI), timestamp, and bytes uploaded and downloaded.

In addition to the mobility and activity signaling events, reference data may optionally be obtained. The reference data can be used to provide analytics in dimensions other that locations. For example, using reference data, KPIs could be generated for different device types, subscription types and/or subscription plans. Exemplary reference data may include:.

The mobility event streams and activity signaling event streams are input to the mobility and activity manager <NUM>, which implements the learning loop <NUM>. The learning algorithm <NUM> implemented by the mobility and activity manager <NUM> has three main tasks: to learn the location model for each subscriber from the mobility event stream; to learn the activity model for each subscriber from the input activity event stream, and maintain a location database <NUM> indicating the current location of each subscriber. The location database <NUM> is updated responsive to a mobility event if there is any change in the actual location of the subscriber. The learning parts of the learning algorithm are based on statistical data collection.

The location and activity models <NUM> are derived for a particular time window (e.g., one week). The same time window is preferably used for both the location model and activity model. The time window is divided into N time bins based on a desired time resolution of the models <NUM> (e.g. <NUM> hour time bins). Thus, the time dimension of the location model and activity model assuming a one week time window and <NUM> hour time resolution will be <NUM> time bins (N = <NUM> × <NUM> = <NUM>).

The location model also includes a geographic dimension. The network coverage area is divided into M distinct geographic area based on a desired geographic resolution. Examples of different geographic resolutions include:.

Location and activity modelling is performed on a per subscriber basis. That is, separate location models <NUM> and activity models <NUM> are derived for each subscriber. The location model is a N × M matrix containing probabilities p_i, j that the subscriber is at time segment i located within AreaJ with the given probability. The location model is independent of any traffic activity, so inactive periods can still produce input to location model whenever the subscriber is moving, though the most location updates may be performed when there is actual traffic detected. The activity model comprises an activity vector of N elements q_i that contain the probability that the subscriber will be active at time segment I with the given probability. In some embodiments, the activity model may further include an activity intensity vector indicating the intensity of the activity. The activity intensity vector comprises N elements, each containing a numeric indicator (e.g., falling into [<NUM>-<NUM>] range) that is proportional to the traffic volume in case of activity. This intensity can be a derivative of the traffic bytes, even by further transformations such as logarithm, etc. The aim is to provide a magnitude of traffic. All other factors being equal, the operational model can choose subscribers with higher activity to generate more KPI samples for analysis.

The mobility and activity manager <NUM> also maintains the location database <NUM>. The location database <NUM> is a simple database that provides a way to lookup subscriber location (last known location for a given IMSI or a list of subscribers in a given monitoring area, AreaJ. The mobility and activity manager <NUM> automatically updates the location database <NUM> whenever a new location event arrives for a subscriber in the input stream.

The mobility and activity manager <NUM> provides the location and activity models <NUM> for the individual subscribers to the filtering manager <NUM>, which implements part of the operational loop <NUM>. The function of the operational loop <NUM> can be divided into five main aspects:.

Based on the location and activity models <NUM> provided by the mobility and activity manager <NUM>, the filtering manager <NUM> determines a representative set of subscribers for which monitoring is performed. The representative subscriber set is primarily focused on covering the entire geographical area of the network <NUM> by active subscribers in order to provide a statistically large enough set of KP! samples so that the network health can be evaluated in each of the defined geographical areas without monitoring the whole subscriber base, which is expensive. The representative subscriber set computation is an optimization process that aims to fulfill the following conditions:.

In case multiple solutions exist for covering the entire geographical area of the mobile network with minimal number of subscribers in the representative set, those subscribers are preferred where the expected activity intensity is maximal.

By including dimensions such as subscription type or device type in the input data, as an auxiliary condition, the optimization process can take these dimensions into account as well, beyond the primary dimension location. Whenever multiple solutions exist for covering the entire geographical area of the mobile network with minimal number of subscribers in the representative set, the process can select that representative subscriber set among those where the values of these additional dimensions are also more evenly distributed. In practice this yields good coverage for all subscription types, all available device types, etc..

The filtering manager <NUM> generates and sends control signaling to various network node in the RAN <NUM> and core network <NUM> to enforce the data collection for the representative set of subscribers. <FIG> illustrates the data sources and control signaling in an exemplary embodiment. The solid black dots in <FIG> represent the data sources (user data and events). The dashed lines show the flow of data and events to the network analytics system <NUM>. In the exemplary embodiment shown in <FIG>, user plane traffic is filtered by a packet broker and the filtered traffic flow is input to the UP analyzer. Events captured by the AMF <NUM> and SMF <NUM> in the core network30 and gNB <NUM> are input to the correlator <NUM>.

User plane traffic is captured by a packet broker <NUM> or virtual TAP (vTAP). The filtering manager <NUM> sends the representative subscriber list to the packet broker <NUM> periodically, which filters the traffic for the required subscribers. The UP Analyzer <NUM> receives the UP traffic for the representative subscribers and calculates the user plane KPIs for the filtered traffic.

The filtering manager <NUM> activates the events needed for calculating the symptom KPIs in the monitoring phase. The filtering manager <NUM> also activates additional troubleshooting events for troubleshooting KPIs as needed. In one embodiments, the troubleshooting events are activated for subscribers in the affected monitoring area and for specific node instances that are being impacted. The activation of events in the network nodes and filtering of user plane traffic is done by sending configuration messages. The correlator <NUM> receives and timestamps the events real-time and correlates them by IMSI with the user plane traffic flow. The symptom KPIs are calculated in by the network analyzer <NUM>.

According to one aspect of the disclosure, a limited set of symptom KPIs/events is monitored to detect service quality degradation. For example, in case of streaming video services, the monitoring solution can detect rebuffering events (based on user plane transport network metrics) and can calculate an average playback time between two rebufferings KPI as a service quality metric. In case of service degradation, the set of representative subscribers and/or events can be temporarily expanded to enable root cause analysis. Generally, the expansion of the data collection focuses on the problematic monitoring areas.

As previously noted, the location database <NUM> contains a list of all subscribers and their last known location. When service quality degradation is detected, the filtering manager <NUM> can query the location database <NUM> to obtain a list of subscribers in the affected monitoring area. The filtering manager <NUM> can add additional subscribers in the affected monitoring area to the representative set of subscribers. The additional subscribers may comprise a predetermined number of additional subscribers, the subscribers in the affected monitoring area that meet some predetermined criteria (e.g., active subscribers with a predetermined level of activity), or all subscribers in the affected area. Thus, the representative set is expanded temporarily during a troubleshooting period to collect more data for root cause analysis. Once, the causes of the service quality degradation are determined, the additional subscribers added during the troubleshooting period can be removed.

In addition to expansion of the subscribers, the filtering manager <NUM> can temporarily expand the number and type of events that are collected during the troubleshooting period to facilitate root cause analysis. The events activated during the troubleshooting period are referred to herein as the troubleshooting events or RCA events. These additional event types can help understanding of the service quality degradation problem and find the root cause of the service quality degradation. For example, in case of video service quality degradation, the filtering manager <NUM> can enable radio environment measurements, radio connection loss events, and more details on handovers to aid the root cause analysis. Once, the causes of the service quality degradation are determined, the filtering manager <NUM> can revert to the base set of events used for normal KPI monitoring.

Even in the absence of service quality degradation, the quality of the representative set of subscribers may be modified from time to time. For example, the location and activity models <NUM> may be recomputed at periodic intervals (e.g., once per week) or responsive to some predetermined events. When new location and activity models <NUM> are available, the filtering manager <NUM> can recompute a new set of representative subscribers based on the new location and activity models <NUM>.

Additionally, the filtering manager <NUM> can be configured to make minor adjustments to the set of representative subscribers before new location and activity models <NUM> are available. As previously noted, the representative set of subscribers is a best estimate based on past behavior based on the location and activity models <NUM>. Actual events may deviate from the location and activity model used to generate the set of representative subscribers. For example, a subscriber selected for inclusion in the representative set may be inactive, or may be active but not in the location predicted in the location model. Also, the activity level could be lower than expected. In some cases, the representative set may include less than the desired minimum number of subscribers for a particular monitoring area. The filtering manager <NUM> can be configured to make adjustments to the set of representative subscribers. The filtering manager <NUM> can, for example, replace an inactive subscriber or subscriber with low activity with an active subscriber or another subscriber with a higher activity level in the same monitoring area. When the number of active subscribers is less than a desired minimum, the filtering manager <NUM> can add additional subscribers to the set. In some cases, the filtering manager <NUM> may trigger a recomputation of the location and activity models <NUM>, in which case the set of representative subscribers is determined based on the new location and activity models <NUM>.

<FIG> illustrates an exemplary method <NUM> implemented by a network analytics system <NUM> comprising one or more network nodes. The network analytics system <NUM> receives a per subscriber, time dependent location model and activity model for each of a plurality of subscribers located in one or more geographic areas of the network (block <NUM>). The network analytics system <NUM> determines, based on the location models and activity models, a subset of representative subscribers that includes a representative sample of subscribers in each of the one more or geographic areas (block <NUM>). The network analytics system <NUM> further generates and sends control signals to one or more network nodes to capture user plane traffic and events for the subset of representative subscribers (block <NUM>).

Some embodiments of the method <NUM> further comprise computing network performance metrics (e.g., KPIs) for the one or more geographic areas based on the captured user plane traffic and events for the subset of representative subscribers (block <NUM>), and detecting service quality degradation in one of the one or more geographic areas based on the network performance metrics (block <NUM>).

Some embodiments of the method <NUM> further comprise adapting, responsive to service quality degradation, the subset of representative subscribers to increase a number of the representative subscribers for at least one geographic area where service quality degradation is detected (block <NUM>).

Some embodiments of the method <NUM> further comprise expanding event types being captured for the subset of representative subscribers to include one or more troubleshooting events.

Some embodiments of the method <NUM> further comprise updating the subset of representative subscribers.

In some embodiments of the method <NUM>, updating the subset of representative subscribers is performed periodically or responsive to predetermined triggers.

In some embodiments of the method <NUM>, updating the subset of representative subscribers comprises replacing a current representative subscriber with a new representative subscriber with a higher activity level.

In some embodiments of the method <NUM>, updating the subset of representative subscribers comprises replacing comprises adding representative subscribers to the subset when a number of active subscribers in one of the geographic areas falls below a threshold.

In some embodiments of the method <NUM>, updating the subset of representative subscribers comprises is performed responsive to a mobility event for one of the representative subscribers.

In some embodiments of the method <NUM>, updating the subset of representative subscribers comprises receiving an updated location model and activity model, and determining an updated subset of representative subscribers based on the updated location model and activity model.

Some embodiments of the method <NUM> further comprise generating the location model and activity model.

In some embodiments of the method <NUM>, the location model comprises, for each of the plurality of subscribers, a set of location probabilities, each location probability representing a likelihood that the subscriber will be within a particular geographic area at a particular time.

In some embodiments of the method <NUM>, the activity model comprises, for each of the plurality of subscribers, a set of activity probabilities, each activity probability representing a likelihood that the subscriber will be active at a particular time.

<FIG> illustrates an exemplary method <NUM> implemented by a network analytics system <NUM> comprising one or more network nodes of generating location and activity models <NUM> for network monitoring. The network analytics system <NUM> receives location events for a subscriber, wherein the location events indicate a location of the subscriber (block <NUM>). The network analytics system <NUM> further receives activity events for the subscriber, wherein the activity events indicate activity of the subscriber (block <NUM>). The network analytics system <NUM> generates a location model for the subscriber based on the location events (block <NUM>). The location model comprises a set of location probabilities, each location probability representing a likelihood that the subscriber will be within a particular geographic area at a particular time. The network analytics system <NUM> further generates an activity model for the subscriber based on the activity events (block <NUM>). The activity model comprises a set of activity probabilities, each activity probability representing a likelihood that the subscriber will be active at a particular time.

In some embodiments of the method <NUM>, the activity model further comprises a set of intensity parameters, each intensity parameter indicating a predicted activity level of the subscriber at a particular time.

Some embodiments of the method <NUM> further comprise maintaining a location database indicating a current location of each of the one or more subscribers, and updating the location database responsive to the location events.

Some embodiments of the method <NUM> further comprise receiving a request from a network monitoring control node for subscribers in a specified geographic area, and providing, responsive to the request, a list of one or more subscribers in the specified geographic area to the network monitoring control node.

Some embodiments of the method <NUM> further comprise receiving a location request from a network monitoring control node, the location request including a subscriber identifier for one of the subscribers, and providing, responsive to the request and for each, the geographic area in which the subscriber is currently located.

An apparatus can perform any of the methods herein described by implementing any functional means, modules, units, or circuitry. In one embodiment, for example, the apparatuses comprise respective circuits or circuitry configured to perform the steps shown in the method figures. The circuits or circuitry in this regard may comprise circuits dedicated to performing certain functional processing and/or one or more microprocessors in conjunction with memory. For instance, the circuitry may include one or more microprocessor or microcontrollers, as well as other digital hardware, which may include Digital Signal Processors (DSPs), special-purpose digital logic, and the like. The processing circuitry may be configured to execute program code stored in memory, which may include one or several types of memory such as read-only memory (ROM), random-access memory, cache memory, flash memory devices, optical storage devices, etc. Program code stored in memory may include program instructions for executing one or more telecommunications and/or data communications protocols as well as instructions for carrying out one or more of the techniques described herein, in several embodiments. In embodiments that employ memory, the memory stores program code that, when executed by the one or more processors, carries out the techniques described herein.

<FIG> illustrates an exemplary network monitoring control node <NUM> configured to perform the method shown in <FIG>. The network monitoring control node <NUM> comprises a receiving unit <NUM>, a determining unit <NUM> a control unit <NUM>, and optional computing unit <NUM>, an optional detecting unit <NUM> and an optional adapting unit <NUM>. The various units <NUM> - <NUM> can be implemented by hardware and/or by software code that is executed by a processor or processing circuit.

The receiving unit <NUM> is configured to receive a per subscriber, time dependent location model and activity model for a plurality of subscribers located in one or more geographic areas of the network. The determining unit <NUM> is configured to determine, based on the location models and activity models, a subset of representative subscribers that includes a representative sample of subscribers in each of the one more or geographic areas. The control unit <NUM> is configured to generate and send control signals to one or more network nodes to capture user plane traffic and events for the for the subset of representative subscribers. The computing unit <NUM>, when present, is configured to compute network performance metrics for the one or more geographic areas based on the captured user plane traffic and events for the subset of representative subscribers. The detecting unit <NUM>, when present, is configured to detect service quality degradation in one of the one or more geographic areas based on the network performance metrics. The adapting unit <NUM>, when present, is configured to adapt, responsive to service quality degradation, the subset of representative subscribers to increase a number of the representative subscribers for at least one geographic area where service quality degradation is detected, the event types being captured for the subset of representative subscribers to include one or more troubleshooting events, or both.

<FIG> illustrates an exemplary location and activity modeling node <NUM> configured to perform the method shown in <FIG>. The location and activity modeling node <NUM> comprises a location event receiving unit <NUM>, an activity event receiving unit <NUM>, a location modeling unit <NUM>, an activity modeling unit <NUM>, and a database management unit <NUM>. The various units <NUM> - <NUM> can be implemented by hardware and/or by software code that is executed by a processor or processing circuit. The location event receiving unit <NUM> is configured to receive location events for a subscriber, wherein the location events indicate a location of the subscriber. The activity event receiving unit <NUM> is configured to receives activity events for the subscriber, wherein the activity events indicate activity of the subscriber. The location modeling unit <NUM> is configured to generate a location model for the subscriber based on the location events. The location model comprises a set of location probabilities, each location probability representing a likelihood that the subscriber will be within a particular geographic area at a particular time. The activity modeling unit <NUM>, when present, is configured to generate an activity model for the subscriber based on the activity events. The activity model comprises a set of activity probabilities, each activity probability representing a likelihood that the subscriber will be active at a particular time. In some embodiments, the activity model further comprises, for each subscriber, intensity parameters indicating a predicted activity level of the subscriber at a particular time. The database management unit <NUM>, when present, is configured to maintain a location database storing a last known location for each of the subscribers.

<FIG> illustrates a network node <NUM> according to one embodiment that may be configured to function as a network monitoring control node <NUM>, location and activity modeling node <NUM>, or both. The network node <NUM> comprises communication circuitry <NUM>, processing circuitry <NUM>, and memory <NUM>.

The communication circuitry <NUM> comprises network interface circuitry for communicating with other network nodes in the wireless communication network over a communication network.

Processing circuitry <NUM> controls the overall operation of the network node <NUM> and is configured to perform one or more of the methods <NUM>, <NUM> shown in <FIG> and <FIG> respectively. Such processing includes coding and modulation of transmitted data signals, and the demodulation and decoding of received data signals. The processing circuitry <NUM> may comprise one or more microprocessors, hardware, firmware, or a combination thereof.

Memory <NUM> comprises both volatile and non-volatile memory for storing computer program code and data needed by the processing circuitry <NUM> for operation. Memory <NUM> may comprise any tangible, non-transitory computer-readable storage medium for storing data including electronic, magnetic, optical, electromagnetic, or semiconductor data storage. Memory <NUM> stores a computer program <NUM> comprising executable instructions that configure the processing circuitry <NUM> to implement the methods <NUM>, <NUM> according to <FIG> and <FIG> respectively. A computer program in this regard may comprise one or more code modules corresponding to the means or units described above. In general, computer program instructions and configuration information are stored in a non-volatile memory, such as a ROM, erasable programmable read only memory (EPROM) or flash memory. Temporary data generated during operation may be stored in a volatile memory, such as a random access memory (RAM). In some embodiments, computer program <NUM> for configuring the processing circuitry <NUM> as herein described may be stored in a removable memory, such as a portable compact disc, portable digital video disc, or other removable media. The computer program <NUM> may also be embodied in a carrier such as an electronic signal, optical signal, radio signal, or computer readable storage medium.

A computer program comprises instructions which, when executed on at least one processor of an apparatus, cause the apparatus to carry out any of the respective processing described above. A computer program in this regard may comprise one or more code modules corresponding to the means or units described above.

Claim 1:
A method (<NUM>) of network performance monitoring implemented by a network node (<NUM>, <NUM>), the method (<NUM>) comprising:
receiving (<NUM>) a per subscriber, time dependent location model and a per subscriber, time dependent activity model for each of a plurality of subscribers located in one or more geographic areas of the network;
determining (<NUM>), based on the location models and activity models, a subset of representative subscribers that includes a representative sample of subscribers in each of the one or more geographic areas;
generating and sending (<NUM>) control signals to one or more network nodes to capture user plane traffic and events for the subset of representative subscribers;
computing (<NUM>) network performance metrics for the one or more geographic areas based on the captured user plane traffic and events for the subset of representative subscribers; and
detecting (<NUM>) service quality degradation in one of the one or more geographic areas based on the network performance metrics.