Patent ID: 12223263

DETAILED DESCRIPTION

The following disclosure includes many different embodiments, or examples, for implementing different features of the subject matter. Examples of components, values, operations, materials, arrangements, or the like, are described below to simplify the present disclosure. These are, of course, examples and unintended to limit. Other components, values, operations, materials, arrangements, or the like, are contemplated. For example, the formation of a first feature over or on a second feature in the description that follows include embodiments in which the first and second features are formed in direct contact, and further include embodiments in which additional features are formed between the first and second features, such that the first and second features are unable to contact directly. In addition, the present disclosure repeats reference numerals and/or letters in the various examples. This repetition is for the purpose of simplicity and clarity and does not in dictate a relationship between the various embodiments and/or configurations discussed.

Further, spatially relative terms, such as “beneath,” “below,” “lower,” “above,” “upper” and the like, are usable herein for ease of description to describe one element or feature's relationship to another element or feature as illustrated in the FIGS. The spatially relative terms are intended to encompass different orientations of the device in use or operation in addition to the orientation depicted in the FIGS. The apparatus is otherwise oriented (rotated 90 degrees or at other orientations) and the spatially relative descriptors usable herein likewise are interpreted accordingly.

An EDA architectural pattern is applied by the design and implementation of applications and systems that transmit event messages among loosely coupled software components and services. An event-driven system typically consists of event emitters (agents, data sources), event consumers (sinks), and event channels (the medium the event messages travel from emitter to consumer). Event emitters detect, gather, and transfer event messages. An event emitter does not know the consumers of the event messages, the event emitter does not even know whether an event consumer exists, and in the event the consumer exists, the event emitter does not know how the event message is used or further processed. Event consumers apply a reaction as soon as an event message is presented. The reaction is or is not completely provided by the event consumer. For example, the event consumer filters the event message frame while the event policy executes and produces transformation and forwards the event message frame to another component or the event consumer supplies a self-contained reaction to such event message frame. Event channels are conduits in which event message frames are transmitted from event emitters to event consumers. In some embodiments, event consumers become event emitters after receiving event message frame and then forwarding the event message frame to other event consumers. The configuration of the correct distribution of event message frames is present within the event channel. The physical implementation of event channels is based on components, such as message-oriented middleware or point-to-point communication, which might rely on a more appropriate transactional executive framework (such as a configuration file that establishes the event channel).

A correlation and policy engine (CPE) is a software application that programmatically understands relationships. CPEs are configured to be used in system management tools to aggregate, normalize, and analyze event data. Event correlation is a technique for making sense of many events and pinpointing the few events that are important in a mass of information. This is accomplished by looking for and analyzing relationships between events. Further, a CPE is a program or process that receives machine-readable policies and applies them to a particular problem domain to constrain the behavior of network resources.

In other approaches, the CPE has tightly bound capabilities that limits the CPE. For example, multiple use-cases used by tightly bound systems, include: (1) a change management system; (2) a root cause analysis engine (performed in real time), (3) an anomaly detection model engine (performed in real time), (4) an AI model performance engine (performed in real time), (5) a performance analysis engine, (6) a security analytics engine, (7) an on-the-fly policy load/change engine.

Change management systems are an information technology (IT) service management discipline. The objective of change management is to ensure that standardized methods and procedures are used for efficient and prompt handling of all changes to control IT infrastructure, to minimize the number and impact of any related incidents upon service. Changes in the IT infrastructure arise reactively in response to problems or externally imposed requirements, e.g., legislative changes, or proactively from seeking improved efficiency and effectiveness or to enable or reflect business initiatives, or from programs, projects, or service improvement initiatives. Change management ensures standardized methods, processes and procedures which are used for all changes, facilitate efficient and prompt handling of all changes, and maintain the proper balance between the need for change and the potential detrimental impact of changes.

A root cause analysis engine is an algorithm developed to provide an automated version of root cause analysis, the method of problem solving that tries to identify the root causes of faults or problems. The algorithm is configured to be used for inaccurate or inconsistent data, incomplete data, large amounts of data, small datasets, and complex problems such as multi-modal failures or with more than one solution.

In data analysis, anomaly detection (further known as outlier detection) is the identification of rare items, events or observations which raise suspicions by differing significantly from most of the data. Typically, the anomalous items translate to a problem. Anomalies are further referred to as outliers, novelties, noise, deviations, and exceptions. In the context of abuse and network intrusion detection, the interesting objects are often not rare objects, but unexpected bursts in activity. This pattern does not adhere to the common statistical definition of an outlier as a rare object, and many outlier detection methods (unsupervised methods) fail on such data, unless it has been aggregated appropriately.

AI model performance engines monitor AI models for changes such as model degradation, data drift, and concept drift, to ensure the AI model is maintaining an acceptable level of performance.

A performance analysis engine identifies whether service performance targets are being achieved, and where relevant, to provide verifiable evidence. Alerts when service performance is degrading, especially when service performance falls below targets; provides information that helps analyze situations, identify locations, scales, and variances of performance problems, and supports information for proposed remedial action; and tracks the impacts of interventions and remedial measures.

Security analytics engines use both real-time and historical data to detect and diagnose threats. Sources of information include real-time alerts from workstations, servers, sensors, mobile devices, and other endpoints; real-time feeds from other IT security applications (firewalls, intrusion prevention, endpoint detection and response, and other suitable security applications); network traffic volume and types; server logs; and third-party threat intelligence feeds. Security analytics combines data from the various sources and looks for correlations and anomalies within the data.

On the fly policy load/change services periodically download policy and data from servers. The policies and data are loaded on the fly without requiring a restart. Once the policies and data have been loaded, they are enforced immediately. On the fly policy load/change services ensure up-to-date policies and data.

Event processing is a method of tracking and analyzing (e.g., processing) streams of information (e.g., data) about things that happen (events), and deriving a conclusion from them. Complex event processing, or CEP, consists of a set of concepts and techniques for processing real-time events and extracting information from event streams as they arrive. The goal of CEP is to identify meaningful events (such as opportunities or threats) in real-time situations and respond to them as quickly as possible.

A data filter is a computer program or subroutine to process a data stream that produces another data stream. While a single filter is used individually, data filters are frequently strung together to form a pipeline. A data filter, as the name suggests, is used to filter data for desired data elements.

In programming and software design, an event is a change of state (e.g., an action or occurrence) recognized by software, often originating asynchronously from the external environment that is handled by the software. Computer event messages are generated or triggered by a system, by a user, or in other ways based upon the event. Event messages are handled synchronously with the program flow; that is, the software is configured to have one or more dedicated places (e.g., a data sink) where event messages are handled. A source of event messages includes the user, who interacts with the software through the computer's peripherals; for example, by typing on a keyboard. Another source is a hardware device such as a timer. Software is configured to further trigger the software's own set of event messages into the event channel (e.g., to communicate the completion of a task). Software that changes behavior in response to event messages is said to be event-driven, often with the goal of being interactive.

Real-time or real time describes operations in computing or other processes that guarantee response times within a specified time (deadline), usually a relatively short time. A real-time process is generally one that happens in defined time steps of maximum duration and fast enough to affect the environment in which the real-time process occurs, such as inputs to a computing system. In computer science, message queues and mailboxes are software-engineering components typically used for inter-process communication (IPC), or for inter-thread communication within the same process. Message queues use a queue for messaging, the passing of control or of content. In a computer network, downstream refers to data sent from a provider to a consumer. One process sending data primarily in the downstream direction is downloading. In some embodiments, downstream refers to the direction from a shared queue to an event consumer.

FIG.1is a block diagram of a correlation and policy engine (CPE)100, in accordance with some embodiments.

CPE100generally includes an event sources input block102, policy manager block104, and an action consumer block106.

Event sources input block102includes event emitters (agents, data sources, and other suitable event emitters within embodiments of the present disclosure). Event emitters detect, gather, and transfer event messages. An event emitter does not know the consumers of the event messages, the event emitter does not even know whether an event consumer exists, and in the event the consumer exists, the event emitter does not know how the event message is used or further processed.

Event sources102include events from a cloud network108. Cloud network computing is on-demand availability of computer system resources, especially data storage (e.g., cloud storage) and computing power, without direct active management by the user. Large clouds often have functions distributed over multiple locations, each location being a data center. Event sources from cloud network108are events occurring in the cloud network. In a non-limiting example, one or more incidents occurring within a data center (a building, a dedicated space within a building, or a group of buildings used to house computer systems and associated components, such as telecommunications and storage systems) of cloud network108.

Event sources102include events from a 5G core network (CN)110. A backbone or CN110is a part of a computer network which interconnects networks, providing a path for the exchange of information between different local area networks (LANs) or subnetworks. A CN ties together diverse networks in the same building, in different buildings in a campus environment, or over wide areas. A large corporation that has many locations has a CN that ties the locations together, for example, in response to a server cluster needing to be accessed by different departments of a company that are located at different geographical locations. The pieces of the network connections (for example: ethernet, wireless) that bring these departments together is often referred to as the CN. One example of a CN is the Internet backbone. Event sources from 5G CN110are events occurring in the 5G CN. In a non-limiting example, one or more incidents occurring within a server cluster (a set of servers that work together and viewed as a single system where each node is set to perform the same task, controlled, and scheduled by software) of 5G CN110.

Event sources102include events from a 5G radio access network (RAN) network112. A RAN is part of a mobile telecommunication system. RAN implements a radio access technology. RANs reside between a device such as a mobile phone, a computer, or remotely controlled machines and provides connection with a CN, such as CN110. Depending on the standard, mobile phones and other wireless connected devices are varyingly known as user equipment (UE), terminal equipment, mobile station (MS), or other suitable equipment within embodiments of the present disclosure. Examples of radio access network types include global system for mobile communications (GSM) radio access network, GSM RAN (GRAN), GERAN (essentially the same as GRAN but specifying the inclusion of EDGE packet radio services), universal mobile telecommunications system (UMTS) RAN, UMTS terrestrial RAN (UTRAN), and E-UTRAN (e.g., long term evolution (LTE) high speed and low latency radio access network). Event sources from 5G RAN112are events occurring in the 5G RAN. In a non-limiting example, one or more incidents occurring within terminal equipment and or mobile stations of 5G RAN112.

Event sources102include events from 5G transport networks114. 5G transport networks114include fronthaul and backhaul portions.

The backhaul portion of a network includes the intermediate links between the CN, such as CN110and small subnetworks at the edge of a network. The most common network type in which backhaul is implemented is a mobile network. A backhaul of a mobile network, also referred to as mobile-backhaul that connects a cell site to the CN. Two methods of mobile backhaul implementations are fiber-based backhaul and wireless point-to-point backhaul. In both the technical and commercial definitions, backhaul generally refers to the side of the network that communicates with the global Internet. Sometimes middle mile networks exist between the customer's own LAN and those exchanges. In some embodiments, this is a local wide area network (WAN) connection.

A fronthaul network is coincident with the backhaul network, but subtly different. In a cloud RAN (C-RAN) the backhaul data is decoded from the fronthaul network at centralized controllers, from where the backhaul data is then transferred to the CN. The fronthaul portion of a C-RAN includes the intermediate links between the centralized radio controllers and the radio heads (or masts) at the edge of a cellular network. Event sources from 5G transport networks114are events occurring in the 5G transport networks114. In a non-limiting example, one or more incidents occurring within radio controllers or network switches of 5G transport networks114.

Policy Manager104is a real-time CEP engine at scale, which automates various workflows and network healing operations. CPE100processes events based on policies. Based upon pre-defined policies and rules policy manager104filters the events, enriches the events, correlates, and processes the events for action.

Policy manager104includes cleaner116that accepts the events from event sources block102, removes unwanted events, and passes the filtered events to enricher118for further processing. In some embodiments, these filtered events are forwarded by using a message-policy cache built by a message-policy sync process. In computing messages are passed between programs or between components of a single program. Message passing is a form of communication used in concurrent and parallel computing, object-oriented programming, and channel communication, where communication is made by sending messages to recipients. A message is sent to an object specifying a request for action.

Policy manager104includes enricher118which enriches the messages arriving from cleaner116with inventory information to successfully execute a policy. In some embodiments, enricher118is configured with a message-enrichment cache built by an enricher sync process. In a non-limiting example, received event data is missing fields or parameters. Events are then enriched with the help of an inventory to fill the missing fields and parameters so decisions are made, and predetermined actions occur.

Policy manager104includes evaluator120that evaluates and processes the enriched events arriving from enricher118. Evaluator120is configured to identify root causes (e.g., what is causing or initiating the received events), decide relevant actions pursuant to predetermined policies, and inform action manager120accordingly.

Policy manager104includes trigger122that matches a policy with an event based the output of evaluator120identifying the root causes of the received events. Trigger122then forwards the matched policy/event to action consumer106to begin an action workflow.

Action consumer106includes ticket alert124. Ticket alert124creates an incident creation or a trigger to begin a workflow action.

Action consumer106includes trigger workflow126. In some embodiments, trigger workflow126performs actions based on a user-created policy. In some embodiments, trigger workflow126initiates the sending of a notification. In some embodiments, trigger workflow126initiates a reboot, restart, scale in, scale out, or other suitable actions within embodiments of the present disclosure.

Action consumer106includes a notification action128. In some embodiments, notification action128is an email, text message or graphical user interface (GUI) display on a user interface, such as user interface3518(FIG.35) notifying the policy creator and/or network operator an event was received, diagnosed, an action taken, and the result of the action taken (e.g., the action taken was successful or failed).

FIG.2is a diagrammatic representation a correlation and policy engine (CPE)200, in accordance with some embodiments.

In some embodiments, CPE100is like CPE200. In some embodiments, event sources102is like data ingestion block202, policy manager104is like policy manager204, and action consumer106is like action manager230.

Policy Manager204is a real-time CEP engine at scale, which automates various workflows and network healing operations (e.g., repair and/or restoration). Policy manager204processes events based on predetermined policies and/or rules. Policy manager204filters the events, enriches the events, correlates, and processes the events for action. Policy manager204provides a framework to support CEP capabilities. In some embodiments, in memory computation logic mitigates latency issues. In some embodiments, multi-source events ingestion covers broader use cases in complex networks and infrastructure. In some embodiments, policy manager204is configured with scalable architecture based upon a business requirement (e.g., a new business policy being implemented). In some embodiments, policy manager204supports multiple computation logic in near-real time processing, such as event followed by, event AND, event OR, count of event occurrences, and mathematical operations on event counters. In a non-limiting example, the computation logic supports performing an action managed by action manager230in response to XYZ event, followed by ABC event, AND (UVW event OR DEF event) along with ten event GHI occurrences. In some embodiments, policy queries are applied on a potentially infinite stream of data. In some embodiments, events are processed immediately. In some embodiments, once policy manager204processes all events for a matching sequence, results are driven directly. In some embodiments, this aspect effectively leads to policy manager204having a near real-time capability.

Users and/or network operators create policy templates using UI208. In some embodiments, UI208is configured with GUIs that are configured to allow a user to view policy creation templates where the user enters information to create a policy. In some embodiments, UI208is like UI3518. In some embodiments, an orchestrator (orchestration is the automated configuration, coordination, and management of computer systems and software) provides general policies, artificial intelligence (AI) generated policies or policies from any external service. The generated policies are sent to policy manager210and policy manager210relays the created policies to database212.

The created policy templates are saved in database212as a draft. The policy templates are configured to be validated, activated, de-activated, edited, and deleted. Thus, templates are stored in database212until needed and then activated upon command by a user.

Data bus214receives data from various sources from data ingestion block202, such as cloud platform216, network applications218, container applications220, other events through the Internet, events through a public cloud222, and events through a fault and performance system224.

In response to received event data at data bus214missing fields and/or parameters, these events with missing fields and/or parameters are enriched at policy correlation and evaluation (PCE) module226through inventory228that provides the missing fields and/or parameters, to make decisions and take predetermined actions. In some embodiments, this is referred to as inventory enrichment.

PCE module226logically evaluates and processes the events from data bus214based on policies from policy manager210. PCE 226 is configured to identify root causes of events, determine relevant actions pursuant to the predetermined policies, and inform action manager230accordingly of any relevant actions pursuant to the predetermined policies.

Action manager230accepts the results after event processing by PCE 226 and takes the corresponding action related to that result. In a non-limiting example, action manager320sends an email, sends a request to an API endpoint232, or other suitable action within embodiments of the present disclosure. Action Manager230obtains the status of the executed action and updates the database212so that users visualize a job status in UI208.

FIG.3is a pictorial diagram representation a correlation and policy engine (CPE)300, in accordance with some embodiments.

FIG.4is a pictorial diagram representation of a method for implementing a correlation and policy engine (CPE)400, in accordance with some embodiments.

FIGS.3and4are discussed together to provide an understanding of the operation of CPE300through method for implementing a correlation and policy engine (CPE)400. In some embodiments, method for implementing a CPE400is a functional overview of a CPE, such as CPEs300,200, or100. Method400is executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method400are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method400includes operations402-428, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method400are repeated. In some embodiments, unless specifically stated otherwise, the operations of method400are performed in order.

In some embodiments, CPE300analyzes, computes, enriches, and evaluates the collected events. In some embodiments, a user creates policy templates through a user interface (UI), such as UI208or UI3518. The created policy filters the collected events, enriches the events (e.g., adds any related event data), correlates the enriched event and then processes the enriched event for action. In some embodiments, created policy templates are saved in a database as a draft where a user validates, activate, de-activate, edit, delete, and other suitable modifications to policy templates within embodiments of the present disclosure. In some embodiments, collected event data is missing parameters and these events are enriched with event data within an inventory so that processing is performed, and actions taken.

A user interface (UI), such as UI208or UI3518, is the space where interactions between humans and machines occur. The goal of this interaction is to allow effective operation and control of the machine from the human end, while the machine simultaneously feeds back information that aids the operators' decision-making process. Non-limiting examples of UIs include the interactive aspects of computer operating systems, hand tools, heavy machinery operator controls, and process controls. UIs are composed of one or more layers, including a human-machine interface (HMI) that interfaces machines with physical input hardware such as keyboards, mice, or game pads, and output hardware such as computer monitors, speakers, and printers. A device that implements an HMI is called a human interface device (HID). Other terms for human-machine interfaces are man-machine interface (MMI) and, when the machine in question is a computer, human-computer interface. Additional UI layers may interact with one or more human senses, including: tactile UI (touch), visual UI (sight), auditory UI (sound), olfactory UI (smell), equilibria UI (balance), and gustatory UI (taste).

A database is a structured collection of data. Databases are anything from a simple shopping list to a picture gallery or a place to hold vast amounts of information in a corporate network. A relational database is a digital store collecting data and organizing the collected data according to a relational model. In this model, tables consist of rows and columns, and relationships between data elements all following a logical structure. A relational database management system (RDBMS) is the set of software tools used to implement, manage, and query such a database.

A cache is a hardware or software component that stores data so that future requests for that data are served faster. The data stored in a cache might be the result of an earlier computation or a copy of data stored elsewhere. A cache hit occurs when the requested data is found in a cache, while a cache miss occurs when it unable to be found. Cache hits are served by reading data from the cache, which is faster than recomputing a result or reading from a slower data store; thus, the more requests that are served from the cache, the faster the system performs.

An action is triggered based upon a matched policy. In some embodiments, a CPE core, such as processing circuitry3502ofFIG.35, logically evaluates and processes the collected events. In some embodiments, the CPE core identifies root causes, decides relevant actions pursuant to predetermined policies (discussed above) and instruct an action manager according to the predetermined policies. In some embodiments, the action manager collects the results of event processing and takes a respective action related to the collected result. In a non-limiting example, the action manage sends an email, sends a request to an application programming interface (API) endpoint, and other suitable actions within embodiments of the present disclosure. In some embodiments, the action manager obtains job status feedback to determine the status of the executed job and update a back-end application at the database, so that users determine a status of the job through a UI.

An API is a connection between computers or between computer programs. An API is a type of software interface, offering a service to other pieces of software. An API specification is a document or standard that describes how to build or use such a connection or interface. A computer system that meets this standard is said to implement or expose an API. The term API refers either to the specification or to the implementation. In contrast to a UI, which connects a computer to a person, an application programming interface connects computers or pieces of software to each other. An API is not intended to be used directly by a person (e.g., the end user) other than a computer programmer who is incorporating the API into the software. An API is often made up of different parts which act as tools or services that are available to the programmer. A program or a programmer that uses one of these parts is said to call that portion of the API. The calls that make up the API are also known as subroutines, methods, requests, or endpoints.

Auto healing operation is triggered through CPE300. In some embodiments, zero-touch network healing is implemented. In a non-limiting example, a user creates a policy through a UI for network healing (e.g., automatic fault resolution). Continuing with the non-limiting example, in response to a fault event being detected and filtered by CPE300, the filtered fault activates the user created policy. Continuing with the non-limiting example, CPE300sends enrichment request to an inventory for topology information of the affected network function. Continuing with the non-limiting example, CPE300sends requests to an orchestrator (orchestration is the automated configuration, coordination, and management of computer systems and software) for a network function restart and CPE300updates the job status in a CPE UI, such as UI208or UI3518. Continuing with the non-limiting example, based upon the status of the network function restart, a request is made of CPE300to take follow up action. For example, in response to the network function restart failing, then CPE300sends a request to the orchestrator for a network re-instantiate (e.g., to create again as an instance of a class). Continuing with the non-limiting example, the network re-instantiate request is sent to a cloud adapter that relays the status of the network re-instantiate and the CPE updates the job status in the CPE UI.

Thus, the automatic network healing proceeds from fault detection to fault repair, to repair verification, to status update all based upon a user predetermined policy.

Zero-touch provisioning (ZTP) is a method of setting up devices that automatically configures the device using a switch feature. ZTP helps IT teams quickly deploy network devices in a large-scale environment, eliminating most of the manual labor involved with adding them to a network. ZTP is found in devices and tools such as network switches, routers, wireless access points and firewalls. The goal is to enable IT personnel and network operators to install networking devices without manual intervention. Manual configuration takes time and is prone to human error especially with large amounts of devices being configured. ZTP is faster, reduces the chance of error and ensures configuration consistency. Zero-touch provisioning is also used to automate the system updating process. Using scripts, ZTP connects configuration management platforms and other tools for configuration or updates.

Network topology is the arrangement of elements (e.g., links, nodes, and other suitable elements within embodiments of the present disclosure) of a communication network. Network topology is used to define or describe the arrangement of various types of telecommunication networks, including command and control radio networks, industrial fieldbuses, and computer networks. Network topology is the topological structure of a network and is depicted physically or logically. Topology is an application of graph theory wherein communicating devices are modeled as nodes and the connections between the devices are modeled as links or lines between the nodes. Physical topology is the placement of the various components of a network (e.g., device location and cable installation), while logical topology illustrates how data flows within a network.

In operation402of method400, CPE300collects near real time performance and event data inputs. In some embodiments, event data inputs are cloud platform events, network application counters, container counters, internet events, public cloud events, fault and performance events or other suitable events within embodiments of the present disclosure. Database312accepts events from one or more sources and publishes the events using CPE input messages so that CPE cleaner334subscribes to the events and filters the corresponding events. Process flows from operation402to operation404.

In operation404of method400, CPE cleaner334filters unwanted events and passes the filtered events for further processing by message-policy cache336built by message-policy sync338. In some embodiments, message-policy cache336is a remote dictionary server such as an in-memory data structure store, used as a distributed, in-memory key-value database, cache, and message broker, with optional durability. Message-policy cache336supports various types of abstract data structures, such as strings, lists, maps, sets, sorted sets, hyper-logs, bitmaps, streams, and spatial indices. Process flows from operation404to operation406.

In operation406of method400, message-policy sync338reads from policy database340the active policies in CPE300and creates an active policy cache in massage-policy cache336such that the policies with the same triggering event type are grouped together. Process flows from operation406to operation408.

In operation408of method400, message-policy cache336retains a cache of the policy information provided by message-policy sync338. Thus, message-policy cache336retains real-time current policy information. Process flows from operation408to operation410.

In operation410of method400, CPE cleaner334publishes CPE cleaned messages (cleaned or filtered events) to CPE enricher342. Process flows from operation410to operation412.

In operation412of method400, CPE enricher342enriches the cleaned message from CPE cleaner334with inventory information (e.g., filling in any missing parameters) to successfully execute a policy, by using message-enrichment cache344built by enricher sync346. Process flows from operation412to operation414.

In operation414of method400, an enricher sync occurs where enricher sync346obtains inventory information from a policy-message enrichment database table (a database table in inventory348which has information about what inventory information is to be enriched for each message type) and save the information to message-enrichment cache344. Thus, CPE enricher342quickly identifies whether an event needs enriching (i.e., adding missing data to the event). Process flows from operation414to operation416.

In operation416of method400, message-enrichment cache344retains a cache of the information provided by enricher sync346. Process flows from operation416to operation418.

In operation418of method400, message-enrichment cache344enriches information (e.g., using the information from inventory348) for each cleaned message from CPE cleaner334. Process flows from operation418to operation420.

In operation420of method400, the enriched CPE enriched messages are sent to CPE evaluator350. Process flows from operation420to operation422.

In operation422of method400, CPE evaluator350performs CEP and determines whether an action is to be triggered based upon the enriched message or not. Process flows from operation422to operation424.

In operation424of method400, there is a CPE evaluator350created for each active policy template by policy CPE sync352. Policy CPE sync352is the entity which creates and/or launches the one or more CPE Evaluator applications350for each active policy. Process flows from operation424to operation426.

In operation426of method400, triggered CPE actions are published by CPE Evaluators350. CPE action manager354is subscribed to the published CPE actions. Process flows from operation426to operation428.

In operation428of method400, CPE action manger354initiates the API trigger to trigger an action which based upon the CPE evaluator application350(e.g., based on the active policy template).

FIG.5is a diagrammatic representation of a virtualized radio access network (vRAN) system500, in accordance with some embodiments.

VRAN system500includes a CN502communicatively connected to RAN504, through backhaul506, which is communicatively connected to base stations508A and508B (hereinafter base station508), with antennas510that are wirelessly connected to UEs512located in geographic coverage cells514A and514B (hereinafter geographic coverage cells514). CN502includes one or more service provider(s)516, KPI servers518, and vRAN module520.

In some embodiments, CN502is like 5G core network112ofFIG.1. CN502(also known as a backbone) is a part of a computer network which interconnects networks, providing a path for the exchange of information between different Local Area Networks (LANs) or subnetworks. In some embodiments, CN502ties together diverse networks over wide geographic areas, in different buildings in a campus environment, or in the same building.

In some embodiments, RAN504is like 5G RAN network114ofFIG.1. RAN504is a GSM RAN, a GSM/EDGE RAN, a UMTS RAN (UTRAN), an E-UTRAN, Open RAN (O-RAN), virtual RAN (v-Ran), or a Cloud-RAN (C-RAN). RAN504resides between user equipment512(e.g., mobile phone, a computer, or any remotely controlled machine) and CN502. RAN504is shown as a C-RAN for purposes of simplified representation and discussion

In some embodiments, backhaul506is like 5G transport network114inFIG.1. In a hierarchical telecommunications network, backhaul506of VRAN system500comprises the intermediate link(s) between CN502and RAN504. The two main methods of mobile backhaul implementations are fiber-based backhaul and wireless point-to-point backhaul. Other methods, such as copper-based wireline, satellite communications and point-to-multipoint wireless technologies are being phased out as capacity and latency requirements become higher in 4G and 5G networks. Backhaul generally refers to the side of the network that communicates with the global internet. The connection between base station508and UE512begins with backhaul506connected to CN502. In some embodiments, backhaul506includes wired, fiber optic and wireless components. Wireless sections include using microwave bands, mesh, and edge network topologies that use a high-capacity wireless channels to get packets to the microwave or fiber links.

In some embodiments, base stations508are lattice or self-supported towers, guyed towers, monopole towers, and concealed towers (e.g., towers designed to resemble trees, cacti, water towers, signs, light standards, and other types of structures). Base stations are known by other names such as base transceiver station, mobile phone mast, or cell tower. In some embodiments, base stations are replaced with edge devices configured to wirelessly communicate with UEs. The edge device provides an entry point into service provider CNs, such as CN502. Examples include routers, routing switches, Integrated Access Devices (IADs), multiplexers, and a variety of Metropolitan Area Network (MAN) and Wide Area Network (WAN) access devices.

In at least one embodiment, antenna(s)510are a sector antenna. In some embodiments, antenna110operates at microwave or Ultra-High Frequency (UHF) frequencies (300 MHz to 3 GHz). In other examples, antenna(s)110are chosen for their size and directional properties. In some embodiments, the antenna(s)110are MIMO (Multiple-Input, Multiple-Output) antenna that send and receive greater than one data signal simultaneously over the same radio channel by exploiting multipath propagation.

In some embodiments, UEs512are a computer or computing system. Additionally or alternatively, UEs512have a Liquid Crystal Display (LCD), Light-Emitting Diode (LED) or Organic Light-Emitting Diode (OLED) screen interface providing a touchscreen interface with digital buttons and keyboard or physical buttons along with a physical keyboard. In some embodiments, UE512connects to the Internet and interconnect with other devices. Additionally or alternatively, UE512incorporates integrated cameras, the ability to place and receive voice and video telephone calls, video games, and Global Positioning System (GPS) capabilities. Additionally or alternatively, UEs run Operating Systems (OS) that allow third-party apps specialized for capabilities to be installed and run. In some embodiments, UEs512are a computer (such as a tablet computer, netbook, digital media player, digital assistant, graphing calculator, handheld game console, handheld Personal Computer (PC), laptop, Mobile Internet Device (MID), Personal Digital Assistant (PDA), pocket calculator, portable medial player, or ultra-mobile PC), a mobile phone (such as a camera phone, feature phone, smartphone, or phablet), a digital camera (such as a digital camcorder, or Digital Still Camera (DSC), Digital Video Camera (DVC), or front-facing camera), a pager, a Personal Navigation Device (PND), a wearable computer (such as a calculator watch, smartwatch, head-mounted display, earphones, or biometric device), or a smart card.

In at least one embodiment, geographic coverage cells514are of any shape and size. In some embodiments, geographic coverage cells514are a macro-cell (covering 1 Km-30 Km), a micro-cell (covering 200 m-2 Km), or a pico-cell (covering 4 m-200 m).

Service provider(s)516are businesses, vendors, or organizations that sell bandwidth or network access by providing direct Internet backbone access to Internet service providers and usually access to its Network Access Points (NAPs). Service providers are sometimes referred to as backbone providers, Internet providers, or vendors. Service providers consist of telecommunications companies, data carriers, wireless communications providers, Internet service providers, and cable television operators offering high-speed Internet access.

KPI servers118produce both predictions and live network data. Live-network data (KPIs, UE/cell/MDT (Minimization of Drive Test) traces, and crowdsourced data) allows for modelling of network traffic, hot-spot identification, and radio signal propagation.

vRAN504is a type of RAN with its networking functions separated from the hardware running the networking functions. vRAN module520provides the control and data planes of vRAN504that are also separated as part of the virtualization. vRAN module520provides network function virtualization (NFV) which is the practice of turning hardware-based functions into software. In an NFV architecture, the hardware is typically commercial off-the-shelf (COTS) standard hardware. vRAN module520adapts to changes in RAN504quicker. vRAN module520allows change without having to replace hardware throughout the entire infrastructure. vRAN module520instead updates software. Upgrading the RAN software improves the network's connectivity, efficiency, or security among other functions.

FIG.6is a data flow diagram representation of a method for vRAN software healing600, in accordance with some embodiments.

In some embodiments, method600is executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method600are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method600includes operations602-630, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method600are repeated. In some embodiments, unless specifically stated otherwise, the operations of method600are performed in order.

In operation602of method600, a policy is created in a CPE system, such as CPEs300,200, or100, for vRAN healing. Process flows from operation602to operation604.

In operation604of method600, aggregation nodes (not shown) and container pods601are being monitored by liveness probes which are used to know when to restart a container. Aggregate nodes are configured to replace a sequence of input records with summary, aggregated output records. Pods, such as pod601, are collections of one or more containers that look like real computers from the point of view of the programs running them (e.g., virtual machines). Process flows from operation604to operation606.

In operation606of method600, pod node603detects a failure of a pod container, such as pod601. Pod node603attempts to restart the failed pod until all attempts are exhausted, including attempting to restart the pod from a different pod node. In response to one or more pods having trouble restarting, a fault event is created (e.g., EVENT_POD_FAULTED) and is sent to observability framework605(OBF) that collects fault events and increments performance counters. Process flows from operation606to operation608.

In operation608of method600, OBF605receives the event and sends the event to data bus607. Process flows from operation608to operation610.

In operation610of method600, data bus607sends the fault to CPE609. In some embodiments, CPE609is like CPEs300,200, or100. Process flows from operation610to operation612.

In operation612of method600, CPE609filters the fault events and activates policy. CPE609filters events based upon existing policy and applies policy condition and rules. Process flows from operation614to operation616.

In operation614of method600, CPE609sends an enrichment request to inventory611to obtain topology information of the affected network function (NF) and cluster for POD601. Process flows from operation614to operation616.

In operation616of method600, CPE609sends a request to a lifecycle management system613(LCM) which is an orchestrator (aligns business requests with the applications, data, and infrastructure) for a NF restart. Process flows from operation616to operation618.

In operation618of method600, LCM613sends the NF restart request to cloud adapter615(a software utility that controls the transfer of information between local back-office systems and a cloud provider). Process flows from operation618to operation620.

In operation620of method600, cloud adapter615and LCM613sends the status of the NF restart request to CPE609. Process flows from operation620to operation622.

In operation622of method600, CPE609updates the job status in CPE UI, such as UI208, and based upon the status of the NF restart request, CPE609takes follow up action. Process flows from operation622to operation624.

In operation624of method600, in response to the NF restart failing, then CPE609sends a request to LCM613for NF to re-instantiate. Process flows from operation624to operation626.

In operation626of method600, LCM613sends the NF re-instantiate request to cloud adapter615. Process flows from operation from operation626to operation628.

In operation628of method600, Cloud Adapter615and LCM613send the status of the NF re-instantiate to Cpe609. Process flows from operation628to operation630where CPE609updates the job status in CPE UI.

FIG.7is a data flow diagram representation of a method for vRAN software healing700, in accordance with some embodiments.

In some embodiments, method700is executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method700are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method700includes operations702-718, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method700are repeated. In some embodiments, unless specifically stated otherwise, the operations of method700are performed in order.

In operation702of method700, policy is created in CPE system609. In a non-limiting example, a user creates a polity where in response to segment routing IPv6 (SRV6) path1throughput being greater than 3 Gbps, trigger an action for new user plan function (UPF) instance creation. Segment Routing IPv6 (SRv6) is a next-generation IP bearer protocol that combines Segment Routing (SR) and IPv6. Utilizing existing IPv6 forwarding technology, SRv6 implements network programming through flexible IPv6 extension headers. The 5G User Plane Function (UPF) is the function that does the work to connect the data over the RAN to the Internet to route packets quickly and accurately to the correct destination. Thus, in response to throughput being greater than 3 Gbps, a new UPF is created to reduce the throughput burden. Process flows from operation702to operation704.

In operation704of method700, the transport network traffic of aggregation nodes three717and four719are monitored every thirty seconds at OBF605for SRV6 Path1throughput. Process flows from operation704to operation706.

In operation706of method700, performance metric (PM) events for SRV6 Path1throughput are sent to data bus607through OBF605. Process flows from operation706to operation708.

In operation708of method700, CPE609receives the events through data bus607. Process flows from operation708to operation710.

In operation710of method700, CPE609filters the PM events and activates the policy of operation702once SRV6 Path1throughput is greater than 3 Gbps. Process flows from operation710to operation712.

In operation712of method700, CPE609sends an enrichment request to inventory611to obtain the topology information of an affected slice identification (e.g., the network slice information). Process flows from operation712to operation714.

In operation714of method700, based upon the enrichment information from inventory611, CPE609raises an action trigger to LCM613for creating a new network service instance. Process flows from operation714to operation716.

In operation716of method700, CPE609obtains a response from LCM613for triggered action status. Process flows from operation716to operation718where CPE609updates the job status in CPE UI.

FIG.8is a data flow diagram representation of a method for vRAN software healing800, in accordance with some embodiments.

In some embodiments, method800is executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method800are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method800includes operations802-820, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method800are repeated. In some embodiments, unless specifically stated otherwise, the operations of method800are performed in order.

In operation802of method800, policy is created in CPE system609. In a non-limiting example, a policy is created in CPE609for non-AI assisted root cause analysis (RCA) use case. In a non-limiting example, the policy created monitors the downlink and uplink throughput rate for node3and the downlink and uplink throughput rate for node6. Continuing with the non-limiting example the policy is set so that in response to either throughput (e.g., dl or ul) for either node3or node6is greater than 3 Gbps or the success rate of initial registration is less than 50%, then RCA is the control and user plane are overloaded. Process flows from operation802to operation804.

RCA is a method of problem solving used for identifying the root causes of faults or problems. RCA is used in IT operations and telecommunications. RCA is decomposed into four steps: (1) identify and describe the problem clearly; (2) establish a timeline from the normal situation up to the time the problem occurred; (3) distinguish between the root cause and other causal factors (e.g., using event correlation); and (4) establish a causal graph between the root cause and the problem. RCA generally serves as input to a remediation process whereby corrective actions are taken to prevent the problem from reoccurring. The name of this process varies from one application domain to another. According to ISO/IEC 31010, RCA includes one or more of the following techniques: (1) five whys; (2) failure mode and effects analysis (FMEA); (3) fault tree analysis; (4) Ishikawa diagram; and (5) Pareto analysis.

In operation804of method800, events are received at OBF605from access & mobility management function (AMF)801and 5G user plane function (UPF)803. AMF is a control plane function in 5G core network, like CN502. The main functions and responsibilities of AMF are registration management, reachability management, and connection management. UPF is the function that does the work to connect the data coming over the RAN to the Internet quickly and accurately routing packets to the correct destination on the internet. Process flows from operation804to operation806.

In operation806of method800, OBF605publishes a fault at data bus607. Process flows from operation806to operation808.

In operation808of method800, CPE609receives the events from data bus607. Process flows from operation808to operation810.

In operation810of method800, CPE609filters the events for based upon available policy. Process flows from operation810to operation812

In operation812of method800, CPE609sends an enrichment request to inventory611to obtain topology information (e.g., slice ID) of AMF801and UPF803. Process flows from operation812to operation814.

In operation814of method800, CPE609evaluates the RCA logic according to policy. Process flows from operation814to operation816.

In operation816of method800, CPE609creates an incident ticket and sends the incident ticket to an incident manager system805. Process flows from operation816to operation818.

In operation818of method800, CPE609receives a status update for an incident creation job. Process flows from operation818to operation820where the job status is updated at CPE UI.

FIG.9is a data flow diagram representation of a method for vRAN software healing900, in accordance with some embodiments.

In some embodiments, method900is executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method900are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method900includes operations902-926, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method900are repeated. In some embodiments, unless specifically stated otherwise, the operations of method900are performed in order.

In operation902of method900, policies are created in CPE system609. In a non-limiting example, policies P1 and P2 are created. Continuing with the non-limiting example, P1 policy trigger is based upon OBF events and P2 policy trigger is based upon an RCA response from artificial intelligence/machine learning module (AI/ML)901. AI/ML module901is configured to use computer algorithms that improve automatically through experience and using data. In a non-limiting example, policy1created monitors the downlink and uplink throughput rate for node3and the downlink and uplink throughput rate for node6. Continuing with the non-limiting example the policy is set so that in response to either throughput (e.g., dl or ul) for either node3or node6is greater than 3 Gbps or the success rate of initial registration is less than 50%, then policy2initiates RCA to obtain recommendations from AI/ML901. Process flows from operation902to operation904. Process flows from operation902to operation904.

In operation904of method900, events are received at OBF605from UPF803and session management function (SMF)903. The SMF is responsible for interacting with the decoupled data plane, creating, updating, and removing Protocol Data Unit (PDU) sessions and managing session context with UPF803. Process flows from operation904to operation906.

In operation906of method900, OBF605publishes the fault at data bus607. Process flows from operation906to operation908.

In operation908of method900, CPE609receives the events from respective data bus607. Process flows from operation908to operation910.

In operation910of method900, CPE609filters the events based upon available policy P1. Process flows from operation910to operation912.

In operation912of method900, CPE609sends and enrichment request to inventory for obtaining the topology information (e.g., slice ID) of the UPF803and SMF903. Process flows from operation912to operation914.

In operation914of method900, CPE609sends a get RCA recommendation action to AI/ML module901. Process flows from operation914to operation916.

In operation916of method900, AI/ML module901sends an RCA recommendation response through data bus607to CPE609. Process flows from operation916to operation918.

In operation918of method900, CPE609receives the RCA recommendation response message from data bus607and activates policy P2. Process flows from operation918to operation920.

In operation920of method900, CPE609implements policy P2 filtering logic. Process flows from operation920to operation922.

In operation922of method900, in response to an action in policy P2, CPE609creates an incident ticket to incident manager system805. Process flows from operation922to operation924.

In operation924of method900, CPE609receives the status update for incident creation job and at operation926the job status is updated at CPE UI.

FIG.10is a data flow diagram representation of a method for vRAN software healing1000, in accordance with some embodiments.

In some embodiments, method1000is executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method1000are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method1000includes operations1002-1018, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method1000are repeated. In some embodiments, unless specifically stated otherwise, the operations of method1000are performed in order.

In operation1002of method1000, policies are created in CPE system609. Process flows from operation1002to operation1004.

In operation1004of method1000, a POD related issue occurs in server cluster1001and the event is received by OBF605. Process flows from operation1004to operation1006.

In operation1006of method1000, OBF605publishes the generated event to data bus607. Process flows from operation1006to operation1008.

In operation1008of method100, data bus607publishes the received event to CPE609. Process flows from operation1008to operation1010.

In operation1010of method1000, CPE609filters and analyses events published by OBF605to data bus607. Process flows from operation1010to operation1012.

In operation1012of method1000, CPE609sends for enrichment of event information from inventory611. Process flows from operation1012to operation1014.

In operation1014of method1000, CPE609evaluates incoming events based on configured policies. Process flows from operation1014to operation1016.

In operation1016of method1000, CPE609invokes LCM613to remediate the fault and confirm with LCM613upon successful completion of remediation. Process flows from operation1016to operation1018where the job status is updated in CPE UI.

FIG.11is a data flow diagram representation of a method for vRAN software healing1100, in accordance with some embodiments.

In some embodiments, method1100is executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method1100are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method1100includes operations1102-1120, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method1100are repeated. In some embodiments, unless specifically stated otherwise, the operations of method1100are performed in order.

In operation1102of method1100, policies are created in CPE system609. Process flows from operation1002to operation1004.

In operation1104of method1100, faults occur in a cloud platform cluster1101and events are received by OBF605. Process flows from operation1104to operation1106.

In operation1106of method1100, OBF605processes the received events and publishes the generated events to data bus607. Process flows from operation1106to operation1108.

In operation1108of method1100, data bus607publishes the received events to CPE609. Process flows from operation1108to operation1110.

In operation1110of method1100, CPE609filters the events received from data bus607. Process flows from operation1110to operation1112.

In operation1112of method1100, CPE609performs enrichment of event information from inventory611. Process flows from operation1112to operation1114.

In operation1114of method1100, CPE609performs RCA pursuant to the policy (e.g., rule-based RCA). Process flows from operation1114to operation1116.

In operation1116of method1100, CPE609sends mail to email server1103providing details about the root cause and correlated events. Process flows from operation1116to operation1118where the job status is updated in CPE UI. Process flows from operation1118to operation1120.

In operation1120of method1100, CPE609provides the details about the root cause and correlated events to data bus607.

FIG.12is a flow diagram of a method for creating a root cause analysis (RCA) policy1200, in accordance with some embodiments.

FIGS.13,14,15,16,17,18, and19are graphical user interfaces (GUIs)1300,1400,1500,1600,1700,1800, and1900for a correlation and policy engine (CPE), in accordance with some embodiments.

FIGS.12-19are discussed together to provide an understanding of the operation of GUIs1300,1400,1500,1600,1700,1800, and1900and the method for creating a root cause analysis (RCA) policy1200. In some embodiments, method for creating a root cause analysis (RCA) policy1200is a functional overview of policy creation for a CPE through GUIs, such as GUIs1300,1400,1500,1600,1700,1800, and1900. In some embodiments, method1200is stored as instructions, such as instructions3506, and executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method1200are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method1200includes operations1202-1214, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method1200are repeated. In some embodiments, unless specifically stated otherwise, the operations of method1200are performed in order.

In operation1202of method1200, a user, through add-policy template GUI1300(FIG.13) inputs basic information in which to develop an RCA policy. In some embodiments, RCA policy is located on policy manager210and/or policy database340. GUI identifier1302identifies GUI1300as a policy-template creation page, for a policy to be used within CPEs100,200, or300and within methods800,900, or1100. In some embodiments, from add-policy template GUI1300, a user searches for an already existing RCA template through search box1304. In some embodiments, a user inputs a known policy or clicks on arrow1306which displays a pull-down box with several already existing templates from which the user chooses. Pull-down menus are the type commonly used in menu bars (e.g., usually near the top of a window or screen), which are often used for performing actions.

In some embodiments, in response to a user being unclear as to the full title of a policy template of interest, the user begins to type what is believed to be the title and search box1304autocompletes with suggestive policy templates for which the user is looking. Autocomplete, or word completion, is a feature in which an application predicts the rest of a word a user is typing. In smartphones this is called predictive text. In GUIs, users typically press the tab key to accept a suggestion or the down arrow key on a keyboard to accept one of several suggestions.

Status bar1308informs the user of progress through the policy template creation. As shown, and discussed with regards to operation1202, GUI1300is a basic information stage of a policy creation template. The user is informed of where the policy template creation process is by status circles1310. An open circle indicates the user has not reached the stage to the right of the open circle (e.g., select elements has an empty circle to the left indicating the user has not begun this process of policy template setup); a partially filled circle, such as the circle in front of basic information included in status bar1308, indicates the current progress in the RCA policy template creation (e.g., the user is currently working on the basic information portion of the policy template); and a checkmark within the circle indicates that stage of the policy creation process has been completed. In operation, after basic policy information is obtained, process flows to select elements, select elements, policy definition, action, and preview as discussed below.

In some embodiments, an asterisk located next to a heading of a user input field, such as user input fields1314,1316,1318,1320, and1322indicates an input included within the user input field allows the user to move onto the next stage of the policy creation process. In some embodiments, a user inputs a policy name in user input field1312. In a non-limiting example, the user has inputted MME auto scale up policy.

Mobility management entity (MME) is the control-node for an LTE access-network, such as networks112, and/or504. MME is responsible for idle mode UE paging and tagging procedures including retransmissions. MME is involved in the bearer activation/deactivation process and is also responsible for choosing the serving gateway for UE at the initial attach and at time of intra-LTE handover involving CN, such as CNs110and/or502, node relocation. MME is responsible for authenticating the user (by interacting with the home subscriber server). The non-access stratum (NAS) signaling (NAS is a set of protocols in the evolved packet system used to convey non-radio signaling between the UE and the MME for an LTE/E-UTRAN access) terminates at the MME and is also responsible for generation and allocation of temporary identities to UEs. MME checks the authorization of the UE to camp on the service provider's public land mobile network (PLMN is a combination of wireless communication services offered by a specific operator in a specific country) and enforces UE roaming restrictions. The MME is the termination point in the network for ciphering/integrity protection for NAS signaling and handles the security key management. The MME also provides the control plane function for mobility between LTE and 2G/3G access networks with the S3 interface (simple storage service is an application programming interface that provides the capability to store, retrieve, list, and delete objects) terminating at the MME.

Continuing with the non-limiting example, the user inputs a version in user input field1316, such as 1.0.0 that indicates this is the first version of the policy. In some embodiments, in response to a major change being made to an already existing RCA policy template, the version number changes with the leftmost integer (e.g., version 2.0.0). In some embodiments, in response to a minor change being made to an already existing RCA policy template, the version number changes with the middle integer (e.g., version 1.1.0). In some embodiments, in response to a typographical change being made to an already existing RCA policy template, the version number changes with the rightmost integer (e.g., version 1.0.1).

Within user input field1318, a user inputs a vendor, such as a service provider516of the network. Within user input field1320a user selects what type of policy is being created (e.g., RCA or standard policy). Within user input field1322, the user inputs a description of the policy being created, such as a purpose of the policy, the boundaries of the policy, and faults or events affecting the policy. In some embodiments, this description is used when other users are performing a search for an already existing policy template to implement or modify.

In some embodiments, a user navigates to a previous GUI with user input button1322. In some embodiments, RCA policy creation is canceled with user input button1324. In some embodiments, in response to user input fields1314,1316,1318, and1320including a valid input, the process moves to the next stage of RCA policy creation with user input button1326. Process flow from operation1202to operation1204.

In operation1204of method1200, a user selects elements for the RCA policy template. In some embodiments, in response to the user clicking on user input button1326of GUI1300, GUI1400(FIG.14) is displayed for a user to begin selecting elements for the RCA policy.

Select elements box1402displays user input fields1404,1406,1408,1410,1412,1414,1416,1418, and1420for a user to select elements. In some embodiments, a user selects a name for the elements group at user input field1404. In a non-limiting example, a user inputs “element group1” as the element name. In some embodiments, a user selects a criteria type in user input field1406by clicking on the down arrow and selecting from eligible criteria (e.g., manage object type based or domain based).

In a non-limiting example, the user has selected “manage object type”. In telecommunications, the term managed object includes: (1) an abstract representation (e.g., not only the actual device that is managed but also the device driver that communicates with the device) of network resources that are managed in a network. For example, a printer as a managed object is the GUI that shows information about the printer, such as the location, printer status, printing progress, paper choice, and printing margins. The database, where all managed objects are stored, is called a management information database. A managed object is dynamic and communicates with other network resources that are managed. A managed object represents a physical entity, a network service, or an abstraction of a resource that exists independently of its use in management. (2) In telecommunications management, a managed object includes a resource within the telecommunications environment that is capable of being managed using operation, administration, maintenance, and provisioning (OAMP) application protocols. Operations are the normal network operations. Administration are the support procedures performed on a network e.g., allocating of passwords. Maintenance is performed to keep the network operating smoothly and include configuring updates or aligning to new policy and regulations. Provisioning is providing users, who have been given access, access to data repositories applications and databases.

In some embodiments, in user input field1408, the user inputs an element type. Continuing with the non-limiting example, a macro element type has been chosen. A macro element, such as a macro cell or macro site is a cell in a mobile phone network that provides radio coverage served by a high-power cell site (e.g., tower, antenna, or mast). Macro cells provide coverage larger than microcell (e.g., macro-cell covering 1 Km-30 Km, a micro-cell covering 200 m-2 Km, or a pico-cell covering 4 m-200 m). The antennas for macro cells are mounted on ground-based masts, such as base stations508, rooftops, and other existing structures, at a height that provides a clear view over the surrounding buildings and terrain. The term macro cell is used to describe the widest range of cell sizes. Macro cells are found in rural areas or along highways. Over a smaller cell area, a microcell is used in a densely populated urban area. Picocells are used for areas smaller than microcells, such as a large office, a mall, or train station. Currently the smallest area of coverage that can be implemented with a femtocell is a home or small office.

In some embodiments, in user input field1410the user inputs the location of the network. Continuing with the non-limiting example, the network is in or at a building. In some embodiments, in user input field1412the user inputs the vendor for the network. In some embodiments, input field1412is automatically filled with the vendor information input in GUI1300. In some embodiments, in user input field1414the user inputs the domain of the network (e.g., a RAN, such as RANs112and/or504). A network domain is an administrative grouping of multiple private computer networks or local hosts within the same infrastructure. Domains are identified using a domain name; domains which are accessible from the public Internet are assigned a globally unique name within the domain name system (DNS).

In some embodiments, in user input field1416the user inputs a category (e.g., the open systems interconnection (OSI) layer). Continuing with the non-limiting example, the user has selected physical, such as the physical layer. The physical layer is responsible for the physical cable or wireless connection between network nodes. The physical layer defines the connector, the electrical cable or wireless technology connecting the devices, and is responsible for transmission of the raw data, which is simply a series of 0s and 1s, while taking care of bit rate control. Other categories include:

The data link layer, which establishes and terminates a connection between two physically connected nodes on a network. The data link layer breaks up packets into frames and sends them from source to destination. This layer is composed of two parts-Logical Link Control (LLC), which identifies network protocols, performs error checking, and synchronizes frames, and Media Access Control (MAC) which uses MAC addresses to connect devices and define permissions to transmit and receive data.

The network layer, which has two functions. One is breaking up segments into network packets and reassembling the packets on the receiving end. The other is routing packets by discovering the best path across a physical network. The network layer uses network addresses (typically Internet Protocol addresses) to route packets to a destination node.

The transport layer, which takes data transferred in the session layer and breaks it into “segments” on the transmitting end. The transport layer, such as transport network114, is responsible for reassembling the segments on the receiving end, turning the segments back into data that are used by the session layer. The transport layer carries out flow control, sending data at a rate that matches the connection speed of the receiving device, and error control, checking whether data was received incorrectly and if not, requesting the data again.

The session layer, which creates communication channels, called sessions, between devices. The session layer is responsible for opening sessions, ensuring they remain open and functional while data is being transferred, and closing them when communication ends. The session layer further sets checkpoints during a data transfer in response to the session being interrupted, devices resume data transfer from the last checkpoint.

The presentation layer, which prepares data for the application layer. The presentation layer defines how two devices encode, encrypt, and compress data so data is received correctly on the other end. The presentation layer takes any data transmitted by the application layer and prepares it for transmission over the session layer.

The application layer, which is used by end-user software such as web browsers and email clients. The application layer provides protocols that allow software to send and receive information and present meaningful data to users. A few examples of application layer protocols are the Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), Post Office Protocol (POP), Simple Mail Transfer Protocol (SMTP), and Domain Name System (DNS).

In some embodiments, in user input field1418the user inputs a network element (NE) filter value. Continuing with the non-limiting example, the user clicks on the down arrow and selects the desired network element, such as POD. A POD, such as POD601, is a module of components, such as network, compute, storage, and application, that work together to deliver networking services. Thus, as event messages are routed to a CPE, such as CPEs100,200, and300, the event messages are first filtered, for the example ofFIG.14, by whether the event messages are related to a POD.

In some embodiments, in user input field1420the NE filter is narrowed even further by inputting filter values the user desires to filter out. Continuing with the non-limiting example, a POD within building131is a POD the user is interested in for the RCA policy. Thus, during the filtering process described above with regards to CPEs100,200, and300, the policy, when implemented first filters according to user input field1418and then filters those results according to filter values in user input field1420.

In some embodiments, the user clicks on user input button1422and elements associated with the criteria inputted by the user are gathered and placed within available elements box1424. In some embodiments, the user moves available elements from available elements box1424to selected elements box1426using the right facing arrows. In some embodiments, the user is further able to move elements from the selected elements box by clicking on one or more selected elements and clicking on a left-facing arrow to move the selected elements back to the available elements box1424. In response to the user selecting the elements of interest, the user clicks on user input button1428to apply the selected elements to the soon-to-be-created RCA policy.

In some embodiments, a user repeats operation1204, creating multiple element groups (as shown below) until the user has input the elements according to the RCA policy. Process flows from operation1204to operation1206.

In operation1206of method1200, the user is presented with a GUI display1500(FIG.15) providing a summary table1502of the user's selected elements after completion of operation1204. Summary table1502includes the criteria type, element type, domain type, number of elements, and the element name. In summary table1502, element groups2,3, and5are domain based on a CN, such as CNs110and/or502. On the Internet, a domain consists of a set of network addresses. As CNs tie together diverse networks, a link between domain-based criteria type and core networks are common. A similar link exists between manage object criteria type and RAN domains.

A 5G RAN is divided into two physical entities named CU (Centralized Unit) and DU (Distributed Unit). With reference to the discussion of OSI layers, the CU provides support for the higher layers of the protocol stack such as service data adaptation protocol (SDAP is a protocol specified by 3GPP and maps the quality of service flow to the bearer service), packet data convergence protocol (PDCP provides services to the RRC and user plane upper layers, e.g. IP at the UE or to the relay at the base station) and radio resource control (RRC is a network layer protocol used between UE and base station) while the DU provides support for the lower layers of the protocol stack such as radio link control (RLC is a layer 2 radio link protocol used in UMTS, LTE and 5G), media access control (MAC is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment) and physical layer. One CU controls multiple DUs, for example more than 100 DUs are connected to one CU. Each DU supports one or more cells, like cells514, so one CU controls hundreds of cells.

The central unit control plane (CU-CP) hosts RRC and the control-plane part of the PDCP protocol. The CU-CP terminates the E1 interface (a standard wide area network (WAN) digital communication format designed to operate over copper facilities at a rate of 2.048 Mbps) connected with the central unit user plane (CU-UP) and the F1-C interface (that connects a CU to a DU) connected with the DU. The central unit user plane (CU-UP) is a logical node hosting the user plane part of the PDCP protocol of the gNB-CU for an en-gNB, and the user plane part of the PDCP protocol and the SDAP protocol of the gNB-CU for a gNB. The gNB-CU-UP terminates the E1 interface connected with the gNB-CU-CP and the F1-U interface connected with the gNB-DU.

Thus, with reference to summary table1502, element group1includes ten elements that are a combination of CU-CPs and CU-UPs, element group2includes three CU-CP elements, element group3includes six elements that are a combination of CU-CPs and CU-Ups, element group4includes 2 DUs elements, and element group five includes five DUs. Process flows from operation1206to operation1208.

In operation1208of method1200, one or more faults are selected for each element group. In some embodiments, GUI1600is configured to allow the user to create an RCA policy template. In some embodiments, in response to the selection of elements of operation1206that are to be a part of the RCA policy, the user defines one or more faults to be monitored within the element group on GUI1600.

In a non-limiting example, from the element groups established in operation1204, the user has selected element group5, which is shown in highlighted box1602(e.g., to indicate to the user the element group for which the event is being selected). Configure elements box1604displays each of the elements selected in operation1204at GUI1400.

In some embodiments, the user selects an event source (e.g., the source of the event message in which the fault is reported) at user input field1606. Continuing with the non-limiting example, the user has selected OBF (observability framework that collects fault events and increments performance counters as the event source), such as OBF605. In some embodiments, the user selects the event type at user input field1608. In some embodiments, a user selects from a list of fault events by clicking the down arrow included in user input field1608. Continuing with the non-limiting example, the user has selected performance manager (PM), which filters incoming event messages for performance metric events, such as those discussed in method700. Thus, the processing circuitry, such as processing circuitry3502(FIG.35), is monitoring incoming event messages for performance events (e.g., event messages with performance data within the event message).

In some embodiments, the user selects a message type at user input field1610. Message type user input field1610restricts the filtering of event type selected in user input field1608to a narrower type of performance metric. In some embodiments, the user narrows the performance metric even further in user input field1612by selecting an event name. In the example ofFIG.16, the user is monitoring the fan speeds within element group5.

Network location user input field1614is configured to be auto filled based upon the information submitted in GUI1400. User input field1616is also able to be auto filled based on the user selection in GUI1400.

In user selection field1618, GUI1600is configured to allow a user to select from several options to discover a specific fault. Continuing with the non-limiting example, the user has selected, and, from the list of conjunctions (e.g., such as and, or, followed by, or passthrough) within user selection field1618. In the non-limiting example, the selected conjunction is in bold and underlined to show the user's selection within user selection field1618. Continuing with the non-limiting example, the user is interested in the fan speed as reported by the performance manager, and, the user is interested in fan speed of 500 rpm (e.g., showing a fan operating above normal standards).

User selection field1618further includes or conjunction, followed by conjunction, and passthrough conjunction to assist a user in defining a fault condition for an RCA based policy. Additionally, the user clicks on user selection field1620to add another condition for the fault. For example, the fault includes a fan speed of 500 rpm or a fan speed of 0 rpm. In another example, the fault includes a fan speed of 500 rpm followed by a fan speed of 0 rpm. In another example, the fault includes a fan speed of 500 rpm event message to passthrough a certain number of times before taking any action.

In some embodiments, the user defines in user input field1622an operator that initiates a fault event. Continuing with the non-limiting example, the user has selected a greater than operation by clicking on the down arrow and choosing greater than from a list of mathematical and logic operators. The user has selected a value of three in user input field1624meaning four separate fan speed event messages where the fan speed is 500 rpm are received before initiating a fault event for the RCA policy template. Process flows from operation1208to operation1210.

In operation1210of method1200, GUI1700is configured to allow a user to define a policy based upon the prior selected elements. In some embodiments, from user input field1708the user selects which of the element groups the user is defining the policy. In a non-limiting example, the user has selected element group3. In some embodiments, within user input field1706a user defines a time window in which the policy is monitoring event messages to potentially take an action. In the example ofFIG.17, a user has set the time window at 5 minutes. In some embodiments, the time window is a sliding window, meaning event messages within five minutes of the current time are retained to determine whether a policy definition is satisfied. In some embodiments, after each five-minute window, all event messages are dumped, and a new group is collected for five minutes.

In some embodiments, user input field1704allows a user to determine how the policy is grouped. Group By user input field1704is configured to allow the grouping of smaller entities within larger entities to execute a single policy at a group level. Continuing with the non-limiting example, in response to grouping a hundred servers in a cluster and the CPU load of one of the one hundred servers within the server cluster is higher than 90%, then the same auto-scaling policy for servers in that cluster triggers. In some embodiments, at user selection field1710, a user selects a conjunction, like GUI1600. In the non-limiting example, the user selects an and conjunction with elements box1702, where the faults defined in GUI1600are identified for the element group listed in user input field1708. Continuing with the non-limiting example, a user selects a conjunction in user selection field1710(e.g., and). Before the policy definition is satisfied, fault event message 1, PM event message 1, and PM event message 2 (shown in event box1712) have been filtered and identified. In the non-limiting example, the user has further restricted the policy definition within user selection field1714that fault event 1, PM event 1, and PM event 2 are unable to be paired with fault event 2. Thus, in response to fault event 1, PM event 1, and PM event 2 all occurring within the five-minute window of user selection field1706, the policy definition is satisfied, unless fault event 2 is also triggered within the five-minute window.

GUI1700presents a flexible system in which to monitor for specific fault events, performance metrics, or both to better monitor the operation of a system. Process flows from operation1210to operation1212.

In operation1212of method1200, an action to be taken is defined, when the RCA policy definition in operation1210is satisfied. GUI1800is configured to allow a user to create an action that is executed based upon the policy definition set forth in operation1210.

Summary table1502is again shown in GUI1800summarizing all the element groups established in operation1204. In some embodiments, the user selects an action type in user input field1802. Continuing with the non-limiting example, the user selects workflow (as shown inFIG.18), notification, or incident ticket (discussed in greater detail above and below). In user input field1804, an action resource is designated. In the example ofFIG.18, LCM is selected. LCM, as discussed above in methods600,700, and1000, is an orchestrator that aligns business requests with the applications, data, and infrastructure.

In user input field1806, a user selects the action to be taken. In the example ofFIG.18, the user has selected to restart the network function like that discussed in method600and CPE300. User input field1808allows the user to select a payload to coincide with the action taken (e.g., an XML payload with parameters to be set after a restart). At user input field1810, a user selects to have the action triggered when a change request (CR) occurs.

A CR is declarative (i.e., CR states what needs to be accomplished, but leaves out how the change should be carried out). Elements of a change request are an ID, the customer (ID), the deadline (if applicable), an indication whether the change is required or optional, the change type (often chosen from a domain-specific ontology) and a change abstract, which is a piece of narrative. Change requests typically originate from one of five sources. (1) problem reports that identify bugs that are to be fixed, which forms the most common source; (2) system enhancement requests from users; (3) events in the development of other systems; (4) changes in underlying structure and or standards (e.g., in software development); (5) demands from senior management. Additionally, in Project Management, change requests further originate from an unclear understanding of the goals and the objectives of the project. Process flows from operation1212to operation1214.

In operation1214of method1200, the RCA policy is submitted for approval by a network administrator as indicated in text box1902. The user is further presented with a list of CPE policy templates1904. Each policy template in list1904is selected by clicking one or more of boxes1906. By clicking on box1906adjacent to the status heading, each policy template included in list1904is selected. Alternatively, a user selects an individual policy template, by clicking on the box for a corresponding policy template. A user is further able to select a group of policy templates by clicking on more than one box.

List1904provides the name of the policy template, the type of policy template (e.g., standard, RCA), the version, the date and time of creation, the creator, date and time of last modification, and an indicator as to whether the policy is triggered upon a CR.

FIG.20is a flow diagram of policy implementation2000, in accordance with some embodiments.

FIG.20is discussed to provide an understanding of the operation of CPEs300,200, or100through method of policy implementation2000. In some embodiments, method for implementing a policy2000is a functional overview of a CPE, such as CPEs300,200, or100. Method2000is executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method2000are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method2000includes operations2002-2020, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method2000are repeated. In some embodiments, unless specifically stated otherwise, the operations of method2000are performed in order.

In operation2002of method2000, a user, at UI such as UI208or3518, creates a policy descriptor that identifies one or more faults or policy metrics in which a later action is to be based upon. Process flows from operation2002to operation2004.

In operation2004of method2000, the user submits the policy template to a network manager who will review the template (e.g., policy structure, policy purpose, policy effectiveness, and other suitable policy parameters within embodiments of the preset disclosure). Process flows from operation2004to operation2006.

In operation2006of method2000, in response to the network manager approving the policy template, the policy template is placed within a template database for use by the policy creator and others. A user is now able to implement a policy state (e.g., implement the policy for a CPE to monitor and implement respective actions) on incoming event messages. Process flows from operation2006to operation2008.

In operation2008of method2000, an OBF, such as OBF605, collects event messages on a data bus, such as data bus214or607. The event messages are filtered in operation2010based upon each policy in effect, such as the created policy in operation2002, at the time of filtering of event messages. Process flows from operation2010to operation2012.

In operation2012of method2000, the filtered event messages are enriched and correlated. As discussed above, an inventory database, such as inventory database228, is accessed to enrichment of the event messages and a policy and correlation module, such as policy correction and evaluation module226. Event correlation is a technique for making sense of many events and pinpointing the few events that are of interest in the large number of events. This is accomplished by looking for and analyzing relationships between events. Event enrichment is the process by which the CPE monitors an event source for new events, looks up information related to the new events in an external data source, such as inventory database228, and then adds the information to the event. Process flows from operation2012to operation2014.

In operation2014of method2000, the CPE decides an action to be taken based upon the policy descriptor in operation2002. In operation2016, the action triggers an LCM, such as LCM613, which triggers the action to be performed to remedy the issue identified by the policy or notify personnel (e.g., through email, SMS, text, or other suitable messaging within embodiments of the present disclosure) the issue identified by the policy is occurring and needs to be addressed. Process flows from operation2016to operation2018.

In operation2018, the CPE updates the job status, e.g., the state of the triggered action of the LCM, and sends a notification in operation2020to the data bus so that any user determines the results of the action taken.

FIG.21is a flow diagram of a method for drag-and-drop policy creation2100, in accordance with some embodiments.

FIGS.22,23,24,25,26,27,28,29,30,31and32are graphical user interfaces (GUIs)2200,2300,2400,2500,2600,2700,2800,2900,3000,3100, and3200for a correlation and policy engine (CPE), in accordance with some embodiments.

FIGS.21-32are discussed together to provide an understanding of the operation of GUIs2200,2300,2400,2500,2600,2700,2800,2900,3000,3100, and3200and the method for drag-and-drop policy creation2100. In some embodiments, method for drag-and-drop policy creation2100is a functional overview of policy creation for a CPE through GUIs, such as2200,2300,2400,2500,2600,2700,2800,2900,3000,3100, and3200. In some embodiments, method2100is stored as instructions, such as instructions3506, and executed by processing circuitry3502discussed below with respect toFIG.35. In some embodiments, some, or all the operations of method2100are executed in accordance with instructions corresponding to instructions3506discussed below with respect toFIG.35.

Method1200includes operations2102-2116, but the operations are not necessarily performed in the order shown. Operations are added, replaced, order changed, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. In some embodiments, one or more of the operations of method2100are repeated. In some embodiments, unless specifically stated otherwise, the operations of method2100are performed in order.

In operation2102of method2100, a user selects to create a custom policy template from drop down window1908(FIG.19). In operation, a user clicks on user selection filed1910, which presents drop down window1908. Within drop down window a user is presented with options to create a custom policy, upload an already created policy or to use a descriptor. Continuing with the non-limiting example, the upload—pre-filled policy rule template allows a user to upload information that includes entire policy information. Use descriptor is a pre-filled policy but does not include the entire information (e.g., user descriptor has some information pre-populated and the rest of the information is filled out to complete the policy and activate). As shown inFIG.19, in correlation and policy engine templates GUI1900, the custom creation option is highlighted indicating the user is selecting to create a custom policy. Process flows from operation2102to operation2104.

In operation2104of method2100, GUI2200is presented for the user to add a policy template. Pop-up box2202presents user input fields2206through2212to identify the policy template being created. In a non-limiting example, a user inputs a policy name in user input field2206, a version in user input field2208, a vendor in user input field2210, and a description in user input field2212. In some embodiments, a user input field with an asterisk adjacent to the titled of the user input field is an indication an input is desired to move forward with the policy template creation process. In some embodiments, a user cancels the policy template creation process by clicking on user input selection2212. In some embodiments, a user proceeds to operation2206by clicking on user input selection2214.

In some embodiments, a policy template is located on policy manager210and/or policy database340. GUI identifier2216identifies GUI2200as a policy-template addition page, for a policy to be used within CPEs100,200, or300and within methods2000or2100.

In some embodiments, a user inputs a policy name in user input field2204. In a non-limiting example, the user has inputted MME auto scale up policy.

Continuing with the non-limiting example, the user inputs a version in user input field2206, such as 1.0.0 that indicates this is the first version of the policy. In some embodiments, in response to a major change being made to an already existing policy template, the version number changes with the leftmost integer (e.g., version 2.0.0). In some embodiments, in response to a minor change being made to an already existing policy template, the version number changes with the middle integer (e.g., version 1.1.0). In some embodiments, in response to a typographical change being made to an already existing policy template, the version number changes with the rightmost integer (e.g., version 1.0.1). In some embodiments, a new template begins with beginning version number of 1.0.0 signifying a first version of the template.

Within user input field2208, a user inputs a vendor, such as a service provider516of the network. Within user input field2210, the user inputs a description of the policy being created, such as a purpose of the policy, the boundaries of the policy, and faults or events affecting the policy. In some embodiments, this description is used when other users are performing a search for an already existing policy template to implement or modify.

In some embodiments, policy creation is canceled with user input button2212. In some embodiments, in response to user input fields2204,2206, and2208including a valid input, the process moves to the next stage of policy template creation with user input button2214.

In operation2106of method2100, GUI2300is presented to the user to begin creation of the policy description. GUI2300is presented as a grid2302in which the user drags and drops elements from toolbox2304. Toolbox2304includes three user input selection fields including network types2306, operators2308, and actions2310. In the example ofFIG.23, a user has selected to define network element types2306(shown as highlighted and the selection arrow2312inverted). In response to a user selecting network element types user input selection field2306, network element types user input selection field is expanded with user input selection fields2314,2316,2318, and2320. In some embodiments, a user searches for a desired network element using user input selection field2314. In some embodiments, a user selects a server as the desired network element type by selecting user input selection field2318. In some embodiments, the user selects a vRAN application as the desired network element type by selection user input selection field2320. In the example ofFIG.23, the user has selected user selection input field2316to select a cluster as the desired network element type. A user would click and hold on user selection input field2316and drag the user selection input field onto grid2301as represented by box2322. Process flows from operation2106to operation2108.

In operation2108of method2100, a user configures the network elements selected in GUI2400. In response to the user dropping a network element type, such as cluster selection2322ofFIG.23, onto grid2302pop-up box2402is presented to the user. Pop-up box2402includes status bar2404that informs the user of progress through the element configuration process. The user is informed of where the elements configuration process is by status circles2410. An open circle indicates the user has not reached the stage to the right of the open circle (e.g., event configuration has an empty circle to the left indicating the user has not begun this process of policy template setup); a partially filled circle, such as the circle in front of elements selection included in status bar2404, indicates the current progress in the policy template creation (e.g., the user is currently working on the elements selection portion of the policy template); and a checkmark within the circle indicates that stage of the policy creation process has been completed. In operation, after the elements are selected, process flows to event configuration as discussed below.

Pop-up box2402displays user input fields2408,2412,2414, and2416for a user to select elements. NE type in box2406is already filled in with cluster as this is what the user selected with regards toFIG.23. Thus, the NE type is already filled in.

In some embodiments, in user input field2408the user inputs the default location of the cluster. Continuing with the non-limiting example, the cluster is in or at a CDC (e.g., a central data center, such as a building, a dedicated space within a building, or a group of buildings used to house computer systems and associated components, such as telecommunications and storage systems).

In some embodiments, in user input field2412the user inputs a network element (NE) filter value. Continuing with the non-limiting example, the user clicks on the down arrow and selects the desired network element, such as geolocation. Thus, the policy is filtering for clusters within a geolocation. Thus, as event messages are routed to a CPE, such as CPEs100,200, and300, the event messages are first filtered, for the example ofFIG.24, by whether the event messages are related within a selected geolocation.

In some embodiments, the NE filter is narrowed even further by selecting a geographic level in user input field2414. In the non-limiting example, the user has selected a prefecture (e.g., a regional or local government subdivision in various countries). Continuing with the non-limiting example, a user narrows the filter even further by inputting a filter value in user input field2416. In the non-limiting example, the user has selected the city of Tokyo. Thus, during the filtering process described above with regards to CPEs100,200, and300, the policy, when implemented first filters according to box2406and then filters those results according to filter values in user input fields2408,2412,2414and2416.

In some embodiments, the user clicks on user input button2418and elements associated with the criteria inputted by the user are gathered and placed within available elements box2420. In some embodiments, the user moves available elements from available elements box2420to selected elements box2422using the right facing arrows. In some embodiments, the user is further able to move elements from the selected elements box by clicking on one or more selected elements and clicking on a left-facing arrow to move the selected elements back to the available elements box2420. In response to the user selecting the elements of interest, the user clicks on user input button2424to apply the selected elements to the soon-to-be-created policy. Process flows from operation2108to operation2110.

In operation2110, a user defines event configuration parameters. In some embodiments, GUI2500is configured to allow the user to create the event configuration. In some embodiments, in response to the selection of elements of operation2108that are to be a part of the policy template, the user defines one or more faults to be monitored within the element group on GUI2400.

In some embodiments, the user selects an event source (e.g., the source of the event message in which the fault is reported) at user input field2502. Continuing with the non-limiting example, the user has selected OBF (observability framework that collects fault events and increments performance counters as the event source), such as OBF605. In some embodiments, the user selects the event type at user input field2504. In some embodiments, a user selects from a list of fault events by clicking the down arrow included in user input field2504. Continuing with the non-limiting example, the user has selected a fault, which filters incoming event messages for fault events. Thus, the processing circuitry, such as processing circuitry3502(FIG.35), is monitoring incoming event messages for fault events (e.g., event messages with faults within the event message).

In some embodiments, within user input field2508a user defines a time window in which the policy is monitoring event messages to potentially take an action. In the example ofFIG.25, a user has set the time window at 5 minutes. In some embodiments, the time window is a sliding window, meaning event messages within five minutes of the current time are retained to determine whether a policy definition is satisfied. In some embodiments, after each five-minute window, all event messages are dumped, and a new group is collected for five minutes.

The user defines the condition even further by setting a match by condition in user selection box2510. Continuing with the example, average has been selected, therefore, whatever value is selected in user input box2514, before the condition is satisfied, the average value over 5 minutes is determined.

In some embodiments, the user defines in user input field2512an operator that initiates a fault event. Continuing with the non-limiting example, the user has selected a greater than operation by clicking on the down arrow and choosing greater than from a list of mathematical and logic operators. The user has selected a value of 90 in user input field2514meaning the average over 5 minutes is greater than 90 before initiating an action. Continuing with the non-limiting example, fault event 1 is an alias of a fault, so in response to the fault event being a CPU load (one kind of fault event), then the policy is triggered in response to the CPU load being greater than 90%. Process flows from operation1208to operation1210. Process flows from operation2110to2112.

In operation2112, a user defines conjunctive connectors for one or more events. With toolbox2304, GUI2600is configured to allow a user to select from several options to determine a specific fault using conjunctive connectors and2602, or2604, and/or followed by2606. In a non-limiting example, a user, with a drag and drop operation, place a conjunction, such a followed by2608, to be paired with fault event 1 and performance event 2 which were defined prior regarding operations2108and2110. Continuing with the non-limiting example, fault event 1 is the initial event followed by performance event 2. In some embodiments, performance event 2 is the initial event followed by fault event 1.

In computer GUIs, drag and drop is a pointing device gesture in which the user selects a virtual object by grabbing the virtual object and dragging it to a different location or onto another virtual object. In general, drag and drop is used to invoke many kinds of actions, or create various types of associations between two abstract objects.

In response to the user setting followed by icon2608on grid2302, pop-up box2701is presented to the user to configure the conjunctive operator (e.g., followed by2608). Box2701is filled automatically as the user has already selected the conjunctive operation type inFIG.26. In some embodiments, the user changes the conjunctive operator type by clicking on the down arrow in box2701to select a different conjunctive operator.

In user input field2704, the user selects the network element types from network elements group2706. Time window2708is set to define boundaries as to when the 2ndevent occurs in relation to the first event. Continuing with the non-limiting example, in response to performance event 2 occurring within 5 minutes of fault event 1, an action is initiated.

In some embodiments, user selection fields2710and2712are automatically filled based upon which order the events were placed upon grid2302. In some embodiments, a user changes the 1stevent or 2ndevent by clicking on the down arrow within user selection fields2710and2712; however, the user is blocked from using the same event within both user selection fields2710and2712. Once the user has configured the conjunction operator, the user clicks on user selection field2714. Process flows from operation2112to operation2114.

In operation2114of method2100, a user selects an action to take in response to the trigger event set in operation2112(FIG.27) being satisfied. In toolbox2304, a user clicks on user selection box2320to present action types presented as user selection boxes. The user selects from user selection boxes2802(workflow),2804(notification), and2806(change request). Workflow2802is used when the user desires for an attempted repair of the fault. For example, the user desires for a network function restart. Notification is selected when the user desires for a network operator or engineer to be informed of the triggered event and for the network operator or engineer to act. Change request is selected when the triggered event initiates a change request to repair the issue causing the triggered event.

In operation, a user would drag and drop an action, such as workflow2808, onto the grid2302. Further, as seen inFIG.28, fault event 1 and performance event 2 are linked to followed by conjunctive operator2608and each event is labeled in the order of occurrence for the trigged event. Such as, fault event 1 includes a heptagram2810indicating fault event 1 is to occur first and heptagram2812indicating performance event 2 occurs second.

With reference toFIG.29, upon the user dropping the workflow2802user selection box onto grid2302, pop-up box2902is presented on GUI2900. GUI2900is configured to allow a user to create an action. In user input field2904, an action resource is designated. In the example ofFIG.29, LCM is selected. LCM, as discussed above in methods600,700, and1000, is an orchestrator that aligns business requests with the applications, data, and infrastructure.

In user input field2906, a user selects the action to be taken. In the example ofFIG.29, the user has selected to restart the network function like that discussed in method600and CPE300. User input field2908allows the user to select a payload to coincide with the action taken (e.g., an XML payload with parameters to be set after a restart). At user input field2910, a user selects to have the action to be triggered when a change request (CR) occurs. Upon completion of configuring the workflow, a user clicks on user selection field2912to move to next operation in the process.

With reference toFIG.30, upon the user clicking on user selection field2912, pop-up box3002is presented in GUI3000. GUI3000provides a summary of the selected elements in the event created. Continuing with the non-limiting example, box3004shows fault event 1 including the 10 elements which are part of fault event 1. Similarly, box3006shows performance event 2 including the three elements which are part of performance event 2.

In response to a user desiring at the last minute to add another element, the user clicks on user selection field3008to add a new element in the event. Upon clicking user selection field3008, lower portion3010of pop-up box3002is present to the user. Lower portion3010is almost identical to pop-up box2402of GUI2400, which allows a user to add additional elements to the event. Process flows from operation2114to operation2116.

In operation2116, a user selects a notification that occurs based upon a result of the workflow. Continuing with the non-limiting example, a user selects notification3102and drags notification box3102onto grid2302. As shown, the workflow is connected to conjunctive operation2608, indicating the workflow follows the triggered event. In a similar fashion, notification3102comes after the workflow to indicate either success or failure. Summary box3104provides the user with a summary of all elements on grid2302up to operation2116.

In response to the user dropping notification3102onto grid2302, GUI3200is presented to the user along with pop up box3202. In the non-limiting example, pop-up box3202is in the form of an email; however, pop-up box3202is configured to be a short message service (SMS) or any other suitable messaging within embodiments of the present disclosure. For example, in response to the user desiring to send the notification via SMS, the user clicks the down arrow in user selection field3204and selects SMS from a pull-down window of messaging selections.

The user inputs the intended recipients in user input field3206. In some embodiments, one or more of the inputs in input field3206are automatically filled based upon CPE settings. The user inputs a message to the recipients (listed in user input field3206) within user input field3208. Once complete, the user clicks on user selection field3210to apply the messaging settings.

With reference to GUI3300ofFIG.33, the user has selected the notification to flow from a failure of the workflow event. In some embodiments, the user creates a second notification based upon success for the workflow event. In some embodiments, the user creates a notification based upon success of the workflow event instead of failure of the workflow event.

With reference to GUI3400ofFIG.34, in response to the policy template being accepted by a network manager or engineer, the policy template is put into service. When implemented, job status is monitored on GUI3400. Those with access to job status GUI3400are able to monitor when the policy is successful, when the policy fails, how many times the policy was triggered, when the policy was last run, and other suitable information within embodiments of the present disclosure.

FIG.35is a block diagram of CPE system3500in accordance with some embodiments. In some embodiments, CPE system3500is a general-purpose computing device including a hardware processing circuitry3502and a non-transitory, computer-readable storage medium3504. Storage medium3504, amongst other things, is encoded with, i.e., stores, computer instructions3506, i.e., a set of executable instructions such as a correlation engine and policy manager. Execution of instructions3506by hardware processing circuitry3502represents (at least in part) a CPE tool which implements a portion or all the methods, such as method400,600,700,800,900,1000,1100,1200,2000, and2100described herein in accordance with one or more embodiments (hereinafter, the noted processes and/or methods).

Hardware processing circuitry3502is electrically coupled to a computer-readable storage medium3504via a bus3508. Hardware processing circuitry3502is further electrically coupled to an I/O interface3510by bus3508. A network interface3512is further electrically connected to processing circuitry3502via bus3508. Network interface3512is connected to a network3514, so that processing circuitry3502and computer-readable storage medium3504connect to external elements via network3514. processing circuitry3502is configured to execute computer instructions3506encoded in computer-readable storage medium3504in order to cause CPE system3500to be usable for performing the noted processes and/or methods, such as methods400,600,700,800,900,1000,1100,1200,2000, and2100ofFIGS.4,6,7,8,9,10,11,12,20and21. In one or more embodiments, processing circuitry3502is a central processing unit (CPU), a multi-processor, a distributed processing system, an application specific integrated circuit (ASIC), and/or a suitable processing unit.

In one or more embodiments, computer-readable storage medium3504is an electronic, magnetic, optical, electromagnetic, infrared, and/or a semiconductor system (or apparatus or device). For example, computer-readable storage medium3504includes a semiconductor or solid-state memory, a magnetic tape, a removable computer diskette, a random-access memory (RAM), a read-memory (ROM), a rigid magnetic disk, and/or an optical disk. In one or more embodiments using optical disks, computer-readable storage medium3504includes a compact disk-read memory (CD-ROM), a compact disk-read/write (CD-R/W), and/or a digital video disc (DVD).

In one or more embodiments, storage medium3504stores computer instructions3506configured to cause CPE system3500to be usable for performing a portion or the noted processes and/or methods. In one or more embodiments, storage medium3504further stores information, such as a correlation and policy engine which facilitates performing the noted processes and/or methods.

CPE system3500includes I/O interface3510that is like UI208. I/O interface3510is coupled to external circuitry. In one or more embodiments, I/O interface3510includes a keyboard, keypad, mouse, trackball, trackpad, touchscreen, cursor direction keys and/or other suitable I/O interfaces are within the contemplated scope of the disclosure for communicating information and commands to processing circuitry3502.

CPE system3500further includes network interface3512coupled to processing circuitry3502. Network interface3512allows CPE system3500to communicate with network3514, to which one or more other computer systems are connected. Network interface3512includes wireless network interfaces such as BLUETOOTH, WIFI, WIMAX, GPRS, or WCDMA; or wired network interfaces such as ETHERNET, USB, or IEEE-864. In one or more embodiments, noted processes and/or methods, is implemented in two or more CPE system3500.

CPE system3500is configured to receive information through I/O interface3510. The information received through I/O interface3510includes one or more of instructions, data, and/or other parameters for processing by processing circuitry3502. The information is transferred to processing circuitry3502via bus3508. CPE system3500is configured to receive information related to a UI through I/O interface3510. The information is stored in computer-readable medium3504as user interface (UI)3518.

In some embodiments, the noted processes and/or methods are implemented as a standalone software application for execution by processing circuitry. In some embodiments, the noted processes and/or methods are implemented as a software application that is a part of an additional software application. In some embodiments, the noted processes and/or methods is implemented as a plug-in to a software application.

In some embodiments, the processes are realized as functions of a program stored in a non-transitory computer readable recording medium. Examples of a non-transitory computer-readable recording medium include, but are not limited to, external/removable and/or internal/built-in storage or memory unit, e.g., one or more of an optical disk, such as a DVD, a magnetic disk, such as a hard disk, a semiconductor memory, such as a ROM, a RAM, a memory card, and the like.

In some embodiments, a system includes processing circuitry; and a memory connected to the processing circuitry, wherein the memory is configured to store executable instructions that, when executed by the processing circuitry, facilitate performance of operations, including receive a policy template identifier; receive network element selections; receive network element filter parameters; receive network event parameters; receive conjunctive operation parameters; receive action configuration parameters; and create a network policy template to monitor event messages and perform an action based on the action configuration parameters.

In some embodiments, the executable instructions further facilitate performance of operations, including receive notification parameters to inform selected recipients of results of the action taken based on the action configuration parameters.

In some embodiments, the executable instructions further facilitate performance of operations, including cause a graphical user interface (GUI) to be output by a user interface (UI), the GUI including a display including a user selection field configured to create a custom policy template in response to a user input.

In some embodiments, the executable instructions further facilitate performance of operations, including cause a first graphical user interface (GUI) to be output by a user interface (UI), the first GUI including a display including a user selection field configured to display a drag and drop user selection field when selected by a user; in response to the drag and drop user selection field being dragged and dropped, cause a second graphical user interface (GUI) to be output by the UI, the second GUI including a display including user input fields to accept parameters for a network element type.

In some embodiments, the receiving network element selections includes cause a graphical user interface (GUI) to be output by a user interface (UI), the GUI including a display including one or more user input fields configured to receive one or more user inputs identifying a network element, a default location, a network element filter, a geography level, or filter value.

In some embodiments, the executable instructions further facilitate performance of operations, including cause a first graphical user interface (GUI) to be output by a user interface (UI), the first GUI including a display including a user selection field configured to display a drag and drop user selection field when selected by a user; in response to the drag and drop user selection field being dragged and dropped, cause a second graphical user interface (GUI) to be output by the UI, the second GUI including a display including user input fields to accept parameters for a conjunction operator to be associated with two event sources.

In some embodiments, the receiving the conjunctive operation parameters, includes cause a graphical user interface (GUI) to be output by a user interface (UI), the GUI including a display including one or more input fields configured to receive one or more inputs identifying a conjunctive operator type, a network element type, a time window for the conjunctive operator type, a first trigger event, and a second trigger event coupled to the first trigger event by the conjunctive operator type.

In some embodiments, the executable instructions further facilitate performance of operations, including cause a first graphical user interface (GUI) to be output by a user interface (UI), the first GUI including a display including a user selection field configured to display a drag and drop user selection field when selected by a user; in response to the drag and drop user selection field being dragged and dropped, cause a second graphical user interface (GUI) to be output by the UI, the second GUI including a display including user input fields to accept parameters for an action to be taken in response to a triggered event occurring.

In some embodiments, receiving the action configuration parameters, includes cause a graphical user interface (GUI) to be output by a user interface (UI), the GUI including a display including one or more input fields configured to receive one or more inputs identifying an action resource in which to implement the action, the action to be initiated, or a payload; and an input filed configured to receive an input designating the action is to be taken when a change request is initiated.

In some embodiments, a method executed by a processor, including receiving a policy template identifier; receiving network element selections; receiving network element filter parameters; receiving network event parameters; receiving conjunctive operation parameters; receiving action configuration parameters; and creating a network policy template to monitor event messages and perform an action based on the action configuration parameters.

In some embodiments, the method further includes receiving notification parameters to inform selected recipients of results of the action taken based on the action configuration parameters.

In some embodiments, the method further includes causing a graphical user interface (GUI) to be output by a user interface (UI), the GUI including a display including a user selection field configured to create a custom policy template in response to a user input.

In some embodiments, the method further includes causing a first graphical user interface (GUI) to be output by a user interface (UI), the first GUI including a display including a user selection field configured to display a drag and drop user selection field when selected by a user; in response to the drag and drop user selection field being dragged and dropped, causing a second graphical user interface (GUI) to be output by the UI, the second GUI including a display including user input fields to accept parameters for a network element type.

In some embodiments, the method further including causing a graphical user interface (GUI) to be output by a user interface (UI), the GUI including a display including one or more user input fields configured to receive one or more user inputs identifying a network element, a default location, a network element filter, a geography level, or filter value.

In some embodiments, the method further includes causing a first graphical user interface (GUI) to be output by a user interface (UI), the first GUI including a display including a user selection field configured to display a drag and drop user selection field when selected by a user; in response to the drag and drop user selection field being dragged and dropped, causing a second graphical user interface (GUI) to be output by the UI, the second GUI including a display including user input fields to accept parameters for a conjunction operator to be associated with two event sources.

In some embodiments, the method further includes causing a graphical user interface (GUI) to be output by a user interface (UI), the GUI including a display including one or more input fields configured to receive one or more inputs identifying a conjunctive operator type, a network element type, a time window for the conjunctive operator type, a first trigger event, and a second trigger event coupled to the first trigger event by the conjunctive operator type.

In some embodiments, the method further includes causing a first graphical user interface (GUI) to be output by a user interface (UI), the first GUI including a display including a user selection field configured to display a drag and drop user selection field when selected by a user; in response to the drag and drop user selection field being dragged and dropped, causing a second graphical user interface (GUI) to be output by the UI, the second GUI including a display including user input fields to accept parameters for an action to be taken in response to a triggered event occurring.

In some embodiments, the method further includes causing a graphical user interface (GUI) to be output by a user interface (UI), the GUI including a display including one or more input fields configured to receive one or more inputs identifying an action resource in which to implement the action, the action to be initiated, or a payload; and an input filed configured to receive an input designating the action is to be taken when a change request is initiated.

In some embodiments, a device includes a non-transitory, tangible computer readable storage medium storing a computer program, wherein the computer program contains instructions that when executed, cause a processor to perform operations including receive a policy template identifier; receive network element selections; receive network element filter parameters; receive network event parameters; receive conjunctive operation parameters; receive action configuration parameters; and create a network policy template to monitor event messages and perform an action based on the action configuration parameters.

In some embodiments, the instructions further cause the processor to perform operations including receive notification parameters to inform selected recipients of results of the action taken based on the action configuration parameters.

The foregoing outlines features of several embodiments so that those skilled in the art better understand the aspects of the present disclosure. Those skilled in the art should appreciate that they readily use the present disclosure as a basis for designing or modifying other processes and structures for carrying out the same purposes and/or achieving the same advantages of the embodiments introduced herein. Those skilled in the art should further realize that such equivalent constructions do not depart from the spirit and scope of the present disclosure, and that they make various changes, substitutions, and alterations herein without departing from the spirit and scope of the present disclosure.