Key performance indicator anomaly detection in telephony networks

Patent metadata

Field	Value
Publication number	US-10944776-B2
Application number	US-202016817488-A
Country	US
Kind code	B2
Filing date	Mar 12, 2020
Priority date	Jul 13, 2018
Publication date	Mar 9, 2021
Grant date	Mar 9, 2021

Abstract

The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary method of operating a system to detect traffic anomalies includes the steps of: inputting input values, said input values including i) a set of key performance indicator values and ii) one or more selector values corresponding to a first anomaly group classification instance into a trained neural network; operating the trained neural network to output values corresponding to the inputted set of key performance indicator values; determining a score for the first anomaly group classification instance based on the output values of the trained neural network corresponding to the key performance indicator values, each of said output values corresponding to one key performance indicator input value; and when the score is above a first threshold determining that an anomaly condition exists with respect to the first anomaly group classification instance.

First claim

What is claimed is:

1. A method of operating a system to detect traffic anomalies comprising:
inputting input values into a trained neural network, said input values including: i) a set of key performance indicator values and ii) one or more selector values corresponding to a first anomaly group classification instance;
operating the trained neural network to output values corresponding to the inputted set of key performance indicator values;
determining a score for the first anomaly group classification instance based on the output values of the trained neural network corresponding to the key performance indicator values, each of said output values corresponding to one key performance indicator input value;
comparing the score to a first threshold; and
when said score is above the first threshold determining that an anomaly condition exists with respect to the first anomaly group classification instance;
wherein said neural network includes:
an input layer which receives the input values;
an output layer from which the neural network output values are outputted;
a bottleneck layer including a plurality of neural network nodes, said bottleneck layer having the fewest neural network nodes of any layer in the neural network containing neural network nodes, said bottleneck layer receiving inputs from a first neural network layer containing more neural network nodes than said bottleneck layer, said bottleneck layer providing outputs to a second neural network layer containing more neural network nodes than said bottleneck layer; and

wherein said neural network minimizes the error between the neural network output values and a subset of the input values.

2. The method of claim 1 further comprising:
when said score is at or below said first threshold determining that an anomaly condition does not exist with respect to the first anomaly group classification instance.

3. The method of claim 2 , wherein determining a score for the first anomaly group classification instance based on the output values of the trained neural network includes determining a loss function value which measures the difference between the inputted key performance indicator values and the corresponding neural network output values, said trained neural network being an autoencoder neural network.

4. The method of claim 3 , wherein said score for the first anomaly group classification instance is the determined loss function value.

5. The method of claim 4 ,
wherein said input values inputted into the trained neural network are a set of input values; and
wherein said loss function value is a reproduction error of the autoencoder neural network post-image output indicating an amount of discrepancy between a subset of the input values and corresponding autoencoder neural network output values, said subset of the input values being smaller than the set of input values.

6. The method of claim 3 , wherein said loss function value is determined using a non-standard cross-entropy loss function.

7. The method of claim 4 ,
wherein said first anomaly group classification instance is a trunk group during a specified time period; and
wherein said key performance indicator values are traffic performance measurements corresponding to the trunk group during the specified time period.

8. The method of claim 4 ,
wherein said first anomaly group classification instance is a two dimensional group classification, the first dimension group classification being a trunk group and the second dimension group classification being a time group, the trunk group specifying the identity of the trunk group from a plurality of trunk groups and the time group specifying a time period; and
wherein said key performance indicator values are traffic performance measurements for the identified trunk group during the time period specified by the time group.

9. The method of claim 8 , wherein the key performance indicators include two or more of the following: ingress and egress bids, ingress and egress connections, ingress and egress minutes of usage (MOU), number of bids, connects and MOU independent of direction.

10. The method of claim 1 ,
wherein said first anomaly group classification instance is an N-dimensional group classification, N being a positive integer value greater than one, the N-dimensional group classification including two or more of the following: source, destination, subscriber, trunk group, and time group.

11. A method of operating a system to detect traffic anomalies comprising:
inputting input values into a trained neural network, said input values including: i) a set of key performance indicator values and ii) one or more selector values corresponding to a first anomaly group classification instance;
operating the trained neural network to output values corresponding to a subset of the inputted values;
determining a score for the first anomaly group classification instance based on one or more of the output values of the trained neural network, said one or more output values corresponding to one or more of the key performance indicator values included in the set of key performance indicator values;
comparing the score to a first threshold;
when said score is above the first threshold determining that an anomaly condition exists with respect to the first anomaly group classification instance; and
wherein said trained neural network includes:
an input layer for receiving the input values;
an output layer which contains the computed output values, said output layer being smaller than said input layer;
at least three neural network layers including neural network nodes, said at least three neural network layers including neural network nodes including a first neural network processing layer, a second neural network processing layer, and a bottleneck layer, said bottleneck layer having the fewest nodes of any neural network layer of the neural network containing neural network nodes, said bottleneck layer receiving inputs from said first processing neural network layer and providing outputs to said second neural network layer;
said neural network having been trained to minimize the error between the output values and a subset of the input values.

12. A system to detect traffic anomalies comprising:
a trained neural network; and
a processor, said processor being configured to control the operations of the system to:
input into the trained neural network input values, said input values including: i) a set of key performance indicator values and ii) one or more selector values corresponding to a first anomaly group classification instance;
operate the trained neural network to output values corresponding to the inputted set of key performance indicator values;
determine a score for the first anomaly group classification instance based on the output values of the trained neural network corresponding to the key performance indicator values, each of said output values corresponding to one key performance indicator input value;
compare the score to a first threshold; and
when said score is above the first threshold determine that an anomaly condition exists with respect to the first anomaly group classification instance;
wherein said trained neural network is an autoencoder neural network trained to minimize the error between the outputted values corresponding to the inputted set of key performance indicator values, said autoencoder neural network being a neural network including:
i) a number of neural network nodes in a bottleneck layer of the neural network, said bottleneck layer of the neural network having the fewest number of nodes of any layer of the neural network containing neural ne

Assignees

• Ribbon Comm Operating Co Inc

Inventors

• Bharrat Shaun Jaikarran
• Thornton Timothy R

Classifications

• G06N3/045

  Combinations of networks · CPC title

• G06N3/0455

  Auto-encoder networks; Encoder-decoder networks · CPC title

• G06N3/0895

  Weakly supervised learning, e.g. semi-supervised or self-supervised learning · CPC title

• G06N3/0499

  Feedforward networks · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title