Network operation

Patent metadata

Field	Value
Publication number	US-11240119-B2
Application number	US-201615749151-A
Country	US
Kind code	B2
Filing date	Jul 28, 2016
Priority date	Jul 31, 2015
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

A method of operating a communications network is disclosed. Modern communications networks produce vast amounts of network operational data which have the potential to provide a useful summary of the operational state of the network. Whilst processes such as clustering are known for arranging the vast amount of data into groups, the clusters themselves do not provide data which might be easily interpreted by network elements or administrators. Network operational data often comprises a plurality of data items, each of which gives a value for each of a set of attributes. By processing a cluster to identify attributes in the cluster whose values vary less in the cluster then they vary outside of the cluster, and then generating a cluster description which is based on a measure of the central tendency of the values of those attribute in the cluster, an easily interpretable general description of the data items in the cluster is provided. The easily interpretable general description of the cluster can then be used to relatively identify data items similar to those present in the cluster (e.g. from a larger database of data items), and elements in the network can then act autonomously on the basis of the cluster description to control the operation of the communications network.

First claim

The invention claimed is:

1. A method of operating a communications network comprising:
accessing a plurality of network operational data items arranged into groups, each of said groups comprising a plurality of network operational data items, each of said network operational data items having a value for each of a plurality of attributes, at least one attribute having an associated statistical data type indication indicating the statistical data type of data values provided for attribute is nominal and at least one another attribute having an associated statistical data type indication indicating the statistical data type of data values provided for attribute is quantitative, and
for each group:
i) for each of said attributes whose values are indicated to be of a nominal statistical data type:
a) calculating a measure of central tendency of the values of said attribute that are indicated to be of the nominal statistical data type; and
b) calculating a measure of the variability of the values of said attribute by performing a nominal attribute variability measure calculation specialized for attributes whose data are of the nominal statistical data type;
ii) for each of said attributes whose values are indicated to be of a quantitative statistical data type:
a) calculating a measure of central tendency of the values of said attribute that are indicated to be of the quantitative statistical data type; and
b) calculating a measure of the variability of the values of said attribute by performing a nominal attribute variability measure calculation specialized for attributes whose data are of the quantitative statistical data type;
iii) identifying one or more attributes having values with a variability lower than a predetermined threshold;
iv) generating a description of the group based on the measure of central tendency found for the one or more identified attributes; and
v) controlling an operation of the communications network using the generated description of the group.

2. The method according to claim 1 wherein controlling the operation of the communications network using the generated description of the group includes automatically generating a query from said description, and executing the query on a database of network operational data items.

3. The method according to claim 1 wherein said groups comprise clusters, said step of arranging said plurality of network operational data items into groups comprising clustering said plurality of network operational items into clusters using a clustering process.

4. The method according to claim 3 wherein said clustering process is a hierarchical clustering process which arranges said plurality of network operational data items into a containment hierarchy of clusters.

5. The method according to claim 1 wherein said description of the group comprises the measure of central tendency found for the one or more identified attributes.

6. The method according to claim 1 wherein the description of the group includes measures of central tendency of two or more attributes of different statistical data types.

7. The method according to claim 1 wherein controlling the operation of the communications network using the generated description of the group includes identifying other data items similar to those present in the group, and controlling the operation of the communications network using those identified other data items.

8. The method according to claim 1 wherein controlling the operation of the communications network using the generated description of the group includes applying a query based on the generated description on other data items, recognizing at least one of the other data items as representing a malicious activity, and stopping or degrading the malicious activity.

9. The method according to claim 1 further comprising automatically finding the statistical data type of the values of the attribute as nominal, ordinal or quantitative by statistically analyzing a plurality of the values of at least one of said attributes.

10. A method according to claim 1 in which at least one attribute has an associated statistical data type indication indicating the statistical data type of the data value provided for the attribute as ordinal, the method further comprising, for each group,
for each of said attributes indicated to be of an ordinal statistical data type:
a) calculating a measure of central tendency of the values of said attribute that are indicated to be of the ordinal statistical data type;
b) calculating a measure of the variability of the values of said attribute by performing an ordinal attribute variability measure calculation specialized for attributes of the ordinal statistical data type.

11. A method according to claim 1 , wherein: for each of said attributes whose values are indicated to be of the nominal statistical data type, calculating the measure of the central tendency of the values of said attribute that are indicated to be of the nominal statistical data type includes using one or more modal values of said attribute that are indicated to be of the nominal statistical data type; and
for each of said attributes whose values are indicated to be of the quantitative statistical data type, calculating the measure of the central tendency of the values of said attribute that are indicated to be of the quantitative statistical data type includes using a mean of the values of said attribute that are indicated to be of the quantitative statistical data type.

12. A method according to claim 1 , wherein:
for each of said attributes whose values are indicated to be of the nominal statistical data type, performing the nominal attribute variability measure calculation specialized for attributes whose data values are of the nominal statistical data type includes calculating a distance measure between a current value and an average value of the attribute whose values are indicated to be of the nominal statistical data type by setting the distance measure between the current value and the average value of the attribute whose values are indicated to be of the nominal statistical data type to be a first value if the current value and the average value of the attribute whose values are indicated to be of the nominal statistical data type are the same, and setting the distance measure between the current value and the average value of the attribute whose values are indicated to be of the nominal statistical data type to be a second value if the current value and the average value of the attribute whose values are indicated to be of the nominal statistical data type are different, the first and second values being different from each other; and
for each of said attributes whose values are indicated to be of the quantitative statistical data type, performing the quantitative attribute variability measure calculation specialized for attributes whose data values are of the quantitative statistical data type includes calculating a distance measure between a current value and an average value of the attribute whose values are indicated to be of the quantitative statistical data type by at least calculating an absolute difference between the current value and the average value of the attribute whose values are indicated to be of the quantitative statistical data type.

13. A computer-implemented method of automatically generating a description of the state of a communications network, said method comprising:
accessing a plurality of network operational data items arranged into groups, each of said groups comprising a plurality of network operational data items, each of said network operational data items havi

Assignees

• British Telecomm

Inventors

• Healing Alexander
• Turner Michael

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06F16/285

  Clustering or classification · CPC title

• G06F16/355 Primary

  Creation or modification of classes or clusters · CPC title

• H04L41/142 Primary

  using statistical or mathematical methods · CPC title