Time series transaction failure cause detection and generative alerting for wireless network transactions

Patent metadata

Field	Value
Publication number	US-12562965-B2
Application number	US-202418791218-A
Country	US
Kind code	B2
Filing date	Jul 31, 2024
Priority date	Jul 31, 2024
Publication date	Feb 24, 2026
Grant date	Feb 24, 2026

Abstract

A processing system may obtain time series associated with a plurality of network functions of a communication network, each time series including a sequence of values over a plurality of time intervals, each value indicating a percentage of events generated by a respective network function indicating a procedure failure within a respective time interval out of a total number of events generated by the respective network function within the respective time interval, identify, via a time series anomaly detection algorithm implemented by the processing system, an anomaly detection result comprising at least one time interval in which at least one time series exhibits at least one anomaly, apply a query to a generative model requesting an interpretation of the anomaly detection result, where an output comprising the interpretation is generated via the generative model in response to the query, and present the output to at least one endpoint device.

First claim

What is claimed is:

1 . A method comprising:
obtaining, by a processing system including at least one processor, a plurality of time series associated with a plurality of network functions of a communication network, wherein each of the plurality of time series comprises a sequence of values over a plurality of time intervals, wherein each value of the sequence of values indicates a percentage of events generated by a respective network function of the plurality of network functions indicating a procedure failure within a respective time interval of the plurality of time intervals out of a total number of events generated by the respective network function within the respective time interval; identifying, by the processing system via a time series anomaly detection algorithm implemented by the processing system, an anomaly detection result comprising at least one time interval of the plurality of time intervals in which at least one time series of the plurality of time series exhibits at least one anomaly; applying, by the processing system, a query to a generative model requesting an interpretation of the anomaly detection result, wherein an output comprising the interpretation is generated via the generative model in response to the query; and presenting, by the processing system to at least one endpoint device, the output comprising the interpretation of the anomaly detection result.

2 . The method of claim 1 , wherein the time series anomaly detection algorithm comprises a multivariate time series anomaly detection algorithm.

3 . The method of claim 2 , wherein for each of the plurality of time series, the time series anomaly detection algorithm includes generating a residual time series by extracting trend and seasonality components.

4 . The method of claim 3 , wherein the at least one time interval is detected via the time series anomaly detection algorithm in accordance with the residual time series for the at least one time series of the plurality of time series.

5 . The method of claim 3 , wherein the at least one time interval is detected in accordance with a correlation metric among a plurality of anomalies identified in a plurality of residual time series associated with the plurality of network functions.

6 . The method of claim 1 , wherein the generative model is implemented by the processing system.

7 . The method of claim 1 , wherein the query includes a prompt.

8 . The method of claim 7 , wherein the prompt includes a description of an architecture of the communication network.

9 . The method of claim 7 , wherein the prompt includes a description of a structure of input data included in the query.

10 . The method of claim 7 , wherein the applying further comprises:
selecting one or more vectors from a vector database that are relevant to the prompt, wherein the one or more vectors comprise vectorized text from one or more data sources; and applying the one or more vectors as supplemental prompt content to the generative model.

11 . The method of claim 10 , wherein the selecting of the one or more vectors and the applying of the one or more vectors as the supplemental prompt content to the generative model comprise a retrieval augmented generation process.

12 . The method of claim 1 , wherein the query includes a plurality of records for a plurality of attributes associated with the at least one anomaly, wherein at least one record of the plurality of records includes: a time stamp, an identification of a network function associated with the at least one time series exhibiting the at least one anomaly, an identification of a procedure initiated by the network function, an identification of an attribute type, and an attribute value for the attribute type, wherein the at least one attribute value is associated with at least one of: the network function or the procedure.

13 . The method of claim 12 , wherein the attribute value is determined to be correlated with the at least one anomaly when a correlation metric exceeds a threshold, wherein the at least one record further includes the correlation metric.

14 . The method of claim 12 , wherein the plurality of records includes records associated with multiple time series of the plurality of time series exhibiting anomalies in the at least one time interval.

15 . The method of claim 14 , wherein the query requests an identification of a root cause network function from the plurality of network functions associated with the multiple time series of the plurality of time series exhibiting anomalies in the at least one time interval, wherein the output comprising the interpretation of the anomaly detection result identifies the root cause network function.

16 . The method of claim 12 , wherein the query requests an identification of a root cause procedure from among procedure failures of network functions of the plurality of network functions associated with the multiple time series of the plurality of time series exhibiting anomalies in the at least one time interval, wherein the output comprising the interpretation of the anomaly detection result identifies the root cause procedure.

17 . The method of claim 12 , wherein each of the plurality of records is associated with the network function associated with the at least one time series exhibiting the at least one anomaly.

18 . The method of claim 17 , wherein the query requests a description of a procedure failure pattern change over time for at least one network function, wherein the output indicative of the at least one anomaly includes the description of the procedure failure pattern change.

19 . A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations, the operations comprising:
obtaining a plurality of time series associated with a plurality of network functions of a communication network, wherein each of the plurality of time series comprises a sequence of values over a plurality of time intervals, wherein each value of the sequence of values indicates a percentage of events generated by a respective network function of the plurality of network functions indicating a procedure failure within a respective time interval of the plurality of time intervals out of a total number of events generated by the respective network function within the respective time interval; identifying, via a time series anomaly detection algorithm implemented by the processing system, an anomaly detection result comprising at least one time interval of the plurality of time intervals in which at least one time series of the plurality of time series exhibits at least one anomaly; applying a query to a generative model requesting an interpretation of the anomaly detection result, wherein an output comprising the interpretation is generated via the generative model in response to the query; and presenting, to at least one endpoint device, the output comprising the interpretation of the anomaly detection result.

20 . An apparatus comprising:
a processing system including at least one processor; and a computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising:
obtaining a plurality of time series associated with a plurality of network functions of a communication network, wherein each of the plurality of time series comprises a sequence of values over a p

Assignees

• At & T Ip I Lp

Inventors

• Ehrlich Willa
• Sun Li-Chuan
• Cao Lingyuan
• Kulkarni Samyukta
• Backas Elissa
• Stockert Mark
• Singh Dhruva Kumar

Classifications

• H04L43/0823

  Errors, e.g. transmission errors · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L41/064

  involving time analysis · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title