Adaptive, Anomaly Detection Based Predictor for Network Time Series Data

Patent metadata

Field	Value
Publication number	US-2016285700-A1
Application number	US-201615077762-A
Country	US
Kind code	A1
Filing date	Mar 22, 2016
Priority date	Mar 24, 2015
Publication date	Sep 29, 2016
Grant date	—

Abstract

System and method embodiments are provided for adaptive anomaly detection based predictor for network data. In an embodiment, a computer-implemented method in a network component for predicting values of future network time series data includes receiving, with one or more receivers, network time series data; determining, with one or more processors, whether an anomaly is detected in the network time series data; generating, with the one or more processors, a prediction associated with the network data according to a primary predictor when no anomaly is detected in the network time series data; generating, with the one or more processors, the prediction associated with the network data according to an alternative predictor when an anomaly in the network time series data is detected; and sending, with one or more transmitters, the prediction to a network controller, wherein the network controller uses the prediction to adjust network parameters.

First claim

What is claimed is:

1 . A computer-implemented method in a network component for predicting values of future network time series data, comprising:
receiving, with one or more receivers, network time series data; determining, with one or more processors, whether an anomaly is detected in the network time series data; generating, with the one or more processors, a prediction associated with the network data according to a primary predictor when no anomaly is detected in the network time series data; generating, with the one or more processors, the prediction associated with the network data according to an alternative predictor when an anomaly in the network time series data is detected; and sending, with one or more transmitters, the prediction to a network controller, wherein the network controller uses the prediction to adjust network parameters.

2 . The computer-implemented method of claim 1 , wherein the primary predictor is trained according to historical data.

3 . The computer-implemented method of claim 1 , the determining whether an anomaly is detected comprises comparing previous predictions determined according to the primary predictor with observed values.

4 . The computer-implemented method of claim 1 , wherein the anomaly is detected when a predicted value determined according to the primary predictor differs from an observed value by more than a threshold.

5 . The computer-implemented method of claim 1 , wherein the anomaly is detected when the number of predicted values determined according to the primary predictor that differ from corresponding observed values by more than a threshold exceeds a predefined number within a specified time period.

6 . The computer-implemented method of claim 1 , wherein the primary predictor comprises a Hidden Markov Model.

7 . The computer-implemented method of claim 1 , wherein determining whether an anomaly is detected in the network time series data comprises determining the anomaly according to a Hidden Markov Model.

8 . The computer-implemented method of claim 1 , wherein the alternative predictor comprises one of a current data predictor and a Gaussian Mixture Model (GMM).

9 . The computer-implemented method of claim 1 , wherein determining whether an anomaly is detected comprises determining a likelihood of occurrence of the observed data point.

10 . The computer-implemented method of claim 9 , wherein the anomaly is detected when the number of calculated likelihood values that fall below a threshold exceeds a predefined number within a specified time period.

11 . The computer-implemented method of claim 9 , wherein the likelihood is computed according to a Gaussian Mixture Model (GMM) model built from the historical data.

12 . The computer-implemented method of claim 11 , wherein the GMM model comprises parameters leaned from the historical data.

13 . The computer-implemented method of claim 9 , wherein the likelihood is computed according to a Hidden Markov Model (HMM) model built (i.e., parameters learned) from the historical data.

14 . The computer-implemented method of claim 13 , wherein the HMM model comprises parameters learned from the historical data.

15 . A network component comprising:
a processor; and a non-transitory computer readable storage medium storing programming for execution by the processor, the programming including instructions for:
receiving, at the network component, network time series data;
determining, with the network component, whether an anomaly is detected in the network time series data;
generating a prediction associated with the network data according to a primary predictor when no anomaly is detected in the network time series data;
generating the prediction associated with the network data according to an alternative predictor when an anomaly in the network time series data is detected; and
sending, with the network component, the prediction to a network controller, wherein the network controller uses the prediction to adjust network parameters.

16 . The network component of claim 15 , wherein the primary predictor is trained according to historical data.

17 . The network component of claim 15 , the determining whether an anomaly is detected comprises comparing previous predictions determined according to the primary predictor with observed values.

18 . The network component of claim 15 , wherein the anomaly is detected when a predicted value determined according to the primary predictor differs from an observed value by more than a threshold.

19 . The network component of claim 15 , wherein the anomaly is detected when the number of predicted values determined according to the primary predictor that differ from corresponding observed values by more than a threshold exceeds a predefined number within a specified time period.

20 . The network component of claim 15 , wherein the primary predictor comprises a Hidden Markov Model.

21 . The network component of claim 15 , wherein determining whether an anomaly is detected in the network time series data comprises determining the anomaly according to a Hidden Markov Model.

22 . The network component of claim 15 , wherein the alternative predictor comprises one of a current data predictor and a Gaussian Mixture Model (GMM).

23 . The network component of claim 15 , wherein determining whether an anomaly is detected comprises determining a likelihood of occurrence of the observed data point.

24 . The network component of claim 23 , wherein the anomaly is detected when the number of calculated likelihood values that fall below a threshold exceeds a predefined number within a specified time period.

25 . The network component of claim 23 , wherein the likelihood is computed according to a Gaussian Mixture Model (GMM) model built from the historical data.

26 . The network component of claim 25 , wherein the GMM model comprises parameters leaned from the historical data.

27 . The network component of claim 23 , wherein the likelihood is computed according to a Hidden Markov Model (HMM) model built (i.e., parameters learned) from the historical data.

28 . The network component of claim 27 , wherein the HMM model comprises parameters learned from the historical data.

29 . A non-transitory computer-readable media storing computer instructions for predicting values of future network time series data, that when executed by one or more processors, cause the one or more processors to perform the steps of:
training an adaptive anomaly detection based predictor with training data; receiving network time series data; determining whether to use a primary predictor or an alternate predictor according to whether an anomaly is detected in the network time series data; generating a prediction associated with the network data according to a primary predictor when no anomaly is detected in the network time series data; generating the prediction associated with the network data according to an alternative predictor when an anomaly in the network time series data is detected; and sending the prediction to a network controller, wherein the network controller uses the prediction to adjust network parameters.

30 . The non-transitory computer-readable media of claim 29 , wherein the step of determining whether to use a primary predictor o

Assignees

• Futurewei Technologies Inc

Inventors

• Gopalakrishnan Nandu
• Hu Yirui

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• H04L41/0823

  characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability (for optimising operational conditions of wireless networks H04W24/02) · CPC title

• H04L41/16 Primary

  using machine learning or artificial intelligence · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title

• G06N5/04

  Inference or reasoning models · CPC title