Cross-layer automated fault tracking and anomaly detection

Patent metadata

Field	Value
Publication number	US-2022014422-A1
Application number	US-202117483285-A
Country	US
Kind code	A1
Filing date	Sep 23, 2021
Priority date	Sep 23, 2021
Publication date	Jan 13, 2022
Grant date	—

Abstract

Systems and techniques for cross-layer automated fault tracking and anomaly detection are described herein. Anomaly data may be obtained from a plurality of layers of a network. Elements of the anomaly data may be identified that correspond to a data flow of an application executing on the network. An artificial intelligence model may be trained using the elements of the anomaly data to generate an impact score for the application. The impact score may be generated for the application by evaluating current network metrics using the artificial intelligence model. An operational component of the network may be modified based on the impact score.

First claim

What is claimed is:

1 . A system for multi-layer anomaly detection and reporting comprising:
at least one processor; and memory including instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:
obtain anomaly data from a plurality of layers of a network;
identify elements of the anomaly data for flows that correspond to an application executing on the network;
train an artificial intelligence model using the elements of the anomaly data to generate an impact score for the application;
generate the impact score for the application by evaluating current network metrics using the artificial intelligence model; and
modify an operational component of the network based on the impact score.

2 . The system of claim 1 , wherein the plurality of layers includes at last one of a physical layer, a data link layer, a network layer, a transport layer, a session layer, a presentation layer, or a radio access technology layer.

3 . The system of claim 1 , wherein the anomaly data is obtained from one or more data collectors operating in the plurality of layers.

4 . The system of claim 1 , wherein the anomaly data includes a data flow and the instructions to identify the elements further comprises instructions to:
determine an endpoint of the data flow of the application; determine a source of the data flow of the application; and identify the elements as portions of the data flow flowing between the endpoint and the source.

5 . The system of claim 1 , wherein the artificial intelligence model is a graph model and the instructions to train the artificial intelligence model includes instructions to generate the graph model including nodes and edges that connect the nodes, wherein the instructions to generate the impact score include instructions to traverse the edges and nodes of the graph model to calculate the impact score.

6 . The system of claim 1 , wherein the instructions to modify the operational component includes instructions to alter a network path of the application.

7 . The system of claim 1 , wherein the instructions to modify the operational component includes instructions to alter a resource assignment for the application on a node of the network.

8 . The system of claim 1 , wherein the anomaly data includes anomaly predictions for each layer of the plurality of layers, and wherein the instructions to train the artificial intelligence model further comprises instructions to:
apply weights to the anomaly predictions from the plurality of layers; and generate the artificial intelligence model using the weighted anomaly predictions.

9 . The system of claim 1 , the memory further comprising instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:
identify current data flows of the application; select a data flow of the current data flows based on the anomaly data; and obtain the current network metrics from components of the network associated with the data flow.

10 . The system of claim 1 , the memory further comprising instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:
transmit the impact score to an orchestration layer of the network; receive a remediation directive from an orchestrator of the orchestration layer; and modify the operational component based at least in part on the remediation directive.

11 . At least one machine-readable medium including instructions for multi-layer anomaly detection and reporting that, when executed by at least one processor, cause the at least one processor to perform operations to:
obtain anomaly data from a plurality of layers of a network; identify elements of the anomaly data for flows that correspond to an application executing on the network; train an artificial intelligence model using the elements of the anomaly data to generate an impact score for the application; generate the impact score for the application by evaluating current network metrics using the artificial intelligence model; and modify an operational component of the network based on the impact score.

12 . The at least one machine-readable medium of claim 11 , wherein the anomaly data includes a data flow and the instructions to identify the elements further comprises instructions to:
determine an endpoint of the data flow of the application; determine a source of the data flow of the application; and identify the elements as portions of the data flow flowing between the endpoint and the source.

13 . The at least one machine-readable medium of claim 11 , wherein the impact score represents a relative impact of the anomaly on the application compared to an impact of the anomaly on other applications.

14 . The at least one machine-readable medium of claim 11 , wherein the anomaly data includes anomaly predictions for each layer of the plurality of layers, and wherein the instructions to train the artificial intelligence model further comprises instructions to:
apply weights to the anomaly predictions from the plurality of layers; and generate the artificial intelligence model using the weighted anomaly predictions.

15 . The at least one machine-readable medium of claim 11 , wherein an anomaly associated with the anomaly data is a radio access transmission error.

16 . The at least one machine-readable medium of claim 11 , further comprising instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:
identify current data flows of the application; select a data flow of the current data flows based on the anomaly data; and obtain the current network metrics from components of the network associated with the data flow.

17 . The at least one machine-readable medium of claim 11 , further comprising instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:
transmit the impact score to an orchestration layer of the network; receive a remediation directive from an orchestrator of the orchestration layer; and modify the operational component based at least in part on the remediation directive.

18 . A method for multi-layer anomaly detection and reporting comprising:
obtaining anomaly data from a plurality of layers of a network; identifying elements of the anomaly data for flows that correspond to an application executing on the network; training an artificial intelligence model using the elements of the anomaly data to generate an impact score for the application; generating the impact score for the application by evaluating current network metrics using the artificial intelligence model; and modifying an operational component of the network based on the impact score.

19 . The method of claim 18 , wherein the anomaly data includes a data flow and identifying the elements further comprises:
determining an endpoint of the data flow of the application; determining a source of the data flow of the application; and identifying the elements as portions of the data flow flowing between the endpoint and the source.

20 . The method of claim 18 , wherein modifying the operational component includes altering a network path of the application.

21 . The method of claim 18 , wherein modifying the operational component includes altering a resource assignment for the application on a node

Assignees

• Gupta Hyde Maruti
• Zhang Yi
• Maciocco Christian
• Bachmutsky Alexander
• Jha Satish Chandra
• Alam S M Iftekharul
• Himayat Nageen
• Balakrishnan Ravikumar
• Sharma Banjade Vesh Raj
• Doshi Kshitij Arun
• Guim Bernat Francesc
• Srivastava Amar
• Srikanteswara Srikathyayani

Inventors

• Gupta Hyde Maruti
• Zhang Yi
• Maciocco Christian
• Bachmutsky Alexander
• Jha Satish Chandra
• Alam S M Iftekharul
• Himayat Nageen
• Balakrishnan Ravikumar
• Sharma Banjade Vesh Raj
• Doshi Kshitij Arun
• Guim Bernat Francesc
• Srivastava Amar
• Srikanteswara Srikathyayani

Classifications

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/147

  for predicting network behaviour · CPC title

• H04L41/149

  for prediction of maintenance · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title