Anomaly detection apparatus, method, and computer program using a probabilistic latent semantic analysis

• US 10,255,554 B2
• Filed: 07/28/2015
• Issued: 04/09/2019
• Est. Priority Date: 07/28/2015
• Status: Active Grant

• Current Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Inventors: Gopalakrishnan, Nandu, Hu, Yirui
• Primary Examiner(s): Gonzales, Vincent
• Application Number:
  US14/811,750
• Publication Number:
  US 20170032266A1
• Time in Patent Office: 1,351 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks

Abstract

An anomaly detection apparatus, method, and computer program product are provided using a probabilistic latent semantic analysis (PLSA). In use, data is received, and a PLSA is performed, based on the data. Further, one or more anomalies are detected in the data, based on the PLSA. Still yet, information identifying the one or more anomalies is stored and/or displayed.

Claims

1. A computer program product embodied on a non-transitory computer readable medium, comprising:

code for receiving first measurement data of a plurality of variables, the first measurement data being obtained based on data samples that are collected in a wireless network during a first period of time, and the data samples comprising traffic data communicated in the wireless network or network performance data of the wireless network, wherein the wireless network comprises a plurality of communication nodes;

code for performing a probabilistic latent semantic analysis on the first measurement data utilizing at least one processor to cluster the data samples into different clusters based on the first measurement data of the plurality of variables, each of the different clusters being associated with a time stamp or a communication node;

code for receiving second measurement data of the plurality of variables, the second measurement data being obtained from one or more data samples that are collected during a second period of time, wherein each of the second measurement data of the plurality of variables is associated with a corresponding time stamp or a corresponding communication node;

code for detecting whether there is an anomaly in the one or more data samples based on the second measurement data, the different clusters, and time stamps or communication nodes associated with the different clusters;

code for displaying information on the anomaly; and

code for identifying an anomaly of the wireless network with respect to the plurality of variables based on the anomaly detected in the one or more data samples.

2. The computer program product of claim 1, wherein the computer program product is configured such that the probabilistic latent semantic analysis includes a Gaussian probabilistic latent semantic analysis.

3. The computer program product of claim 1, wherein the computer program product is configured such that the data samples are received in connection with at least one of a cellular network, one or more base stations, or one or more user devices.

4. The computer program product of claim 1, wherein the computer program product is configured such that the data samples are received in connection with one or more radio network controllers.

5. The computer program product of claim 1, wherein the computer program product is configured such that one or more first variables associated with the data samples are mapped to one or more second variables associated with the probabilistic latent semantic analysis.

6. The computer program product of claim 5, wherein the computer program product is configured such that the one or more first variables include a time variable.

7. The computer program product of claim 5, wherein the computer program product is configured such that the one or more first variables include a space variable.

8. The computer program product of claim 5, wherein the computer program product is configured such that the one or more first variables include a network node or user equipment variable.

9. The computer program product of claim 5, wherein the computer program product is configured such that the one or more first variables include a key performance indicator variable.

10. The computer program product of claim 5, wherein the computer program product is configured such that the one or more first variables include a key quality indicator variable.

11. The computer program product of claim 5, wherein the computer program product is configured such that the one or more first variables include a network resource variable.

12. The computer program product of claim 5, wherein the computer program product is configured such that the one or more first variables include a network traffic variable.

13. The computer program product of claim 5, wherein the computer program product is configured such that the one or more first variables include a location variable.

14. The computer program product of claim 5, wherein the computer program product is configured such that the one or more second variables include co-occurrence variables.

15. The computer program product of claim 5, wherein the computer program product is configured such that the one or more second variables include a cluster variable.

16. The computer program product of claim 1, and further comprising:

code for setting one or more thresholds.

17. The computer program product of claim 16, and further comprising:

code for identifying potential anomalies based on the one or more thresholds.

18. The computer program product of claim 16, and further comprising:

code for confirming one or more potential anomalies to be anomalies based a time in which the one or more potential anomalies persists.

19. A method, comprising:

receiving first measurement data of a plurality of variables, the first measurement data being obtained based on data samples that are collected in a wireless network during a first period of time, and the data samples comprising traffic data communicated in the wireless network or network performance data of the wireless network, wherein the wireless network comprises a plurality of communication nodes;

performing a probabilistic latent semantic analysis on the first measurement data, utilizing at least one processor to cluster the data samples into different clusters based on the first measurement data of the plurality of variables, each of the different clusters being associated with a time stamp or a communication node;

receiving second measurement data of the plurality of variables, the second measurement data being obtained from one or more data samples that are collected during a second period of time, wherein each of the second measurement data of the plurality of variables is associated with a corresponding time stamp or a corresponding communication node;

detecting whether there is an anomaly in the one or more data samples based on the second measurement data, the different clusters, and time stamps or communication nodes associated with the different clusters, utilizing the at least one processor;

identifying a performance anomaly of the wireless network with respect to the plurality of variables based on the anomaly detected in the one or more data samples; and

storing information identifying the anomaly, utilizing memory in communication with the at least one processor.

20. An apparatus, comprising:

a non-transitory memory storage comprising instructions; and

one or more processors in communication with the memory storage, wherein the one or more processors execute the instructions to;

receive first measurement data of a plurality of variables, the first measurement data being obtained based on data samples that are collected in a wireless network during a first period of time, and the data samples comprising traffic data communicated in the wireless network or network performance data of the wireless network, wherein the wireless network comprises a plurality of communication nodes;

perform probabilistic latent semantic analysis on the first measurement data to cluster the data samples into different clusters based on the first measurement data of the plurality of variables, each of the different clusters being associated with a time stamp or a communication node;

receive second measurement data of the plurality of variables, the second measurement data being obtained from one or more data samples that are collected during a second period of time, wherein each of the second measurement data of the plurality of variables is associated with a corresponding time stamp or a corresponding communication node;

detect whether there is an anomaly in the one or more data samples based on the second measurement data, the different clusters, and time stamps or communication nodes associated with the different clusters;

cause output of information identifying the anomaly; and

identify an anomaly of the wireless network with respect to the plurality of variables based on the anomaly detected in the one or more data samples.