Detection and mitigation of signalling anomalies in wireless network

• US 10,602,396 B2
• Filed: 10/17/2017
• Issued: 03/24/2020
• Est. Priority Date: 10/18/2016
• Status: Active Grant

• Current Assignee: Nokia Solutions and Networks OY (Nokia Corporation)
• Original Assignee: Nokia Solutions and Networks OY (Nokia Corporation)
• Inventors: Kalliola, Aapo, Oliver, Ian Justin, Miche, Yoan Jean Claude, Holtmanns, Silke, Ali, Amaanat, Kuure, Pekka
• Primary Examiner(s): Alia, Curtis A
• Application Number:
  US15/785,915
• Publication Number:
  US 20180109975A1
• Time in Patent Office: 889 Days
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 24/04 Arrangements for maintaining operational condition
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 24/10 Scheduling measurement reports ; Arrangements for measurement reports
• CPC Class Codes: H04W 28/00 Network traffic management; Network resource management
• CPC Class Codes: H04W 28/0231 based on communication conditions dynamic wireless traffic scheduling definition based on channel quality criteria H04W72/54
• CPC Class Codes: H04W 28/0247 based on conditions of the access network or the infrastructure network central resource management H04W28/16
• CPC Class Codes: H04W 28/0284 detecting congestion or overload during communication monitoring arrangements H04L43/00
• CPC Class Codes: H04W 28/18 Negotiating wireless communication parameters

Abstract

This document discloses a solution for detecting and mitigating anomalies such as signalling storms in a radio access network of a wireless communication system. According to an aspect, there is disclosed a method including receiving, in a first local traffic analysis module, configuration parameters from a second local traffic analysis module or from a central traffic analysis module connected to a plurality of local traffic analysis modules; monitoring, by a first traffic analysis module by using the received configuration parameters, traffic in a radio access network of a wireless communication system; detecting, in the monitored traffic on the basis of the configuration parameters, an anomaly causing a control plane signalling load; and in response to said detecting, taking an action to mitigate the anomaly and reporting information on the anomaly to the central traffic analysis module.

Claims

1. A method comprising:

receiving, in connection with a first access node of a radio access network, configuration parameters in connection with a second access node of the radio access network or in connection with a mobility management entity or a gateway of a core network in connection with a plurality of access nodes of the radio access network;

monitoring, in connection with the first access node using the received configuration parameters, traffic in the radio access network;

detecting, in connection with the first access node, in the monitored traffic on the basis of the received configuration parameters, an anomaly causing a control plane signalling load;

exchanging, in connection with the first access node and in connection with a different access node of the radio access network, information regarding capacity and capability of the different access node to take extra control plane signalling;

in response to said detecting and said exchanging, taking, in connection with the first access node, an action to mitigate the anomaly and reporting, in connection with the first access node and in connection with the mobility management entity or the gateway, information on the anomaly;

identifying, in connection with the first access node, a source causing said anomaly on the basis of at least one message of the monitored traffic; and

routing, in connection with the first access node and in connection with the mobility management entity or the gateway, a plurality of messages associated with the identified source.

2. The method of claim 1, wherein said reporting comprises transmitting, in connection with the first access node and in connection with the mobility management entity or the gateway, data representing traffic that caused said detection.

3. The method of claim 1, further comprising indicating, in connection with the first access node and in connection with another access node of the radio access network, the detected anomaly.

4. The method of claim 1, wherein said action to mitigate the anomaly comprises controlling traffic of the identified source.

5. The method of claim 4, wherein said controlling the traffic of the identified source comprises at least one of:

blocking the identified source,

causing handover of the identified source from one access node of the radio access network to another access node of the radio access network,

suspending communication with the identified source,

reducing traffic volume of the identified source while allowing the identified source to cause traffic,

transmitting a message to an owner of the identified source, or

causing software or firmware update at the identified source.

6. The method of claim 1, wherein the monitoring comprises monitoring traffic in one of the plurality of access nodes.

7. An apparatus comprising:

at least one processor; and

at least one non-transitory memory including computer program code,

wherein the at least one non-transitory memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to;

receive configuration parameters in connection with a second access node of a radio access network or in connection with a mobility management entity or a gateway of a core network in connection with a plurality of access nodes of the radio access network;

monitor, using the received configuration parameters, traffic in the radio access network;

detect, in the monitored traffic on the basis of the received configuration parameters, an anomaly causing a control plane signalling load;

exchange, in connection with a different access node of the radio access network, information regarding capacity and capability of the different access node to take extra control plane signalling;

in response to said detection and said exchange, take an action to mitigate the anomaly and report, in connection with the mobility management entity or the gateway, information on the anomaly;

identify a source causing said anomaly on the basis of at least one message of the monitored traffic; and

route, in connection with the mobility management entity or the gateway, a plurality of messages associated with the identified source.

8. An apparatus according to claim 7, wherein said reporting comprises causing the apparatus to transmit, in connection with the mobility management entity or the gateway, data representing traffic that caused said detection.

9. An apparatus according to claim 7, further configured to indicate, in connection with another access node of the radio access network, the detected anomaly.

10. An apparatus according to claim 7, wherein said action to mitigate the anomaly comprises causing the apparatus to control traffic of the identified source.

11. An apparatus according to claim 7, wherein the monitoring comprises monitoring traffic in one of the plurality of access nodes.

12. A computer program product embodied on a non-transitory distribution medium readable by a computer and comprising program instructions which, when loaded into an apparatus and executed on at least one processor, cause the apparatus at least to:

receive configuration parameters in connection with a second access node of a radio access network or in connection with a mobility management entity or a gateway of a core network in connection with a plurality of access nodes of the radio access network;

monitor, using the received configuration parameters, traffic in the radio access network;

detect, in the monitored traffic on the basis of the received configuration parameters, an anomaly causing a control plane signalling load;

exchange, in connection with a different access node of the radio access network, information regarding capacity and capability of the different access node to take extra control plane signalling;

in response to said detection and said exchange, take an action to mitigate the anomaly and report, in connection with the mobility management entity or the gateway, information on the anomaly;

identify a source causing said anomaly on the basis of at least one message of the monitored traffic; and

route, in connection with the mobility management entity or the gateway, a plurality of messages associated with the identified source.

13. A computer program product according to claim 12, wherein said reporting comprises causing the apparatus to transmit, in connection with the mobility management entity or the gateway, data representing traffic that caused said detection.

14. A computer program product according to claim 12, where the program instructions are further configured to cause the apparatus to indicate, in connection with another access node of the radio access network, the detected anomaly.

15. A computer program product according to claim 12, wherein said action to mitigate the anomaly comprises causing the apparatus to control traffic of the identified source.

16. A computer program product according to claim 15, wherein said causing the apparatus to control the traffic of the identified source comprises at least one of:

block the identified source,

cause handover of the identified source from one access node of the radio access network to another access node of the radio access network,

suspend communication with the identified source,

reduce traffic volume of the identified source while allowing the identified source to cause traffic,

transmit a message to an owner of the identified source, or

cause software or firmware update at the identified source.

17. A computer program product according to claim 12, wherein the monitoring comprises monitoring traffic in one of the plurality of access nodes.