ANOMALY DETECTION METHOD AND SYSTEM AND MAINTENANCE METHOD AND SYSTEM

• US 20090052330A1
• Filed: 06/02/2006
• Published: 02/26/2009
• Est. Priority Date: 06/02/2005
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Takeuchi, Junichi, Nakata, Takayuki, Matsunaga, Yasuhiko
• Granted Patent: US 8,611,228 B2
• Time in Patent Office: Days
• US Class Current: 370/242
• CPC Class Codes: H04L 1/0019 in which mode-switching is based on a statistical approach

Abstract

A network management apparatus in a mobile communication network holds a communication quality index in a normal operation and periodically receives input of a communication quality measurement result from a radio base station control apparatus. When a connection failure count f with respect to a connection request count a of each radio cell is obtained as a measurement result, letting p₀ be the call loss rate in the normal operation, an upper probability B of a binomial distribution representing the connection failure count becomes larger than f is obtained (step 524). The negative logarithm of the upper probability B is obtained as the score of the degree of abnormality (step 525). Anomaly of communication is detected when the score of the degree of abnormality exceeds a predetermined threshold value (steps 526 and 527). After that, maintenance control is executed in accordance with the calculated score of the degree of abnormality, thereby appropriately avoiding a fault of the communication system. This allows to calculate the degree of abnormality from the measurement result of the communication quality index in the mobile communication network in consideration of the statistical reliability and execute maintenance corresponding to the degree of abnormality.

Claims

1. An anomaly detection method characterized by comprising the steps of:

obtaining, on the basis of a probability distribution of a communication quality index in a normal operation of a communication network, an upper probability that the communication quality index during a measurement period becomes lower than a measured value; and

detecting anomaly of the communication network by using the value of the obtained upper probability.

2. An anomaly detection method according to claim 1, characterized in that the obtaining step comprises the step of, when an average failure ratio p₀ of communication in the normal operation of the communication network is given in the communication network which uses a failure ratio of communication attempt as the communication quality index, obtaining, on the basis of a communication attempt count a during the measurement period and a communication failure count f during the measurement period, an upper probability B(a,f,p₀) of a binomial distribution representing that the failure count is not less than f.

3. An anomaly detection method according to claim 1, characterized in that the obtaining step comprises the step of, when an average value q₀ of an index and a dispersion q_v of the index in the normal operation of the communication network are given in the communication network which uses continuous values containing an average transfer delay amount as the communication quality index, obtaining, on the basis of a measurement count e during the measurement period and an average value d of the measured communication quality index, an upper probability N(d,q₀,q_v/e) of a normal distribution representing that the communication quality index is less than the average value d.

4. An anomaly detection method according to claim 1, characterized by further comprising the step of measuring the communication quality index for each subscriber group in a communication network having a plurality of subscriber groups with different target values of communication quality to be provided,

wherein the obtaining step comprises the step of obtaining the upper probability for each subscriber group, and

the detecting step comprises the step of detecting degradation in communication quality for each subscriber group by using the value of the obtained upper probability.

5. An anomaly detection method according to claim 1, characterized in that

the obtaining step comprises the steps of:

obtaining a score of a degree of abnormality for each of a plurality of communication quality indices on the basis of the upper probability; and

executing weighted addition of the scores of the degree of abnormality for the respective communication quality indices, and

the detecting step comprises the step of detecting anomaly of the communication network on the basis of a result of weighted addition.

6. An anomaly detection method according to claim 1, characterized in that

the obtaining step comprises the step of obtaining a score of a time series degree of abnormality from the communication quality index which is measured a plurality of number of times at a predetermined interval, and

the detecting step comprises the steps of:

estimating a coefficient when obtained time series data is applied to an autoregressive model; and

determining the communication network as abnormal when the estimated coefficient does not satisfy a steady condition of the autoregressive model.

7. An anomaly detection method according to claim 1, characterized by further comprising the steps of:

causing a mobile terminal in a mobile communication network to measure the communication quality index and periodically transmit a measurement result to a server which manages communication quality; and

causing the server to totalize the measurement result of the communication quality index for subscriber groups with the same target value of communication quality to be provided,

wherein the obtaining step comprises the step of causing the server to obtain a score of a degree of abnormality on the basis of the upper probability, and

the detecting step comprises the step of causing the server to detect degradation in communication quality for each subscriber group in accordance with the obtained score of the degree of abnormality.

8. An anomaly detection method according to claim 1, characterized in that in the obtaining step, at least one of a connection failure count with respect to a connection request count, a handover failure count with respect to a handover request count, a packet transfer throughput, a packet transfer delay, and a packet loss ratio which are measured for each radio cell of the communication network is used as the communication quality index.

9. A maintenance method characterized by comprising the steps of:

obtaining, on the basis of a probability distribution of a communication quality index in a normal operation of a communication network, an upper probability that the communication quality index during a measurement period becomes lower than a measured value;

obtaining a score of a degree of abnormality on the basis of the obtained upper probability; and

improving communication quality by changing a network operation parameter related to the communication quality index to generate negative feedback to the score of the degree of abnormality.

10. A maintenance method according to claim 9, characterized in that the upper probability obtaining step comprises the step of, when an average failure ratio p₀ of communication in the normal operation of the communication network is given in the communication network which uses a failure ratio of communication attempt as the communication quality index, obtaining, on the basis of a communication attempt count a during the measurement period and a communication failure count f during the measurement period, an upper probability B(a,f,p₀) of a binomial distribution representing that the failure count is not less than f.

11. A maintenance method according to claim 9, characterized in that the upper probability obtaining step comprises the step of, when an average value q₀ of an index and a dispersion q_v of the index in the normal operation of the communication network are given in the communication network which uses continuous values containing an average transfer delay amount as the communication quality index, obtaining, on the basis of a measurement count e during the measurement period and an average value d of the measured communication quality index, an upper probability N(d,q₀,q_v/e) of a normal distribution representing that the communication quality index is less than the average value d.

12. A maintenance method according to claim 9, characterized in that in the score obtaining step, a score of a time series degree of abnormality is obtained from the communication quality index which is measured a plurality of number of times at a predetermined interval, and

the improving step comprises the steps of:

estimating a coefficient when obtained time series data is applied to an autoregressive model;

predicting the score of the degree of abnormality at a next measurement time by using the estimated coefficient; and

changing the network operation parameter by using the predicted value of the score of the degree of abnormality to generate negative feedback to the score of the degree of abnormality.

13. A maintenance method according to claim 9, characterized by further comprising the steps of:

causing a mobile terminal in a mobile communication network to measure the communication quality index and periodically transmit a measurement result to a server which manages communication quality;

causing the server to totalize the measurement result of the communication quality index for subscriber groups with the same target value of communication quality to be provided; and

causing the server to detect degradation in communication quality for each subscriber group in accordance with the obtained score of the degree of abnormality,

wherein in the improving step, the server improves the communication quality for each subscriber group by changing the network operation parameter.

14. A maintenance method according to claim 9, characterized in that in the improving step, the network operation parameter including at least one of a pilot channel transmission power of a radio base station, an outer loop transmission power of downlink data transmitted from a radio base station to a mobile terminal, an outer loop transmission power of uplink data transmitted from a mobile terminal to a radio base station, a call reception control threshold value to be referred to in call connection or handover of a mobile terminal, a radio link addition threshold value reception power referred to by a mobile terminal in handover, a radio link deletion threshold value reception power, and a radio link replacement threshold value reception power is changed to generate negative feedback to the score of the degree of abnormality.

15. An anomaly detection system characterized by comprising:

storage means for storing a probability distribution of a communication quality index in a normal operation of a communication network; and

degree-of-abnormality calculation means for obtaining, on the basis of the probability distribution stored in said storage means, an upper probability that the communication quality index during a measurement period becomes lower than a measured value, and detecting anomaly of the communication network by using the value of the upper probability.

16. An anomaly detection system according to claim 15, characterized in that

said storage means stores an average failure ratio p₀ of communication in the normal operation of the communication network in the communication network which uses a failure ratio of communication attempt as the communication quality index, and

said degree-of-abnormality calculation means obtains, on the basis of a communication attempt count a during the measurement period and a communication failure count f during the measurement period, an upper probability B(a,f,p₀) of a binomial distribution representing that the failure count is not less than f.

17. An anomaly detection system according to claim 15, characterized in that

said storage means stores an average value q₀ of an index and a dispersion q_v of the index in the normal operation of the communication network in the communication network which uses continuous values containing an average transfer delay amount as the communication quality index, and

said degree-of-abnormality calculation means obtains, on the basis of a measurement count e during the measurement period and an average value d of the measured communication quality index, an upper probability N(d,q₀,q_v/e) of a normal distribution representing that the communication quality index is less than the average value d.

18. An anomaly detection system according to claim 15, characterized by further comprising communication quality monitoring means for measuring the communication quality index for each subscriber group in a communication network having a plurality of subscriber groups with different target values of communication quality to be provided,

wherein said degree-of-abnormality calculation means obtains the upper probability for each subscriber group and detects degradation in communication quality for each subscriber group by using the value of the upper probability.

19. An anomaly detection system according to claim 15, characterized in that said degree-of-abnormality calculation means obtains a score of a degree of abnormality for each of a plurality of communication quality indices on the basis of the upper probability and detects anomaly of the communication network by weighted addition of the scores of the degree of abnormality for the respective communication quality indices.

20. An anomaly detection system according to claim 15, characterized in that said degree-of-abnormality calculation means obtains a score of a time series degree of abnormality from the communication quality index which is measured a plurality of number of times at a predetermined interval, estimates a coefficient when obtained time series data is applied to an autoregressive model, and determines the communication network as abnormal when the estimated coefficient does not satisfy a steady condition of the autoregressive model.

21. An anomaly detection system according to claim 15, characterized by further comprising:

a mobile terminal and a server which manages communication quality,

wherein said mobile terminal measures the communication quality index and periodically transmits a measurement result to said server,

said server comprises;

communication quality monitoring means for totalizing the measurement result of the communication quality index for subscriber groups with the same target value of communication quality to be provided; and

said storage means and said degree-of-abnormality calculation means, and

said degree-of-abnormality calculation means obtains a score of a degree of abnormality on the basis of the upper probability and detects degradation in communication quality for each subscriber group in accordance with the score of the degree of abnormality.

22. An anomaly detection system according to claim 15, characterized in that said degree-of-abnormality calculation means uses, as the communication quality index, at least one of a connection failure count with respect to a connection request count, a handover failure count with respect to a handover request count, a packet transfer throughput, a packet transfer delay, and a packet loss ratio which are measured for each radio cell of the communication network.

23. A maintenance system characterized by comprising:

storage means for storing a probability distribution of a communication quality index in a normal operation of a communication network; and

degree-of-abnormality calculation means for obtaining, on the basis of the probability distribution stored in said storage means, an upper probability that the communication quality index during a measurement period becomes lower than a measured value, obtaining a score of a degree of abnormality on the basis of the upper probability, and improving communication quality by changing a network operation parameter related to the communication quality index to generate negative feedback to the score of the degree of abnormality.

24. A maintenance system according to claim 23, characterized in that

said storage means stores an average failure ratio p₀ of communication in the normal operation of the communication network in the communication network which uses a failure ratio of communication attempt as the communication quality index, and

said degree-of-abnormality calculation means obtains, on the basis of a communication attempt count a during the measurement period and a communication failure count f during the measurement period, an upper probability B(a,f,p₀) of a binomial distribution representing that the failure count is not less than f.

25. A maintenance system according to claim 23, characterized in that

said storage means stores an average value q₀ of an index and a dispersion q_v of the index in the normal operation of the communication network in the communication network which uses continuous values containing an average transfer delay amount as the communication quality index, and

said degree-of-abnormality calculation means obtains, on the basis of a measurement count e during the measurement period and an average value d of the measured communication quality index, an upper probability N(d,q₀,q_v/e) of a normal distribution representing that the communication quality index is less than the average value d.

26. A maintenance system according to claim 23, characterized in that said degree-of-abnormality calculation means obtains a score of a time series degree of abnormality from the communication quality index which is measured a plurality of number of times at a predetermined interval, estimates a coefficient when obtained time series data is applied to an autoregressive model, predicts the score of the degree of abnormality at a next measurement time by using the estimated coefficient, and changes the network operation parameter by using the predicted value of the score of the degree of abnormality to generate negative feedback to the score of the degree of abnormality.

27. A maintenance system according to claim 23, characterized by further comprising:

a mobile terminal and a server which manages communication quality,

wherein said mobile terminal measures the communication quality index and periodically transmits a measurement result to said server,

said server comprises;

communication quality monitoring means for totalizing the measurement result of the communication quality index for subscriber groups with the same target value of communication quality to be provided; and

said storage means and said degree-of-abnormality calculation means, and

said degree-of-abnormality calculation means obtains a score of a degree of abnormality on the basis of the upper probability, detects degradation in communication quality for each subscriber group in accordance with the score of the degree of abnormality, and improves the communication quality for each subscriber group by changing the network operation parameter to generate negative feedback to the score of the degree of abnormality.

28. A maintenance system according to claim 23, characterized in that said degree-of-abnormality calculation means changes the network operation parameter including at least one of a pilot channel transmission power of a radio base station, an outer loop transmission power of downlink data transmitted from a radio base station to a mobile terminal, an outer loop transmission power of uplink data transmitted from a mobile terminal to a radio base station, a call reception control threshold value to be referred to in call connection or handover of a mobile terminal, a radio link addition threshold value reception power referred to by a mobile terminal in handover, a radio link deletion threshold value reception power, and a radio link replacement threshold value reception power to generate negative feedback to the score of the degree of abnormality.

29. A network management apparatus characterized by comprising:

first storage means for storing a probability distribution of a communication quality index in a normal operation of a communication network;

second storage means for storing the communication quality index during a measurement period; and

degree-of-abnormality calculation means for obtaining, on the basis of the probability distribution stored in said first storage means and the communication quality index stored in said second storage means, an upper probability that the communication quality index during the measurement period becomes lower than a measured value, and detecting anomaly of the communication network by using the value of the upper probability.

30. A network management apparatus according to claim 29, characterized in that

said first storage means stores an average failure ratio p₀ of communication in the normal operation of the communication network in the communication network which uses a failure ratio of communication attempt as the communication quality index,

said second storage means stores a communication attempt count a during the measurement period and a communication failure count f during the measurement period, and

said degree-of-abnormality calculation means obtains, on the basis of the stored average failure ratio p₀, attempt count a, and failure count f, an upper probability B(a,f,p₀) of a binomial distribution representing that the failure count is not less than f.

31. A network management apparatus according to claim 29, characterized in that

said first storage means stores an average value q₀ of an index and a dispersion q_v of the index in the normal operation of the communication network in the communication network which uses continuous values containing an average transfer delay amount as the communication quality index,

said second storage means stores a measurement count e during the measurement period and an average value d of the measured communication quality index, and

said degree-of-abnormality calculation means obtains, on the basis of the stored average value q₀, dispersion q_v, measurement count e, and average value d, an upper probability N(d,q₀,q_v/e) of a normal distribution representing that the communication quality index is less than the average value d.

32. A program characterized by causing a computer to implement:

first storage means for storing a probability distribution of a communication quality index in a normal operation of a communication network;

second storage means for storing the communication quality index during a measurement period; and

degree-of-abnormality calculation means for obtaining, on the basis of the probability distribution stored in said first storage means and the communication quality index stored in said second storage means, an upper probability that the communication quality index during the measurement period becomes lower than a measured value, and detecting anomaly of the communication network by using the value of the upper probability.

33. A program according to claim 32, characterized in that

said first storage means stores an average failure ratio p₀ of communication in the normal operation of the communication network in the communication network which uses a failure ratio of communication attempt as the communication quality index,

said second storage means stores a communication attempt count a during the measurement period and a communication failure count f during the measurement period, and

said degree-of-abnormality calculation means obtains, on the basis of the stored average failure ratio p₀, attempt count a, and failure count f, an upper probability B(a,f,p₀) of a binomial distribution representing that the failure count is not less than f.

34. A program according to claim 32, characterized in that

said first storage means stores an average value q₀ of an index and a dispersion q_v of the index in the normal operation of the communication network in the communication network which uses continuous values containing an average transfer delay amount as the communication quality index,

said second storage means stores a measurement count e during the measurement period and an average value d of the measured communication quality index, and

said degree-of-abnormality calculation means obtains, on the basis of the stored average value q₀, dispersion q_v, measurement count e, and average value d, an upper probability N(d,q₀,q_v/e) of a normal distribution representing that the communication quality index is less than the average value d.

35. A communication quality monitoring apparatus characterized by comprising:

first storage means for storing a probability distribution of a communication quality index in a normal operation of a mobile communication network;

second storage means for storing the communication quality index during a measurement period in correspondence with each mobile terminal, the communication quality index being periodically transmitted from each mobile terminal; and

degree-of-abnormality calculation means for obtaining, in correspondence with each mobile terminal on the basis of the probability distribution stored in said first storage means and the communication quality index stored in said second storage means, an upper probability that the communication quality index during the measurement period becomes lower than a measured value, and detecting degradation in communication quality by using the value of the upper probability in correspondence with each mobile terminal.

36. A communication quality monitoring apparatus according to claim 35, characterized in that

said first storage means stores, in correspondence with each mobile terminal, an average failure ratio p₀ of communication in the normal operation of the mobile communication network in the mobile communication network which uses a failure ratio of communication attempt as the communication quality index,

said second storage means stores a communication attempt count a during the measurement period and a communication failure count f during the measurement period in correspondence with each mobile terminal, the attempt count a and the failure count f being periodically transmitted from each mobile terminal, and

said degree-of-abnormality calculation means obtains, in correspondence with each mobile terminal on the basis of the stored average failure ratio p₀, attempt count a, and failure count f, an upper probability B(a,f,p₀) of a binomial distribution representing that the failure count is not less than f.

37. A communication quality monitoring apparatus according to claim 35, characterized in that

said first storage means stores, in correspondence with each mobile terminal, an average value q₀ of an index and a dispersion q_v of the index in the normal operation of the mobile communication network in the mobile communication network which uses continuous values containing an average transfer delay amount as the communication quality index,

said second storage means stores a measurement count e during the measurement period and an average value d of the measured communication quality index in correspondence with each mobile terminal, the measurement count e and the average value d being periodically transmitted from each mobile terminal, and

said degree-of-abnormality calculation means obtains, in correspondence with each mobile terminal on the basis of the stored average value q₀, dispersion q_v, measurement count e, and average value d, an upper probability N(d,q₀,q_v/e) of a normal distribution representing that the communication quality index is less than the average value d.

38. A program characterized by causing a computer to implement:

first storage means for storing a probability distribution of a communication quality index in a normal operation of a mobile communication network;

second storage means for storing the communication quality index during a measurement period in correspondence with each mobile terminal, the communication quality index being periodically transmitted from each mobile terminal; and

degree-of-abnormality calculation means for obtaining, in correspondence with each mobile terminal on the basis of the probability distribution stored in said first storage means and the communication quality index stored in said second storage means, an upper probability that the communication quality index during the measurement period becomes lower than a measured value, and detecting degradation in communication quality by using the value of the upper probability in correspondence with each mobile terminal.

39. A program according to claim 38, characterized in that

said first storage means stores, in correspondence with each mobile terminal, an average failure ratio p₀ of communication in the normal operation of the mobile communication network in the mobile communication network which uses a failure ratio of communication attempt as the communication quality index,

said second storage means stores a communication attempt count a during the measurement period and a communication failure count f during the measurement period in correspondence with each mobile terminal, the attempt count a and the failure count f being periodically transmitted from each mobile terminal, and

said degree-of-abnormality calculation means obtains, in correspondence with each mobile terminal on the basis of the stored average failure ratio p₀, attempt count a, and failure count f, an upper probability B(a,f,p₀) of a binomial distribution representing that the failure count is not less than f.

40. A program according to claim 38, characterized in that

said first storage means stores, in correspondence with each mobile terminal, an average value q₀ of an index and a dispersion q_v of the index in the normal operation of the mobile communication network in the mobile communication network which uses continuous values containing an average transfer delay amount as the communication quality index,

said second storage means stores a measurement count e during the measurement period and an average value d of the measured communication quality index in correspondence with each mobile terminal, the measurement count e and the average value d being periodically transmitted from each mobile terminal, and

said degree-of-abnormality calculation means obtains, in correspondence with each mobile terminal on the basis of the stored average value q₀, dispersion q_v, measurement count e, and average value d, an upper probability N(d,q₀,q_v/e) of a normal distribution representing that the communication quality index is less than the average value d.