System, Method and Computer Program Product for Identification of Anomalies in Performance Indicators of Telecom Systems

• US 20150134622A1
• Filed: 11/06/2014
• Published: 05/14/2015
• Est. Priority Date: 11/06/2013
• Status: Active Grant

• Current Assignee: Teoco Ltd.
• Original Assignee: TEOCO
• Inventors: Ebel, Shachar, Stein, Yuval, Pridor, Adir, Virtser, Alexander
• Granted Patent: US 10,860,570 B2
• Time in Patent Office: Days
• US Class Current: 707/690
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: H04L 67/30 Profiles

Abstract

A system and method for identifying anomalies in indicators, such as key performance indicators (KPIs) of a telecom system are disclosed. The method can learn over time behavior of the indicator and can statistically identify what should be considered anomalous. Learning can be performed on a per indicator basis that each presents different statistical qualities. The method can associate the indicator to a profile, such as one of several statistical distributions and can operate accordingly. Association may be determined by the correlation of the indicator to statistical distribution. The method can identify correlations between indicators when identifying the statistical distribution and especially when the associated statistical distribution is an unidentified profile. The method can include comparison of actuals versus prediction and sending alerts when anomalies are found. The system can be configured to receive data points respective of indicators and implement the method while continuously determining data points constituting anomalies.

Claims

1. A computer-implemented method of classification of an indicator respective of a data series comprising:

receiving, by at least one computer processor, from at least a source of information, at least the data series respective of the indicator measured by the at least a source of information;

determining, by the at least one computer processor, for the indicator respective of the at least a data series, a profile from a plurality of possible profiles;

associating, by the at least one computer processor, the indicator with the respective profile; and

storing, by the at least one computer processor, the associated profile with the respective indicator.

2. The computer-implemented method of claim 1, wherein the profile is one of:

a distribution profile,

a behavioral profile, or

an unidentified profile.

3. The computer-implemented method of claim 2, wherein the profile is a distribution, and wherein the distribution is one of:

normal;

Poisson, or

unidentified.

4. The computer-implemented method of claim 2, wherein the profile is a distribution profile and further comprising:

determining, by the at least one computer processor, at least a first parameter respective of the distribution profile and respective of the at least a data series.

5. The computer-implemented method of claim 4, further comprising:

determining a threshold respective of the at least a first parameter.

6. The computer-implemented method of claim 3, further comprising:

determining, by the at least one computer processor, a noise to signal ratio respective of the distribution profile.

7. The computer-implemented method of claim 3, further comprising:

determining, by the at least one computer processor, correlation of a first data series with at least a second data series, wherein the first data series is associated with the unidentified distribution.

8. The computer-implemented method of claim 2, further comprising:

reporting, by the at least one computer processor, identification of the at least a data series or the indicator wherein the associated respective profile is the unidentified profile.

9. The computer-implemented method of claim 8, further comprising:

receiving, by the at least one computer processor, a new profile respective of the at least a data series identified to have the unidentified profile.

10. The computer-implemented method of claim 8, further comprising:

associating, by the at least one computer processor, the at least a data series

identified to have the unidentified profile with an existing profile of the plurality of possible profiles.

11. The computer-implemented method of claim 1, wherein the indicator is any of:

a key performance indicator (KPI),

a counter, or

a key quality indicator (KQI).

12. The computer-implemented method of claim 1, further comprising:

receiving, by the at least one computer processor, a current data point respective of the at least a data series;

comparing, by the at least one computer processor, the current data point to the profile of the at least a data series; and

determining, by the at least one computer processor, existence of an anomalous data point respective of the current data point and respective of the profile of the at least a data series.

13. A system of classification of an indicator respective of a data series comprising:

at least one computer processing unit;

a network interface communicatively coupled to the at least one computer processing unit;

a memory communicatively coupled to the at least one computer processing unit, the memory containing instructions that when executed by the at least one computer processing unit configure the system to;

receive from at least a source of information at least a data series respective of the indicator measured by the at least a source of information;

determine for the indicator respective of the at least a data series a profile from a plurality of possible profiles;

associate the indicator with the respective profile; and

store the associated profile with the respective indicator.

14. The system of claim 13, wherein the profile is one of:

a distribution,

a behavioral, or

an unidentified profile.

15. The system of claim 14, wherein the profile is a distribution, and wherein the distribution is one of:

normal;

Poisson;

or

unidentified.

16. The system of claim 14, wherein the profile is a distribution profile and

wherein the memory further contains instructions that when executed by the at least one computer processing unit configure the system to:

determine at least a first parameter respective of the distribution profile and respective of the at least a data series.

17. The system of claim 16, wherein the memory further contains instructions that when executed by the at least one computer processing unit configure the system to:

determine a threshold respective of the at least a first parameter.

18. The system of claim 14, wherein the memory further contains instructions that when executed by the at least one computer processing unit configure the system to:

determine a noise to signal ratio respective of the distribution profile.

19. The system of claim 14, wherein the memory further contains instructions that when executed by the at least one computer processing unit configure the system to:

determine a correlation of a first data series with at least a second data series, wherein the first data series is associated with the unidentified distribution.

20. The system of claim 14, wherein the memory further contains instructions that when executed by the at least one computer processing unit configure the system to:

report identification of the at least a data series or the indicator wherein the associated respective profile is the unidentified profile.

21. The system of claim 20, wherein the memory further contains instructions that when executed by the at least one computer processing unit configure the system to:

receive a new profile respective of the at least a data series identified to have the unidentified profile.

22. The system of claim 20, wherein the memory further contains instructions that when executed by the at least one computer processing unit configure the system to:

associate the at least a data series identified to have the unidentified profile with an existing profile of the plurality of possible profiles.

23. The system of claim 13, wherein the indicator is any of:

a key performance indicator (KPI),

a counter, or

a key quality indicator (KQI).

24. The system of claim 13, wherein the memory further contains instructions that when executed by the at least one computer processing unit configure the system to:

receive a current data point respective of the at least a data series;

compare the current data point to the profile of the at least a data series; and

determine existence of an anomalous data point respective of the current data point and respective of the profile of the at least a data series.

25. A computer program product embodied on a computer accessible medium, the computer program product comprising program logic, which when executed on at least one computer processor provides a method of classification of an indicator respective of a data series, the method comprising:

receiving, by the at least one computer processor, from at least a source of information, at least the data series respective of the indicator measured by the at least a source of information;

determining, by the at least one computer processor, for the indicator respective of the at least a data series, a profile from a plurality of possible profiles;

associating, by the at least one computer processor, the indicator with the respective profile; and

storing, by the at least one computer processor, the associated profile with the respective indicator.

26. The computer program product of claim 25, wherein the profile is one of:

a distribution profile,

a behavioral profile, or

an unidentified profile.

27. The computer program product of claim 25, wherein the profile is a distribution, and wherein the distribution is one of:

normal;

Poisson, or

unidentified.

28. The computer program product of claim 26, wherein the profile is a distribution profile and the method further comprises:

determining, by the at least one computer processor, at least a first parameter respective of the distribution profile and respective of the at least a data series.

29. The computer program product of claim 27, wherein the method further comprises:

determining, by the at least one computer processor, a noise to signal ratio respective of the distribution profile.

30. The computer program product of claim 27, wherein the method further comprises:

determining, by the at least one computer processor, correlation of a first data series with at least a second data series, wherein the first data series is associated with the unidentified distribution.

31. The computer program product of claim 26, wherein the method further comprises:

reporting, by the at least one computer processor, identification of the at least a data series or the indicator wherein the associated respective profile is the unidentified profile.

32. The computer program product of claim 31, wherein the method further comprises:

receiving, by the at least one computer processor, a new profile respective of the at least a data series identified to have the unidentified profile.

33. The computer program product of claim 31, wherein the method further comprises:

associating, by the at least one computer processor, the at least a data series identified to have the unidentified profile with an existing profile of the plurality of possible profiles.

34. The computer program product of claim 25, wherein the indicator is any of:

a key performance indicator (KPI),

a counter, or

a key quality indicator (KQI).

35. The computer program product of claim 25, wherein the method further comprises:

receiving, by the at least one computer processor, a current data point respective of the at least a data series;

comparing, by the at least one computer processor, the current data point to the profile of the at least a data series; and

determining, by the at least one computer processor, existence of an anomalous data point respective of the current data point and respective of the profile of the at least a data series.