Adaptive, Anomaly Detection Based Predictor for Network Time Series Data

• US 20160285700A1
• Filed: 03/22/2016
• Published: 09/29/2016
• Est. Priority Date: 03/24/2015
• Status: Active Grant

• Current Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Inventors: Hu, Yirui, Gopalakrishnan, Nandu
• Granted Patent: US 10,911,318 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 41/0823 characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for optimising operational conditions of wireless networks H04W24/02
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/149 for prediction of maintenance
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

System and method embodiments are provided for adaptive anomaly detection based predictor for network data. In an embodiment, a computer-implemented method in a network component for predicting values of future network time series data includes receiving, with one or more receivers, network time series data; determining, with one or more processors, whether an anomaly is detected in the network time series data; generating, with the one or more processors, a prediction associated with the network data according to a primary predictor when no anomaly is detected in the network time series data; generating, with the one or more processors, the prediction associated with the network data according to an alternative predictor when an anomaly in the network time series data is detected; and sending, with one or more transmitters, the prediction to a network controller, wherein the network controller uses the prediction to adjust network parameters.

Claims

1. A computer-implemented method in a network component for predicting values of future network time series data, comprising:

receiving, with one or more receivers, network time series data;

determining, with one or more processors, whether an anomaly is detected in the network time series data;

generating, with the one or more processors, a prediction associated with the network data according to a primary predictor when no anomaly is detected in the network time series data;

generating, with the one or more processors, the prediction associated with the network data according to an alternative predictor when an anomaly in the network time series data is detected; and

sending, with one or more transmitters, the prediction to a network controller, wherein the network controller uses the prediction to adjust network parameters.

2. The computer-implemented method of claim 1, wherein the primary predictor is trained according to historical data.

3. The computer-implemented method of claim 1, the determining whether an anomaly is detected comprises comparing previous predictions determined according to the primary predictor with observed values.

4. The computer-implemented method of claim 1, wherein the anomaly is detected when a predicted value determined according to the primary predictor differs from an observed value by more than a threshold.

5. The computer-implemented method of claim 1, wherein the anomaly is detected when the number of predicted values determined according to the primary predictor that differ from corresponding observed values by more than a threshold exceeds a predefined number within a specified time period.

6. The computer-implemented method of claim 1, wherein the primary predictor comprises a Hidden Markov Model.

7. The computer-implemented method of claim 1, wherein determining whether an anomaly is detected in the network time series data comprises determining the anomaly according to a Hidden Markov Model.

8. The computer-implemented method of claim 1, wherein the alternative predictor comprises one of a current data predictor and a Gaussian Mixture Model (GMM).

9. The computer-implemented method of claim 1, wherein determining whether an anomaly is detected comprises determining a likelihood of occurrence of the observed data point.

10. The computer-implemented method of claim 9, wherein the anomaly is detected when the number of calculated likelihood values that fall below a threshold exceeds a predefined number within a specified time period.

11. The computer-implemented method of claim 9, wherein the likelihood is computed according to a Gaussian Mixture Model (GMM) model built from the historical data.

12. The computer-implemented method of claim 11, wherein the GMM model comprises parameters leaned from the historical data.

13. The computer-implemented method of claim 9, wherein the likelihood is computed according to a Hidden Markov Model (HMM) model built (i.e., parameters learned) from the historical data.

14. The computer-implemented method of claim 13, wherein the HMM model comprises parameters learned from the historical data.

15. A network component comprising:

a processor; and

a non-transitory computer readable storage medium storing programming for execution by the processor, the programming including instructions for;

receiving, at the network component, network time series data;

determining, with the network component, whether an anomaly is detected in the network time series data;

generating a prediction associated with the network data according to a primary predictor when no anomaly is detected in the network time series data;

generating the prediction associated with the network data according to an alternative predictor when an anomaly in the network time series data is detected; and

sending, with the network component, the prediction to a network controller, wherein the network controller uses the prediction to adjust network parameters.

16. The network component of claim 15, wherein the primary predictor is trained according to historical data.

17. The network component of claim 15, the determining whether an anomaly is detected comprises comparing previous predictions determined according to the primary predictor with observed values.

18. The network component of claim 15, wherein the anomaly is detected when a predicted value determined according to the primary predictor differs from an observed value by more than a threshold.

19. The network component of claim 15, wherein the anomaly is detected when the number of predicted values determined according to the primary predictor that differ from corresponding observed values by more than a threshold exceeds a predefined number within a specified time period.

20. The network component of claim 15, wherein the primary predictor comprises a Hidden Markov Model.

21. The network component of claim 15, wherein determining whether an anomaly is detected in the network time series data comprises determining the anomaly according to a Hidden Markov Model.

22. The network component of claim 15, wherein the alternative predictor comprises one of a current data predictor and a Gaussian Mixture Model (GMM).

23. The network component of claim 15, wherein determining whether an anomaly is detected comprises determining a likelihood of occurrence of the observed data point.

24. The network component of claim 23, wherein the anomaly is detected when the number of calculated likelihood values that fall below a threshold exceeds a predefined number within a specified time period.

25. The network component of claim 23, wherein the likelihood is computed according to a Gaussian Mixture Model (GMM) model built from the historical data.

26. The network component of claim 25, wherein the GMM model comprises parameters leaned from the historical data.

27. The network component of claim 23, wherein the likelihood is computed according to a Hidden Markov Model (HMM) model built (i.e., parameters learned) from the historical data.

28. The network component of claim 27, wherein the HMM model comprises parameters learned from the historical data.

29. A non-transitory computer-readable media storing computer instructions for predicting values of future network time series data, that when executed by one or more processors, cause the one or more processors to perform the steps of:

training an adaptive anomaly detection based predictor with training data;

receiving network time series data;

determining whether to use a primary predictor or an alternate predictor according to whether an anomaly is detected in the network time series data;

generating a prediction associated with the network data according to a primary predictor when no anomaly is detected in the network time series data;

generating the prediction associated with the network data according to an alternative predictor when an anomaly in the network time series data is detected; and

sending the prediction to a network controller, wherein the network controller uses the prediction to adjust network parameters.

30. The non-transitory computer-readable media of claim 29, wherein the step of determining whether to use a primary predictor or an alternate predictor comprises applying a log-likelihood function to the network time series data.

31. The non-transitory computer-readable media of claim 29, wherein the step of determining whether to use a primary predictor or an alternate predictor comprises applying a Hidden Markov Model to the network time series data.

32. The non-transitory computer-readable media of claim 29, wherein the primary predictor comprises a Hidden Markov Model.

33. The non-transitory computer-readable media of claim 29, wherein the alternative predictor comprises one of a current data predictor and a Gaussian Mixture Model (GMM).