Detection and Mitigation of Signalling Anomalies in Wireless Network

• US 20180109975A1
• Filed: 10/17/2017
• Published: 04/19/2018
• Est. Priority Date: 10/18/2016
• Status: Active Grant

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: KALLIOLA, Aapo, OLIVER, Ian Justin, MICHE, Yoan Jean Claude, HOLTMANNS, Silke, ALI, Amaanat, KUURE, Pekka
• Granted Patent: US 10,602,396 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 24/04 Arrangements for maintaining operational condition
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 24/10 Scheduling measurement reports ; Arrangements for measurement reports
• CPC Class Codes: H04W 28/0231 based on communication conditions dynamic wireless traffic scheduling definition based on channel quality criteria H04W72/54
• CPC Class Codes: H04W 28/0247 based on conditions of the access network or the infrastructure network central resource management H04W28/16
• CPC Class Codes: H04W 28/0284 detecting congestion or overload during communication monitoring arrangements H04L43/00
• CPC Class Codes: H04W 28/0289 Congestion control load shedding arrangements in network planning H04W16/08; performing reselection for handling the traffic H04W36/22; wireless traffic scheduling H04W72/12
• CPC Class Codes: H04W 28/18 Negotiating wireless communication parameters

Abstract

This document discloses a solution for detecting and mitigating anomalies such as signalling storms in a radio access network of a wireless communication system. According to an aspect, there is disclosed a method including receiving, in a first local traffic analysis module, configuration parameters from a second local traffic analysis module or from a central traffic analysis module connected to a plurality of local traffic analysis modules; monitoring, by a first traffic analysis module by using the received configuration parameters, traffic in a radio access network of a wireless communication system; detecting, in the monitored traffic on the basis of the configuration parameters, an anomaly causing a control plane signalling load; and in response to said detecting, taking an action to mitigate the anomaly and reporting information on the anomaly to the central traffic analysis module.

Claims

1. A method comprising:

receiving, in a first local traffic analysis module, configuration parameters from a second local traffic analysis module or from a central traffic analysis module connected to a plurality of local traffic analysis modules;

monitoring, by a first traffic analysis module by using the received configuration parameters, traffic in a radio access network of a wireless communication system;

detecting, in the monitored traffic on the basis of the configuration parameters, an anomaly causing a control plane signalling load; and

in response to said detecting, taking an action to mitigate the anomaly and reporting information on the anomaly to the central traffic analysis module.

2. The method of claim 1, wherein said reporting comprises transmit ting data representing traffic that caused said detection to the central traffic analysis module.

3. The method of claim 1, further comprising indicating the detected anomaly to another local traffic analysis module.

4. The method of claim 1, further comprising in the first local traffic analysis module:

identifying a device causing said anomaly on the basis of at least one message of the monitored traffic; and

routing at least some of traffic associated with the identified device to the central traffic analysis module.

5. The method of claim 1, wherein said action to mitigate the anomaly comprises:

identifying a device causing said anomaly on the basis of at least one message of the monitored traffic; and

controlling traffic of the identified device.

6. The method of claim 5, wherein said controlling the traffic of the identified device comprises at least one of the following traffic control functions:

blocking the device, causing handover of the device from one access node to another access node, suspending communication with the device, reducing traffic volume of the device while allowing the device to cause traffic, transmitting a message to an owner of the device, and causing software or firmware update at the device.

7. The method of claim 1, wherein the first local traffic analysis module monitors traffic in an access node of the radio access network.

14. An apparatus comprising means for carrying out the steps of the method of claim 1.

15. A computer program product embodied on a distribution medium readable by a computer and comprising program instructions which, when loaded into an apparatus, execute the method according to claim 1.

8. A method comprising:

providing, in a central traffic analysis module, a communication connection with a plurality of local traffic analysis modules configured to monitor traffic in a radio access network of a wireless communication system;

receiving, in the central traffic analysis module from a first local traffic analysis module, information on an anomaly causing a control plane signalling load;

analysing the received information and determining, on the basis of the analysis, whether or not to carry out an action related to the anomaly; and

upon determining to carry out the action in the central traffic analysis module, causing transmission of a configuration message to at least one of another central traffic analysis module and at least one of the plurality of local traffic analysis modules.

9. The method of claim 8, wherein said analysing comprises using machine learning to determine whether or not the received information indicates presence of the anomaly.

10. The method of claim 9, further comprising upon detecting the anomaly:

including in the configuration message a command to perform an action to mitigate the anomaly and causing transmission of the configuration message to said at least one of the plurality of local traffic analysis modules.

11. The method of claim 9, further comprising upon detecting the anomaly:

including characteristics of the anomaly in the configuration message and informing said other central traffic analysis module about the anomaly.

12. The method of claim 9, further comprising upon detecting the anomaly:

determining a terminal device that causes the anomaly and modifying at least one register entry of the terminal device in a location register of the terminal device.

13. The method of claim 8, further comprising providing the plurality of local traffic analysis modules with configuration parameters enabling the plurality of local traffic analysis modules to use machine learning to detect anomalies from monitored traffic in the radio access network.