Abstract: Systems and methods for balancing load in an area of a wireless network comprising first nodes operating according to a first Radio Access Technology and at least one second node operating according to a second Radio Access Technology. The method comprises establishing a connection between a user device and a first node; receiving an indication of an entry threshold for establishing a connection between the user device and a second node during a current time period, wherein the entry threshold is determined in dependence on an expected usage requirement for the area of the wireless network during the current time period; determining, by the user device, whether a parameter of a signal received from the second node exceeds the entry threshold; and responsive to determining that the parameter of the signal received from the second node exceeds the entry threshold, establishing, by the first node, a dual connectivity session between the user device and both the first and the second nodes.

Abstract: An apparatus, method and computer program is described, comprising: obtaining analytics data from one or more network data analytics functions of a mobile communication system using a probe network function which subscribes to the network data analytics functions; obtaining control plane data from one or more control plane probes, wherein the control plane data comprises signaling between one or more user devices and a network of the mobile communication system; obtaining user plane data from one or more user plane probes; processing the analytics data, control plane data and user plane data, including correlating at least some of said analytics, user plane and control plane data and identifying at least one anomaly in said data; and triggering an active mode to acquire a subset of analytics data related to said at least one anomaly.

Abstract: An embodiment may involve: (i) obtaining a set of data records that include respective pluralities of tuples characterizing operation of communication sessions in a network and that identify hardware or software components related to the network that were involved in the communication sessions, (ii) determining degrees to which signatures in the pluralities of tuples are associated with communication problems in the network; (iii) identifying, from the degrees, a subset of the signatures most associated with the communication problems; (iv) grouping specific pairs from the subset of the signatures into equivalence classes based on co-occurrence of signatures of the specific pairs within the data records; (v) generating and pruning a dependency graph between the equivalence classes; (vi) from the equivalence classes remaining in the dependency graph, selecting a subset of the hardware or software components related to the network that are candidates for involvement with the communication problems.

Abstract: Systems and methods for call direction detection on Session Initiation Protocol (SIP) Internet Protocol (IP) Multimedia Subsystem (IMS) include monitoring SIP register messages, such as “401 UNAUTHORIZED” messages inside the IMS core to detect and log the IP addresses of the Proxy-Call Session Control Function (P-CSCF). The systems and methods include monitoring SIP registration messages; determining and storing addresses of P-CSCFs based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein; monitoring SIP INVITE messages; and, for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs.

Abstract: An example embodiment may involve obtaining training time series data spanning an observation time window and comprising a series of values of a metric at regularly-spaced sample points in time, and analyzing the training time series data to determine one of a periodicity or a pseudo-periodicity across a plurality of consecutive sub-windows, each equal in size to a reference time period and each spanned by the same number N of sample points of metric values. A reference pattern corresponding to a model time series having no anomalies, as well as a reference threshold, may be determined and stored. Runtime time series data may then be obtained and time aligned with the reference pattern. Deviations between the runtime time series and the reference pattern may be identified as anomalies if they exceed the reference threshold. Identified anomalies may be displayed in a display device.

Abstract: The invention concerns a method and a system for determining root-cause diagnosis of events occurring during the operation of a communication network comprising monitoring time signals representative of the operation of the network to detect the occurrence of an event relative to the network traffic, and for each detected event, during the duration of said event obtaining distributions of data on several dimensions of the network linked to said event, automatically determining an event root-cause diagnosis of the detected event, called single event diagnosis, comprising at least one element of said distributions, an element being a value taken by a network dimension having a contribution in said distributions of data, the single event diagnosis determination using rules of business logic configuration organized hierarchically, which are applied according to said hierarchy to select at least one element of said distributions, the selection of more than one element comprising machine learning clustering.

Abstract: Systems and methods implemented by a workflow engine include obtaining data from a plurality of interfaces and network functions, NF, in one or more datacenters associated with a 5G core, 5GC, network, wherein the data relates to lifecycle management in the 5GC network; responsive to analyzing the data with a set of key performance indicators, KPI, and rules associated therewith that are formulated to detect anomalies that impact the lifecycle management, generating an alarm based on the analyzing based on detection of an anomaly that impacts the lifecycle management; and creating a workflow based on the alarm and pushing the workflow to the 5GC network via an orchestrator.

Abstract: Systems and methods include obtaining monitored traffic from an S1 interface; detecting a Secondary Radio Access Technology (RAT) Data Usage Report (DUR) in the monitored traffic; determining whether the Secondary RAT DUR relates to a 5G Non-Standard Architecture (NSA), and, if so, determining an address of a gNodeB in the Secondary RAT DUR; and storing the address of the gNodeB in a database. The systems and methods can include, for a call, updating a Call Detail Record (CDR) to reflect one of 5G NSA and 4G based on whether an address in the CDR is in the database.

Abstract: Systems and methods include obtaining monitored messages between a Mobility Management Entity (MME) and a Serving Gateway (SGW) in a 5G Non-Standalone (NSA) system; detecting base stations that are gNodeB base stations based on the monitored messages; and storing the detected gNodeB base stations in a database of known gNodeB base stations in the 5G NSA system. The systems and methods can include identifying a bearer as utilizing 5G Radio Access Technology based on a presence of an address associated with the detected gNodeB base stations in the database of known gNodeB base stations. The systems and methods can further include identifying a bearer as utilizing 4G Radio Access Technology based on a lack of the presence of the address in the database of known gNodeB base stations.

Abstract: Systems and methods for detection, characterization, and prediction of real-time events having approximate periodicity include detection of events from raw data that are approximately periodic. The detection includes analyzing raw data to determine approximately periodic chains of events. The raw data can be related to network management systems, financial monitoring systems, medical monitoring, seismic activity monitoring, or any system that performs some management or monitoring of an underlying system or network having time lasting events. The detected approximately periodic events could be characterized and presented in natural language as well as used for prediction of future events via supervised machine learning.

Abstract: A method and device for estimating a number of distinct subscribers of a telecommunication network impacted by network issues include, for a plurality of N successive counting periods preceding a current time, steps of determining, for each counting period, an estimate of a number of different subscribers impacted by at least one network issue by implementing a probabilistic counter structure, and storing at least one elementary counter in association to said counting period, aggregating the elementary counters in a multi-level final counter structure, wherein each level of the final counter structure has an associated probabilistic counter structure, the aggregation comprising, for each elementary counter: computing, for at least one level of the multi-level final counter structure, an intersection between said elementary counter and the probabilistic counter structure associated to said level of the multi-level final counter structure, and updating the multi-level final counter structure based on the inters

Abstract: Deep Packet Inspection (DPI) application classification systems and methods are presented to enrich and improve application classification. Specifically, the systems and methods utilize domain and hostname information to enrich the DPI application classification. The systems and methods can include obtaining a packet; determining a hostname associated with the packet; utilizing a main rule to extract a domain from the hostname; and analyzing the domain and the hostname with a plurality of secondary rules based on the domain to deduce an application therefrom.

Abstract: An embodiment may involve: (i) obtaining a set of data records that include respective pluralities of tuples characterizing operation of communication sessions in a network and that identify hardware or software components related to the network that were involved in the communication sessions, (ii) determining degrees to which signatures in the pluralities of tuples are associated with communication problems in the network; (iii) identifying, from the degrees, a subset of the signatures most associated with the communication problems; (iv) grouping specific pairs from the subset of the signatures into equivalence classes based on co-occurrence of signatures of the specific pairs within the data records; (v) generating and pruning a dependency graph between the equivalence classes; (vi) from the equivalence classes remaining in the dependency graph, selecting a subset of the hardware or software components related to the network that are candidates for involvement with the communication problems.

Abstract: An embodiment may involve obtaining a set of data records including features characterizing operational aspects of a communication network. Each data record may include a feature vector and performance metrics of the communication network. Each feature vector may include a multiple elements corresponding to feature-value pairs. A first statistical analysis may be applied to the set of data records and their performance metrics to identify major contributors to degraded network performance. A second statistical analysis may be applied to identify elements that negatively influence the major contributors, and to discriminate between additive effects and incompatibilities as the source of negative influence. For each major contributor, a hierarchical dependency tree may be constructed with the major contributor as the root node and influencer elements as other nodes.

Abstract: Visualization systems and methods include, responsive to obtaining data related to one or more events occurring during operation of a system, displaying information about a time-based component of the one or more events on a timeline; displaying fixed information about a timeless component of the one or more events on the timeline; and responsive to user input to modify a timescale of the timeline, adjusting display of the timeline by adjusting the information of the one or more events and maintaining the fixed information of the one or more events.

Abstract: A method, implemented in a distributed system including a plurality of processing devices, generates an end-to-end Call Detail Record (CDR) on voice and multimedia telecommunication sessions over a plurality of telecommunication network elements and interfaces. The method includes the steps of receiving CDRs generated in real-time and streamed by multiple network elements, each CDR referring to a specific interface or protocol, processing the received CDRs as they are received to identify the specific interface or protocol to which the received CDR refers and to identify a single telecommunication session based on a key associated with the received CDR, and creating an end-to-end CDR incrementally based on all of the received CDRs identified for the single telecommunication session, wherein at least two of the received CDRs have a different interface or protocol from one another.

Abstract: An example embodiment may involve obtaining training time series data spanning an observation time window and comprising a series of values of a metric at regularly-spaced sample points in time, and analyzing the training time series data to determine one of a periodicity or a pseudo-periodicity across a plurality of consecutive sub-windows, each equal in size to a reference time period and each spanned by the same number N of sample points of metric values. A reference pattern corresponding to a model time series having no anomalies, as well as a reference threshold, may be determined and stored. Runtime time series data may then be obtained and time aligned with the reference pattern. Deviations between the runtime time series and the reference pattern may be identified as anomalies if they exceed the reference threshold. Identified anomalies may be displayed in a display device.