Abstract: Systems and methods for managing 5G networks are provided. A method for injecting analytics into a Network Repository Function (NRF) for managing a 5G slice, according to one implementation, includes a first step of obtaining parameters associated with User Plane (UP) traffic and Control Plane (CP) traffic from a Service-Based Architecture (SBA) of a 5G network. The method also includes the step of performing analytics on the obtained parameters to monitor Network Functions (NFs) associated with the 5G network. In addition, the method includes the step of providing results of the analytics to an NRF to control NFs stored in a repository associated with the NRF.

Abstract: Subscriber identity module (SIM) swap scam detection include receiving wireless network data based on passive monitoring of a wireless network; identifying a subscriber identity module, SIM, card change in user equipment, UE, based on changes in identifiers in the wireless network data; identifying a commercial user communication with the UE after the SIM card change; and detecting potentially fraudulent activity for the UE based on a combination of the SIM card change, the commercial user communication, and a time period therebetween. The steps can further include providing an alert of the potentially fraudulent activity identifying the commercial user communication as a possible SIM swap scam.

Abstract: Systems and methods for monitoring data packets captured from a network are provided. A method, according to one implementation, includes the step of receiving raw data from a network, where the raw data pertains to mobile communications involving a Network Element (NE). The method also includes the step of extracting information from the raw data to obtain NE information defining a device type, such as network element type, and other information that characterizes the NE. Also, the method includes the step of encoding the NE information in a header of a Packet Capture (PCAP) file.

Abstract: An interference matrix for LTE and NR based on user equipment measurement data reports for PCI clash and neighbor addition and deletion algorithms. In an embodiment, a method for identifying interferences in a telecommunications network having at least one serving cell and at least one reported cell includes retrieving data sources including one or more of (a) call trace data from the telecommunications network and (b) device metrics from multiple user equipment (UEs) connected to a telecommunications network; processing the data sources to form an interference matrix with structured data that is vendor and device agnostic by (a) parsing and correlating the call trace data to provide the structured data and (b) processing the device metrics from multiple UEs and geo-binning them based on location; analyzing the structured data in the interference matrix to determine interferences between cells; and displaying information about the determined interferences.

Abstract: Systems and methods for balancing load in an area of a wireless network comprising first nodes operating according to a first Radio Access Technology and at least one second node operating according to a second Radio Access Technology. The method comprises establishing a connection between a user device and a first node; receiving an indication of an entry threshold for establishing a connection between the user device and a second node during a current time period, wherein the entry threshold is determined in dependence on an expected usage requirement for the area of the wireless network during the current time period; determining, by the user device, whether a parameter of a signal received from the second node exceeds the entry threshold; and responsive to determining that the parameter of the signal received from the second node exceeds the entry threshold, establishing, by the first node, a dual connectivity session between the user device and both the first and the second nodes.

Abstract: An apparatus, method and computer program is described, comprising: obtaining analytics data from one or more network data analytics functions of a mobile communication system using a probe network function which subscribes to the network data analytics functions; obtaining control plane data from one or more control plane probes, wherein the control plane data comprises signaling between one or more user devices and a network of the mobile communication system; obtaining user plane data from one or more user plane probes; processing the analytics data, control plane data and user plane data, including correlating at least some of said analytics, user plane and control plane data and identifying at least one anomaly in said data; and triggering an active mode to acquire a subset of analytics data related to said at least one anomaly.

Abstract: Systems and methods for call direction detection on Session Initiation Protocol (SIP) Internet Protocol (IP) Multimedia Subsystem (IMS) include monitoring SIP register messages, such as “401 UNAUTHORIZED” messages inside the IMS core to detect and log the IP addresses of the Proxy-Call Session Control Function (P-CSCF). The systems and methods include monitoring SIP registration messages; determining and storing addresses of P-CSCFs based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein; monitoring SIP INVITE messages; and, for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs.

Abstract: The invention concerns a method and a system for determining root-cause diagnosis of events occurring during the operation of a communication network comprising monitoring time signals representative of the operation of the network to detect the occurrence of an event relative to the network traffic, and for each detected event, during the duration of said event obtaining distributions of data on several dimensions of the network linked to said event, automatically determining an event root-cause diagnosis of the detected event, called single event diagnosis, comprising at least one element of said distributions, an element being a value taken by a network dimension having a contribution in said distributions of data, the single event diagnosis determination using rules of business logic configuration organized hierarchically, which are applied according to said hierarchy to select at least one element of said distributions, the selection of more than one element comprising machine learning clustering.

Abstract: Systems and methods implemented by a workflow engine include obtaining data from a plurality of interfaces and network functions, NF, in one or more datacenters associated with a 5G core, 5GC, network, wherein the data relates to lifecycle management in the 5GC network; responsive to analyzing the data with a set of key performance indicators, KPI, and rules associated therewith that are formulated to detect anomalies that impact the lifecycle management, generating an alarm based on the analyzing based on detection of an anomaly that impacts the lifecycle management; and creating a workflow based on the alarm and pushing the workflow to the 5GC network via an orchestrator.

Abstract: Systems and methods include obtaining monitored traffic from an S1 interface; detecting a Secondary Radio Access Technology (RAT) Data Usage Report (DUR) in the monitored traffic; determining whether the Secondary RAT DUR relates to a 5G Non-Standard Architecture (NSA), and, if so, determining an address of a gNodeB in the Secondary RAT DUR; and storing the address of the gNodeB in a database. The systems and methods can include, for a call, updating a Call Detail Record (CDR) to reflect one of 5G NSA and 4G based on whether an address in the CDR is in the database.

Abstract: Systems and methods include obtaining monitored messages between a Mobility Management Entity (MME) and a Serving Gateway (SGW) in a 5G Non-Standalone (NSA) system; detecting base stations that are gNodeB base stations based on the monitored messages; and storing the detected gNodeB base stations in a database of known gNodeB base stations in the 5G NSA system. The systems and methods can include identifying a bearer as utilizing 5G Radio Access Technology based on a presence of an address associated with the detected gNodeB base stations in the database of known gNodeB base stations. The systems and methods can further include identifying a bearer as utilizing 4G Radio Access Technology based on a lack of the presence of the address in the database of known gNodeB base stations.

Abstract: Systems and methods for detection, characterization, and prediction of real-time events having approximate periodicity include detection of events from raw data that are approximately periodic. The detection includes analyzing raw data to determine approximately periodic chains of events. The raw data can be related to network management systems, financial monitoring systems, medical monitoring, seismic activity monitoring, or any system that performs some management or monitoring of an underlying system or network having time lasting events. The detected approximately periodic events could be characterized and presented in natural language as well as used for prediction of future events via supervised machine learning.

Abstract: A method and device for estimating a number of distinct subscribers of a telecommunication network impacted by network issues include, for a plurality of N successive counting periods preceding a current time, steps of determining, for each counting period, an estimate of a number of different subscribers impacted by at least one network issue by implementing a probabilistic counter structure, and storing at least one elementary counter in association to said counting period, aggregating the elementary counters in a multi-level final counter structure, wherein each level of the final counter structure has an associated probabilistic counter structure, the aggregation comprising, for each elementary counter: computing, for at least one level of the multi-level final counter structure, an intersection between said elementary counter and the probabilistic counter structure associated to said level of the multi-level final counter structure, and updating the multi-level final counter structure based on the inters

Abstract: Deep Packet Inspection (DPI) application classification systems and methods are presented to enrich and improve application classification. Specifically, the systems and methods utilize domain and hostname information to enrich the DPI application classification. The systems and methods can include obtaining a packet; determining a hostname associated with the packet; utilizing a main rule to extract a domain from the hostname; and analyzing the domain and the hostname with a plurality of secondary rules based on the domain to deduce an application therefrom.

Abstract: An embodiment may involve: (i) obtaining a set of data records that include respective pluralities of tuples characterizing operation of communication sessions in a network and that identify hardware or software components related to the network that were involved in the communication sessions, (ii) determining degrees to which signatures in the pluralities of tuples are associated with communication problems in the network; (iii) identifying, from the degrees, a subset of the signatures most associated with the communication problems; (iv) grouping specific pairs from the subset of the signatures into equivalence classes based on co-occurrence of signatures of the specific pairs within the data records; (v) generating and pruning a dependency graph between the equivalence classes; (vi) from the equivalence classes remaining in the dependency graph, selecting a subset of the hardware or software components related to the network that are candidates for involvement with the communication problems.

Abstract: Visualization systems and methods include, responsive to obtaining data related to one or more events occurring during operation of a system, displaying information about a time-based component of the one or more events on a timeline; displaying fixed information about a timeless component of the one or more events on the timeline; and responsive to user input to modify a timescale of the timeline, adjusting display of the timeline by adjusting the information of the one or more events and maintaining the fixed information of the one or more events.

Abstract: A method, implemented in a distributed system including a plurality of processing devices, generates an end-to-end Call Detail Record (CDR) on voice and multimedia telecommunication sessions over a plurality of telecommunication network elements and interfaces. The method includes the steps of receiving CDRs generated in real-time and streamed by multiple network elements, each CDR referring to a specific interface or protocol, processing the received CDRs as they are received to identify the specific interface or protocol to which the received CDR refers and to identify a single telecommunication session based on a key associated with the received CDR, and creating an end-to-end CDR incrementally based on all of the received CDRs identified for the single telecommunication session, wherein at least two of the received CDRs have a different interface or protocol from one another.

Abstract: An example embodiment may involve obtaining training time series data spanning an observation time window and comprising a series of values of a metric at regularly-spaced sample points in time, and analyzing the training time series data to determine one of a periodicity or a pseudo-periodicity across a plurality of consecutive sub-windows, each equal in size to a reference time period and each spanned by the same number N of sample points of metric values. A reference pattern corresponding to a model time series having no anomalies, as well as a reference threshold, may be determined and stored. Runtime time series data may then be obtained and time aligned with the reference pattern. Deviations between the runtime time series and the reference pattern may be identified as anomalies if they exceed the reference threshold. Identified anomalies may be displayed in a display device.