Abstract: A system and method for identifying anomalies in indicators, such as key performance indicators (KPIs) of a telecom system are disclosed. The method can learn over time behavior of the indicator and can statistically identify what should be considered anomalous. Learning can be performed on a per indicator basis that each presents different statistical qualities. The method can associate the indicator to a profile, such as one of several statistical distributions and can operate accordingly. Association may be determined by the correlation of the indicator to statistical distribution. The method can identify correlations between indicators when identifying the statistical distribution and especially when the associated statistical distribution is an unidentified profile. The method can include comparison of actuals versus prediction and sending alerts when anomalies are found.

Abstract: A computerized method, system, and computer program product thereof determines a service topology of a telecommunication network respective of one or more user devices. Information related to a service, provided to the user device over a telecommunication network, is received. The service may be providing connectivity required for a voice call, a data session, short message service (SMS) or the like. Information related to at least a network element of the telecommunication network is collected, the network element having supplied the service. A telecommunication network topology for the service is determined related to the information. A failure notification is received through the telecommunication network. An impact on the service is determined, related to the telecommunication network topology and the failure notification. The impact may be full or partial loss of service. A service notification may be sent related to the determined impact, for example to a fault management system.

Abstract: A performance indicator monitoring system (PIMS) receives a plurality of operational measurements (OMs) for each performance indicator (PI), which may be stored on a first storage. A rate of access by a monitoring system is determined for the PI. The rate may be determined, for example, related to a counter of the PI. An enriched dataset related to a subset of the plurality of OMs is generated, upon determination that the selected PI rate of use is higher than a primary threshold value. The generated enriched dataset may be stored in a second storage. In some embodiments, a component of the PIMS, such as a processing unit, is determined. A usage level of the component is then determined, and the enriched dataset is generated if the usage level of the component is below a secondary threshold.

Abstract: A computerized method, system, and computer program product can allow for processing by a processor data records (xDRs). The method can include receiving by the processor xDRs, each xDR including a vector of unique data fields, the xDRs forming together a stream. The stream can be stored by the processor in a memory of a general purpose graphic processor unit (GPGPU). An index vector of xDRs can be created by the processor, wherein each xDR is assigned a unique index identifier, and stored by the processor in a memory of the GPGPU. The index vector of xDRs is sorted with respect to at least a key of at least a unique data element selected. The sorted index vector can be stored in the memory of the GPGPU. A selection of at least the unique data field can be performed and aggregation of the stream performed with respect to the selection.

Abstract: A Fault Management (FaM) system monitoring a telecommunication network is able to determine a root cause of a malfunction within the network. The root cause determination is accomplished by receiving alarms from network elements, which may be physical devices, logical interfaces, or a combination thereof. An alarm typically includes a managed object, an alarm name, object type, timestamp, and the like. FaM systems may receive thousands of alarms, where a root cause alarm indicates a malfunction which triggered other alarms to be reported. Alarms are correlated by the FaM system, and a probability is determined for each correlated alarm to be the root cause. The system may have a learning mode, in which it correlates alarms, and an online mode, in which it receives alarms and determines that the alarms are correlated based on data from the learning mode. In some embodiments, both modes may be executed in parallel.

Abstract: A system is disclosed for electronically forecasting values of a plurality of time series. The system receives a dataset, for example of a telecommunications network. A plurality of performance indicators (PIs) are generated from the dataset. Groups of PIs are generated by the system, so that each PI in a group corresponds to an autoregressive integrated moving average (ARIMA) model of that group. A first group of PIs is selected, and the system configures for each PI of the first group of PIs at least a parameter of the ARIMA model. Based on the configured ARIMA model, the system may generate predicted values for any PI of the first group. In some embodiments, a seasonal ARIMA (SARIMA) model may be used, to allow detection of seasonal behavior of the time series.

Abstract: A performance indicator monitoring system (PIMS) receives a plurality of operational measurements (OMs) for each performance indicator (PI), which may be stored on a first storage. A rate of access by a monitoring system is determined for the PI. The rate may be determined, for example, related to a counter of the PI. An enriched dataset related to a subset of the plurality of OMs is generated, upon determination that the selected PI rate of use is higher than a primary threshold value. The generated enriched dataset may be stored in a second storage. In some embodiments, a component of the PIMS, such as a processing unit, is determined. A usage level of the component is then determined, and the enriched dataset is generated if the usage level of the component is below a secondary threshold.

Abstract: A location-based system detects anomalies in performance indicators of telecommunication networks. The system generates a plurality of service areas, each service area including a plurality of adjacent cell sites. A performance indicator of a first service area of the plurality of service areas is selected and an aggregated service area performance indicator is generated, by aggregating the selected performance indicator for each cell site of the plurality of cell sites of the first service area. Generation of the plurality of service areas may be related to a determined network traffic threshold. The threshold may be related to: total bandwidth provided by a cell site, or total number of calls handled by a cell site. The selected indicator may be, for example the call set-up success rate (CSSR), or the drop call rate (DCR). An alert related to the aggregated indicator may be generated.

Abstract: A system and method for identification and handling of a flood of alarms in a telecommunications system. A flood event occurs when a plurality of alarms in a queue of an alarm management system exceeds a threshold. The threshold may be a static, dynamic or adaptive threshold. A classification is determined for each flood event and preventive measures are determined. A plurality of floods having identical or different classifications may be identified respective of the plurality of alarms. A classification may be related, for example, to a network element (NE), element manager (EM), sync event, user actions, external application or rules. Preventive measures may be, for example, resetting a NE or EM or diverting alarms from the queue into another memory portion. The threshold may be determined respective of the total number of alarms in queue, the rate of alarms received and the rate of processing the alarms.