Abstract: Methods, apparatus, and system for generating efficient cross-layer key performance indicators for monitoring, managing and debugging communications networks. An exemplary method embodiment includes the steps of: generating a plurality of different cross-layer key performance indicators (CL-KPIs) from a set of event data records corresponding to a first period of time and a first base protocol, each CL-KPI in said plurality of different CL-KPIs being for a different failure cause scenario; identifying a CL-KPI in the plurality of different CL-KPIs corresponding to the first period of time and the first base protocol having a highest CL-KPI value and determining a most likely failure cause scenario for said first base protocol to be the failure cause scenario associated with the identified CL-KPI having the highest CL-KPI value.

Abstract: A method includes: receiving protocol event data from a plurality of probes within the telecommunication system; determining a most probable cause of a call event from the protocol event data; applying the most probable cause to a trained machine learning algorithm that includes the most probable cause as its input and a telecommunication system score as its output; and in response to an output score from the trained machine learning algorithm, performing a corrective action for a plurality of network users that are expected to be affected by the most probable cause.

Abstract: A method performed by a computing system includes collecting information on transactions in a telecommunication system, using the information on transactions to create a plurality of event objects, each of the event objects associated with a telecommunication event, associating each of the event objects with a Key Performance Indicator (KPI), applying the event objects to a plurality of inference functions, each inference functions using the set of parameters as inputs and the KPIs of the event objects as outputs to create a model that infers a relationship between the set of parameters and the KPIs, and analyzing metadata from each of the inference functions to determine which of the set of parameters was used to predict an outcome leading to the KPI.

Abstract: A method performed by a computing system includes collecting information on transactions in a telecommunication system, using the information on transactions to create a plurality of event objects, each of the event objects associated with a telecommunication event, associating each of the event objects with a Key Performance Indicator (KPI), applying the event objects to a plurality of inference functions, each inference functions using the set of parameters as inputs and the KPIs of the event objects as outputs to create a model that infers a relationship between the set of parameters and the KPIs, and analyzing metadata from each of the inference functions to determine which of the set of parameters was used to predict an outcome leading to the KPI.

Abstract: A method performed by a computing system that collects information on transactions in a telecommunication system includes receiving an event object. The event object includes parameters associated with a telecommunication event. The method further includes classifying the event object, using a classification mechanism, as one of a plurality of Key Performance Indicators (KPIs) by using the parameters, including considering events from multiple protocols for classifying event objects. The method further includes, after classifying the event object, inferring relationships between a set of inputs and a set of outputs, the set of inputs including information types from the event object and the set of outputs including KPIs.

Abstract: A method includes: receiving protocol event data from a plurality of probes within the telecommunication system; determining a most probable cause of a call event from the protocol event data; applying the most probable cause to a trained machine learning algorithm that includes the most probable cause as its input and a telecommunication system score as its output; and in response to an output score from the trained machine learning algorithm, performing a corrective action for a plurality of network users that are expected to be affected by the most probable cause.

Abstract: Methods, apparatus, and system for generating efficient cross-layer key performance indicators for monitoring, managing and debugging communications networks. An exemplary method embodiment includes the steps of: generating a plurality of different cross-layer key performance indicators (CL-KPIs) from a set of event data records corresponding to a first period of time and a first base protocol, each CL-KPI in said plurality of different CL-KPIs being for a different failure cause scenario; identifying a CL-KPI in the plurality of different CL-KPIs corresponding to the first period of time and the first base protocol having a highest CL-KPI value and determining a most likely failure cause scenario for said first base protocol to be the failure cause scenario associated with the identified CL-KPI having the highest CL-KPI value.

Abstract: Methods and apparatus for implementing and operating malicious transaction detection systems. An exemplary method embodiment includes the steps of: (i) operating, a malicious transaction detection system, to receive communications session establishment data; operating, the malicious transaction detection system, to determine a probability of whether or not the communications session establishment data indicates that the communications session is malicious; and when the determined probability is greater than or equal to a predetermined threshold value determining that a transaction corresponding to the received communications session establishment data is malicious; and when the determined probability is less than the predetermined threshold value determining that the transaction corresponding to the received communications session establishment data is not malicious; and wherein the malicious transaction detection system includes a determination model trained using synthetic communications session data.

Abstract: A method includes: receiving protocol event data from a plurality of probes within the telecommunication system; determining a most probable cause of a call event from the protocol event data; applying the most probable cause to a trained machine learning algorithm that includes the most probable cause as its input and a telecommunication system score as its output; and in response to an output score from the trained machine learning algorithm, performing a corrective action for a plurality of network users that are expected to be affected by the most probable cause.

Abstract: A method performed by a computing system that collects information on transactions in a telecommunication system includes receiving an event object. The event object includes parameters associated with a telecommunication event. The method further includes classifying the event object, using a classification mechanism, as one of a plurality of Key Performance Indicators (KPIs) by using the parameters, including considering events from multiple protocols for classifying event objects. The method further includes, after classifying the event object, inferring relationships between a set of inputs and a set of outputs, the set of inputs including information types from the event object and the set of outputs including KPIs.

Abstract: A method performed by a computing system includes collecting information on transactions in a telecommunication system, using the information on transactions to create a plurality of event objects, each of the event objects associated with a telecommunication event, associating each of the event objects with a Key Performance Indicator (KPI), applying the event objects to a plurality of inference functions, each inference functions using the set of parameters as inputs and the KPIs of the event objects as outputs to create a model that infers a relationship between the set of parameters and the KPIs, and analyzing metadata from each of the inference functions to determine which of the set of parameters was used to predict an outcome leading to the KPI.

Abstract: Methods for estimating Subscriber quality of experience (QOE) for mobile users accessing networks for different services from observed data in control and user planes in mobile wireless networks and then summarizing inferences per user, per service, per sector, group of sectors and other aggregate points, and exporting this information for reducing user churn, network planning and network tuning, application adaptation to improve QOE are disclosed. Methods for improving subscriber QOE metrics for certain applications, services and web-sites for improved monetization methods are also presented. The methods facilitate quantifying network goodness from the user application point of view, and exporting triggers to other network elements, such as SON Server, OSS and PCRF, when QOE anomalies are detected. Additionally, this exported information could also trigger content adaptation, delivery optimizations and other actions.

Abstract: Control Plane and User plane packet data are collected within the Radio Access Network using a plurality of network devices. Consolidation and summarization of this information is then performed to present a unified picture of RAN through abstract APIs to management and analytics applications. The invention identifies methods of retaining the collected network data, such as control and application protocol headers at the collection points, and consolidation and exporting this network data to management/reporting/analytics application using application driven rules for consolidation and summarization. Real-time statistical analysis tools, which may be used to predict failure and degradation trends and proactively control the underlying causes, are also disclosed.

Abstract: Control Plane and User plane packet data are collected within the Radio Access Network using a plurality of network devices. Consolidation and summarization of this information is then performed to present a unified picture of RAN through abstract APIs to management and analytics applications. The invention identifies methods of retaining the collected network data, such as control and application protocol headers at the collection points, and consolidation and exporting this network data to management/reporting/analytics application using application driven rules for consolidation and summarization. Real-time statistical analysis tools, which may be used to predict failure and degradation trends and proactively control the underlying causes, are also disclosed.

Abstract: An apparatus and method for steering and load-balancing mobile network traffic with user session awareness from multiple control and user plane protocols while understanding the load on the corresponding physical or virtual servers in cloud and virtual deployments is disclosed. This traffic could be monitored traffic, such as from optical taps, or network probes of mobile network interfaces, or port mirrors from network devices, or inline traffic when the load-balancer is logically placed inline in the network before the Virtual Network Functions, such as Virtual SGW (vSGW), Virtual SGSN (vSGSN), Virtual PGW (vPGW), Virtual MME (vMME), or Virtual Performance Enhancing proxy(vPEP). The apparatus and methods identified herein allow additional capabilities, such as ensuring that both directions of a protocol flow target the same physical or virtual server, or both control plane and user plane protocols of a flow are forwarded to the same server.

Abstract: The present invention identifies methods and procedures for correlating control plane and user plane data, consolidating and abstracting the learned and correlated data in a form convenient for minimizing and exporting to other network devices, such as those in the Core Network and the Access Network, or the origin server, CDN devices or client device. These correlation methods may use Control Plane information from a plurality of interfaces in the RAN, and User plane information from other interfaces in the RAN or CN. IF the device is deployed as an inline proxy, this information may be exported using in-band communication, such as HTTP extension headers in HTTP Request or Response packets, or another protocol header, such as the IP or GTP-U header field. Alternatively, this information can be exported out-of-band using a separate protocol between the RAN Transit Network Device (RTND) and the receiving device.

Abstract: Methods for estimating Subscriber quality of experience (QOE) for mobile users accessing networks for different services from observed data in control and user planes in mobile wireless networks and then summarizing inferences per user, per service, per sector, group of sectors and other aggregate points, and exporting this information for reducing user churn, network planning and network tuning, application adaptation to improve QOE are disclosed. Methods for improving subscriber QOE metrics for certain applications, services and web-sites for improved monetization methods are also presented. The methods facilitate quantifying network goodness from the user application point of view, and exporting triggers to other network elements, such as SON Server, OSS and PCRF, when QOE anomalies are detected. Additionally, this exported information could also trigger content adaptation, delivery optimizations and other actions.

Abstract: A packet scheduling method and apparatus with the knowledge of application behavior, anticipated usage/behavior based on the type of content, and underlying transport conditions during the time of delivery, is disclosed. This type of scheduling is applicable to a content server or a transit network device in wireless (e.g., 3G, WIMAX, LTE, WIFI) or wire-line networks. Methods for identifying or estimating rendering times of multi-media objects, segmenting a large media content, and automatically pausing or delaying delivery are disclosed. The scheduling reduces transit network bandwidth wastage, and facilitates optimal sharing of network resources such as in a wireless network.

Abstract: Control Plane and User plane packet data are collected within the Radio Access Network using a plurality of network devices. Consolidation and summarization of this information is then performed to present a unified picture of RAN through abstract APIs to management and analytics applications. The invention identifies methods of retaining the collected network data, such as control and application protocol headers at the collection points, and consolidation and exporting this network data to management/reporting/analytics application using application driven rules for consolidation and summarization. Real-time statistical analysis tools, which may be used to predict failure and degradation trends and proactively control the underlying causes, are also disclosed.

Abstract: An application mobility-management entity (“AME”) in a radio-access network detects movement of a mobile device and routes application data for already-active application streams associated with the mobile device to the device's new location by establishing a connection to a second AME in the radio-access network. The second AME merges forwarded application data from/to the first AME for previously active application streams with the new application streams (e.g., new TCP connections) locally and forwards to/from the mobile device through the radio access network elements.