Efficient anomaly workflow detection for end-to-end provisioning systems

1 . A method implemented in a network system to provide efficient anomaly detection simultaneously across elements along end-to-end provisioning flows in the network system, the method comprising:

provisioning, by a network provisioning application implemented in a first computer system, a plurality of provisioning flows, each based on a respective one of a plurality of transactions associated with a respective one of a plurality of transaction types and a respective one of a plurality of subscriber segments, wherein the provisioning comprises:

transmitting, by the network provisioning application, to a plurality of network elements (NEs), provisioning instructions based on a translation of the plurality of transactions, wherein the translation is based on a plurality of network provisioning catalogs (NPCs);

receiving, by an anomaly detection application implemented in a second computer system, a provisioning log captured from provisioning respective ones of the provisioning flows over a predefined time period, wherein the provisioning log comprises operations and response codes associated with provisioning flow elements along the plurality of provisioning flows, wherein the provisioning flow elements comprise the plurality of transaction types, the plurality of subscriber segments, the plurality of NPCs, and the plurality of NEs;

determining, by the anomaly detection application, based on the provisioning log, a plurality of metrics, each indicative of a success rate for a respective one of the provisioning flow elements in association with provisioning a respective one of the plurality of provisioning flows;

determining, by the anomaly detection application, a machine learning (ML) model to approximate a probability density function of the plurality of metrics;

determining, by the anomaly detection application, an anomaly at one or more of the provisioning flow elements based on the ML model; and

triggering, by the anomaly detection application, an action to address the detected anomaly.

2 . The method of claim 1 , wherein the plurality of subscriber segments comprise at least one of a prepaid service brand, a postpaid service brand, or an Internet of things (IoT) service brand.

3 . The method of claim 1 , wherein the plurality of transaction types are associated with at least one of a service activation, a service deactivation, a service suspension, a service restoration, a billing cycle change, a service feature change, an identity access management, a subscriber identity module (SIM) change, or a phone number change.

4 . The method of claim 1 , wherein:

the provisioning log comprises a timestamp for each of the operations and response codes, and

the plurality of metrics comprise, for each of a plurality of intervals in the predefined time period, a sequence of success rates, each associated with a respective one of the provisioning flow elements in association with provisioning respective ones of the plurality of provisioning flows.

5 . The method of claim 1 , wherein the determining the ML model comprises:

adjusting, by the anomaly detection application, based on the plurality of metrics, a probability density threshold of the ML model.

6 . The method of claim 1 , wherein the determining the anomaly at the one or more provisioning flow elements comprises:

determining, by the anomaly detection application, a plurality of live metrics based on a live provisioning log captured from provisioning respective ones of the provisioning flows during a current time, each of the plurality of live metrics indicative of a success rate for a respective one of the provisioning flow elements at the current time; and

processing, by the anomaly detection application, the plurality of live metrics using the ML model.

7 . The method of claim 1 , further comprising:

updating a parameter of the ML model based on a subsequent provisioning log captured from provisioning respective ones of the provisioning flows during a subsequent time period.

8 . The method of claim 7 , wherein a duration of the predefined time period during which the provisioning log is captured for determining the ML model is the same as a duration of the subsequent time period during which the subsequent provisioning log is captured for updating the ML model.

9 . The method of claim 1 , wherein the action to address the detected anomaly comprises:

generating a dashboard comprising an indication of the detected anomaly and errors associated with the one or more of the provisioning flow elements at which the anomaly is detected.

10 . The method of claim 1 , wherein the action to address the detected anomaly comprises:

transmitting, by the anomaly detection application, to a responsible party for the detected anomaly, a notification of the detected anomaly.

11 . The method of claim 1 , wherein the action to address the detected anomaly comprises:

displaying, by the anomaly detection application, on a displaying device, an indication of the detected anomaly.

12 . The method of claim 1 , wherein:

the anomaly detected at the one or more provisioning flow elements comprises:

a first anomaly at a first provisioning flow element of the provisioning flow elements; and

a second anomaly at a second provisioning flow element of the provisioning flow elements different than the first provisioning flow element, and

the action to address the detected anomaly comprises:

determining, by the anomaly detection application, an error in the network system based on a correlation between the first anomaly at the first provisioning flow element and the second anomaly at the second provisioning flow element.

13 . The method of claim 1 , wherein the ML model is trained to approximate a probability density function of a distribution of a training data set.

14 . The method of claim 13 , wherein the training data set comprises, for each interval of a plurality of intervals across a predetermined period of time, a plurality of success rates, each for a respective one of the provisioning flow elements in association with respective ones of the plurality of provisioning flows.

15 . The method of claim 14 , wherein the training data set further includes, for each of the plurality of success rates, at least one of an indication of a date and time or an hour of the day associated with the respective success rate.

16 . The method of claim 13 , wherein the probability density function approximated by the ML model is based on a kernel density estimation (KDE).

17 . The method of claim 13 , wherein the ML model is trained to approximate the probability density function of the distribution of the training data set by adjusting a threshold probability density of the ML model.

18 . The method of claim 1 , wherein the ML model comprises a probability density model.

19 . The method of claim 18 , further comprising:

adapting, by the anomaly detection application, one or more parameters of the probability density model repeatedly, wherein each of the adapting is based on a most recent provisioning log captured from provisioning flows provisioned in a most recent capturing period.

20 . The method of claim 10 , wherein transmitting the notification of the detected anomaly is via at least one of an email notification, a dashboard, or an alarm.