Methods and systems to determine and monitor topologies of 5G service-based architectures

1 . A system of a telecommunications network configured to determine and monitor a topology of its 5G Service-Based Architecture, the system comprising:

at least one hardware processor; and

at least one non-transitory memory storing instructions, which, when executed by the at least one hardware processor, cause the system to:

poll a collection of distributed Network Repository Functions (NRFs) of the telecommunications network for status data of a collection of Network Functions (NFs) for each NRF of the distributed NRFs,

wherein to poll the distributed NRFs requires authorizations to access a particular collection of NFs of a particular NRF,

wherein each NRF monitors a service of associated NFs, and

wherein each NRF stores a profile for each associated NF including a collection of fields that include a time-series collection of states;

receive particular status data obtained from at least a subset of fields of the collection of NFs of the distributed NRFs,

wherein the particular status data is of a current time slice from the time-series collection of states;

generate an end-to-end network topology for the telecommunications network based on an aggregation of the particular status data,

wherein the end-to-end network topology delineates current and historical states of services and connections of the telecommunications network; and

detect an anomalous service area based on a particular instance of the end-to-end network topology using a model configured to:

receive, as input features, the particular status data of the end-to-end network topology for the current time slice, including one or more of: an integer, a float, a string, a Boolean, and/or a custom data class,

compare the particular status data of respective fields of each NF to past status data of corresponding fields, accessed from prior polling of time-series collections of associated NF profiles,

wherein the past status data comprises one or more statistical distributions based on historical states, and

output, responsive to the input features and comparisons to the one or more statistical distributions, at least one flag indicating the anomalous service area.

2 . The system of claim 1 , wherein to poll the collection of distributed NRFs comprises causing the system to:

query the collection of NFs for each NRF,

wherein each NRF includes a list of devices,

wherein each query includes a list of commands to be run in a sequence on a respective device from the list of devices, and

wherein each query includes an authorization that is specific to the respective device.

3 . The system of claim 1 , further caused to:

perform an action in response to the detected anomalous service area,

wherein the action includes any one of:

issuing an alert,

recording a timestamp, or

flagging an anomalous state, an anomalous field, an anomalous NF, or an anomalous NRF from within a particular service area of the telecommunications network.

4 . The system of claim 1 :

wherein the collection of NRFs is divided into regions, and

wherein each region corresponds to a geographical area.

5 . The system of claim 1 , wherein the end-to-end network topology reflects a portion of an entirety of the telecommunications network.

6 . The system of claim 1 , wherein to poll the collection of distributed NRFs is in response to an operation of:

a time function,

a clustering algorithm, or

a neural network.

7 . The system of claim 1 , wherein the particular status data comprises a combination of values for:

a fully qualified domain name (fqdn);

an IP address;

a network function status (nfstatus);

network slice selection assistance information (nssai);

a data network name (dnn);

locality;

priority; or

a Tracking Area Identity Range List (taiRangeList).

8 . The system of claim 1 ,

wherein the particular status data comprises any of:

an undiscoverable state,

a suspended state, or

a missing state, and

wherein the past status data comprises any one of:

a registered state, or

a suspended state.

9 . A non-transitory, computer-readable storage medium comprising instructions recorded thereon that, when executed by at least one processor of a system of a wireless 5G telecommunications network, cause the system to:

poll a collection of distributed Network Repository Functions (NRFs) of a telecommunications network for status data of a collection of Network Functions (NFs) for each NRF of the distributed NRFs,

wherein each NRF monitors a service of associated NFs, and

wherein each NRF stores a profile for each NF including a collection of fields that each include a time-series collection of states;

receive particular status data obtained from at least a subset of the fields of the collection of NFs of the distributed NRFs,

wherein the particular status data is of a current time slice from the time-series collection of states;

generate an end-to-end network topology for the telecommunications network based on an aggregation of the particular status data,

wherein the end-to-end network topology delineates states of services or connections of the telecommunications network; and

detect an anomalous service area based on a particular instance of the end-to-end network topology using a model configured to:

receive, as input features, the particular status data of the end-to-end network topology for the current time slice, including one or more of: an integer, a float, a string, a Boolean, and/or a custom data class,

compare the particular status data of respective fields of each NE to past status data of corresponding fields, accessed from prior polling of time-series collections of associated NE profiles,

wherein the past status data comprises one or more statistical distributions based on historical states, and

output, responsive to the input features and comparisons to the one or more statistical distributions, at least one flag indicating the anomalous service area.

10 . The non-transitory, computer-readable storage medium of claim 9 , wherein to poll the collection of distributed NRFs comprises causing the system to:

query the collection of NFs for each NRF,

wherein each NRF includes a list of devices,

wherein each query includes a list of commands to be run in a sequence on a respective device from the list of devices, and

wherein each query includes an authorization that is specific to the respective device.

11 . The non-transitory, computer-readable storage medium of claim 9 , wherein the system is further caused to:

perform an action in response to a detected anomaly,

wherein the action includes any one of:

issuing an alert,

recording a timestamp, or

flagging an anomalous state, an anomalous field, an anomalous NF, or an anomalous NRF from within a particular service area of the telecommunications network.

12 . The non-transitory, computer-readable storage medium of claim 9 :

wherein the collection of NRFs is divided into regions, and

wherein each region corresponds to a geographical area.

13 . The non-transitory, computer-readable storage medium of claim 9 , wherein to poll the collection of distributed NRFs is in response to an operation of:

a time function,

a clustering algorithm,

a neural network, or

a statistical distribution based on historical data.

14 . The non-transitory, computer-readable storage medium of claim 9 , wherein status data of each NRF comprises multiple values of:

a fully qualified domain name (fqdn);

an IP address;

a network function status (nfstatus);

network slice selection assistance information (nssai);

a data network name (dnn);

locality;

priority; or

a Tracking Area Identity Range List (taiRangeList).

15 . The non-transitory, computer-readable storage medium of claim 9 , wherein to detect the anomalous service area comprises causing the system to:

wherein the current state comprises any one of:

an undiscoverable state,

a suspended state, or

a missing state, and

wherein the undiscoverable state comprises any of:

a registered state, or

a suspended state.

16 . A method performed by a central hub of a telecommunications network, the method comprising:

polling multiple Network Repository Functions (NRFs) of the telecommunications network for status data of associated Network Functions (NFs),

wherein each NRF stores a profile for an NF including a collection of fields that each include a time-series collection of states;

receiving particular status data of the time-series collection of states for fields of at least a subset of the NFs of the multiple NRFs at the central hub;

generating an end-to-end network topology for the telecommunications network based on an aggregation of the particular status data,

wherein the end-to-end network topology delineates states of services or connections of the telecommunications network; and

detecting an anomalous service area based on a particular instance of the end-to-end network topology using a model configured to:

receive, as input features, the particular status data of the end-to-end network topology for the current time slice, including one or more of: an integer a float, a string a Boolean, and/or a custom data class,

compare the particular status data of respective fields of each NF to past status data of corresponding fields, accessed from prior polling of time-series collections of associated NE profiles,

wherein the past status data comprises one or more statistical distributions based on historical states, and

output responsive to the input features and comparisons to the one or more statistical distributions, at least one flag indicating the anomalous service area.

17 . The method of claim 16 , further comprising:

performing an action in response to a detected anomaly,

wherein the action includes any one of:

issuing an alert,

recording a timestamp, or

flagging an anomalous state, an anomalous field, an anomalous NF, or an anomalous NRF.

18 . The method of claim 16 ,

wherein the current state comprises any one of:

an undiscoverable state,

a suspended state, or

a missing state, and

wherein the past state comprises any one of:

a registered state, or

a suspended state.

19 . The method of claim 16 , wherein polling the multiple NRFs comprises:

querying the associated NFs for each NRF,

wherein each NRF includes a list of devices,

wherein each query includes a list of commands to be run in a sequence on a respective device from the list of devices, and

wherein each query includes an authorization that is specific to the respective device.

20 . The method of claim 19 , further comprising:

providing the authorization to the device;

connecting to the device;

running the commands in a proper sequence on the device;

collecting standard output from the device;

querying an NF API for additional information;

mapping the additional information into the standard output;

parsing the standard output for relevant information based on the mapping;

sorting the relevant information into a readable format; and

retrieving from the device the relevant information in the readable format as status data.