Unusual event detection in a telecommunications network
View Patent ↗Measures for detecting unusual communication session events in a telecommunications network. A Markov model for events occurring in communication sessions conducted in the network is maintained. The maintaining includes assigning a probability of occurrence metric to a plurality of event sequences in the conducted communication sessions. In response to a given sequence of communication session events being assigned a probability of occurrence metric which exceeds a predetermined threshold, an unusual communication session event alert in association with the given sequence is triggered.
1. A method of detecting unusual communication session events in a telecommunications network, the method comprising:
maintaining a Markov model for events occurring in communication sessions conducted in the network, the maintaining comprising assigning a probability of occurrence metric to a plurality of event sequences in the conducted communication sessions;
updating the content of the Markov model by applying a weighting factor over time; and
in response to a given sequence of communication session events being assigned a probability of occurrence metric that exceeds a predetermined threshold, triggering an unusual communication session event alert in association with the given sequence.
2. A method according to claim 1 , wherein the probability of occurrence metric comprises the probability given by the Markov model that the next event in a given sequence of two events follows the previous event in the given sequence of two events.
3. A method according to claim 1 , wherein the probability of occurrence metric comprises the probability given by the Markov model that the next event in a given sequence of two events follows the previous event in the given sequence of two events divided by the average probability of all next events in the Markov model given the previous event in the given sequence of two events.
4. A method according to claim 1 , wherein the probability of occurrence metric comprises the surprisal of the probability of the next event in a given sequence of two events given the previous event in the given sequence of two events divided by the entropy of the previous event in the given sequence of two events.
5. A method according to claim 1 , wherein the Markov model comprises a first-order Markov chain.
6. A method according to claim 1 , wherein the weighting factor is user-configurable.
7. A method according to claim 1 , wherein the weighting factor is a constant weighting factor of 0.90.
8. A method according to claim 1 , further comprising: receiving at least some of the communication session event data for maintaining the Markov model for at least some of the conducted communication sessions via the network as the conducted communication sessions occur.
9. A method according to claim 8 , wherein the communication session event data is received from a plurality of different network nodes in the network.
10. A method according to claim 1 , further comprising: retrieving at least some of the communication session event data for maintaining the Markov model from a historical communication session event database.
11. A method according to claim 1 , further comprising: providing a user interface for displaying data associated with communication session events, wherein the triggering comprises displaying data associated with the given sequence of communication session events differently to data associated with other communication session events via the user interface.
12. A method according to claim 11 , further comprising:
storing snapshots of the content of the Markov model at periodic intervals,
wherein displaying data associated with the given sequence of communication session events via the user interface comprises using the stored snapshot content of the Markov model which occurred closest in time to the given sequence of communication session events in relation to the triggering.
13. A method according to claim 1 , further comprising: in response to a further sequence of communication session events being assigned a probability of occurrence metric that exceeds both the predetermined threshold and a further, different predetermined threshold, triggering a further unusual communication session event alert in association with the further sequence.
14. A method according to claim 13 , further comprising:
providing a user interface for displaying data associated with communication session events, wherein the triggering comprises displaying data associated with the given sequence of communication session events differently to data associated with other communication session events via the user interface,
wherein triggering of the further unusual communication session event alert comprises displaying data associated with the further sequence of communication session events differently to data associated with the given sequence of communication session events and differently to data associated with other communication session events via the user interface.
15. A method according to claim 1 , wherein the maintaining comprises maintaining a plurality of different Markov models for events occurring in communication sessions conducted in the network during different time periods.
16. A method according to claim 1 , wherein the maintaining comprises maintaining a plurality of different Markov models for events occurring in communication sessions conducted between different groups of subscribers in the network.
17. A method according to claim 1 , wherein the Markov model comprises a higher than first-order Markov chain.
18. A method according to claim 11 , further comprising: in response to the given sequence of communication session events being assigned a probability of occurrence metric which exceeds the predetermined threshold, triggering an unusual communication session alert in association with a given communication session in which the given sequence occurred, wherein the triggering of an unusual communication session alert comprises displaying data associated with the given communication session differently to data associated with other communication sessions via the user interface.
19. A method according to claim 11 , further comprising:
calculating the average of the probability of occurrence metrics assigned to all events sequences in a further communication session; and
in response to the calculated average exceeding a yet further predetermined threshold, triggering a further unusual communication session alert in association with the further communication session,
wherein the triggering of the further unusual communication session alert comprises displaying data associated with the further unusual communication session differently to data associated with other communication sessions via the user interface.
20. A method according to claim 1 , further comprising:
storing snapshots of the content of the Markov model at periodic intervals;
calculating, for all pairs of two events in a given stored snapshot and the maintained Markov model, the average difference between the surprisal of the probability of the next event in each sequence of two events given the previous event in each sequence of two events divided by the entropy of the previous event in each sequence of two events; and
in response to the calculated average difference exceeding a given predetermined threshold, triggering an abnormal network behavior alert for the network.
21. A method according to claim 11 , further comprising:
identifying a subset of event sequences in the plurality of event sequences for which the assigned probability of occurrence metric is higher than other event sequences; and
triggering a further abnormal network behavior alert for the network, wherein the triggering of a further abnormal network behavior alert comprises only displaying data associated with event sequences in the subset via the user interface.
22. A method according to claim 21 , further comprising: displaying data associated with event sequences in the subset via the user interface using a word cloud diagram.
23. An apparatus for use in detecting errors in communication sessions in a telecommunications network, the apparatus comprising at least one processor, and at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus to:
maintain a Markov model for events occurring in communication sessions conducted in the network, the maintaining comprising assigning a probability of occurrence metric to a plurality of event sequences in the conducted communication sessions;
update the content of the Markov model by applying a weighting factor over time; and
in response to a given sequence of communication session events being assigned a probability of occurrence metric which exceeds a predetermined threshold, trigger a unusual communication session event alert in association with the given sequence.
24. A computer program product comprising a non-transitory, computer-readable storage medium having computer readable instructions stored thereon, the computer readable instructions being executable by a computerized device to cause the computerized device to perform a method for detecting errors in communication sessions in a telecommunications network, the method comprising:
maintaining a Markov model for events occurring in communication sessions conducted in the network, the maintaining comprising assigning a probability of occurrence metric to a plurality of event sequences in the conducted communication sessions;
update the content of the Markov model by applying a weighting factor over time; and
in response to a given sequence of communication session events being assigned a probability of occurrence metric which exceeds a predetermined threshold, triggering a unusual communication session event alert in association with the given sequence.