Method, device and computer program product for anomaly detection

1. A method performed by at least one processor, and comprising:

first determining, among a plurality of cells, a first set of cells that are anomalous, wherein said first determining is based on

input data of a plurality of first features of each cell among the plurality of cells, and

a first machine learning operation;

second determining, among remaining cells of the plurality of cells that are not determined as anomalous by said first determining, a second set of cells that are anomalous, wherein said second determining is based on

the input data of the plurality of first features of each cell among the remaining cells, and

a second machine learning operation different from the first machine learning operation; and

identifying a resulting set of anomalous cells among the plurality of cells, wherein the resulting set of anomalous cells is a combination of the first set and the second set of anomalous cells.

2. The method of claim 1 , wherein

said second determining is based on the input data of the plurality of first features of each cell among the remaining cells, without using the input data of the plurality of first features of each cell among the first set of cells.

3. The method of claim 1 , wherein

the first machine learning operation comprises unsupervised machine learning, and

the second machine learning operation comprises supervised machine learning.

4. The method of claim 3 , wherein

the unsupervised machine learning comprises Hierarchical Agglomerative Clustering (HAC), and

the supervised machine learning comprises Logistic Regression (LR).

5. The method of claim 1 , wherein

the plurality of first features comprises downlink (DL) key performance indicators (KPIs).

6. The method of claim 1 , further comprising:

third determining, among the plurality of cells, a third set of cells that are anomalous, wherein said third determining is based on

input data of a plurality of second features of each cell among the plurality of cells, and

a third machine learning operation different from the first and second machine learning operations;

identifying a first Root Cause Analysis (RCA) for each anomalous cell in the resulting set of anomalous cells, based on the input data of the plurality of first features of said anomalous cell; and

indicating a second Root Cause Analysis (RCA) for each anomalous cell in the third set of anomalous cells, based on the input data of the plurality of second features of said anomalous cell.

7. The method of claim 6 , wherein

the plurality of first features comprises downlink (DL) key performance indicators (KPIs),

the plurality of second features comprises uplink (UL) KPIs.

8. The method of claim 7 , wherein at least one of

the DL KPIs comprise at least one selected from the group consisting of:

Network Availability,

Radio Access Bearer (ERAB) Setup Success Rate (SSR),

ERAB Drop Rate,

DL Physical Resource Block (PRB) Resource Utilization,

DL Modulation and Coding Schemes (MCSs),

Control Channel Element (CCE) Utilization,

UL Traffic,

DL Traffic, and

Timing Advance (TA) Type 1, or

the UL KPIs comprise at least one selected from the group consisting of:

Network Availability,

ERAB SSR,

ERAB Success Rate,

Quality of Service (QoS) Class Identifier (QCI) 9 and 5 ,

UL Noise, and

UL MCSs.

9. The method of claim 7 , wherein

the first machine learning operation comprises first unsupervised machine learning,

the second machine learning operation comprises supervised machine learning,

the third machine learning operation comprises second unsupervised machine learning different from the first unsupervised machine learning, and

the supervised machine learning comprises training a machine learning model based on training data of the DL KPIs collected over a period of up to 60 days.

10. The method of claim 9 , wherein

the first unsupervised machine learning comprises Hierarchical Agglomerative Clustering (HAC),

the supervised machine learning comprises Logistic Regression (LR), and

the second unsupervised machine learning comprises Gaussian Mixture Model (GMM).

11. A cell anomaly detecting device, comprising at least one processor configured to:

cluster a plurality of cells into a plurality of clusters, based on input data of a plurality of downlink (DL) key performance indicators (KPIs) of the plurality of cells,

perform cluster selection to identify one or more anomalous clusters among the plurality of clusters, the one or more anomalous clusters comprising a first set of anomalous cells,

perform label selection to identify a second set of anomalous cells among cells in one or more remaining clusters that are not determined as anomalous by the cluster selection, wherein said label selection is based on

the input data of DL KPIs of the cells in the one or more remaining clusters, and

a trained machine learning model previously obtained by supervised machine learning,

combine the first and second sets of anomalous cells to identify a resulting set of anomalous cells among the plurality of cells, and

identify a Root Cause Analysis (RCA) for each anomalous cell in the resulting set of anomalous cells, based on the input data of the DL KPIs of said anomalous cell.

12. The cell anomaly detecting device of claim 11 , wherein

the DL KPIs comprise at least one selected from the group consisting of:

Network Availability,

Radio Access Bearer (ERAB) Setup Success Rate (SSR),

ERAB Drop Rate,

DL Physical Resource Block (PRB) Resource Utilization,

DL Modulation and Coding Schemes (MCSs),

Control Channel Element (CCE) Utilization,

UL Traffic,

DL Traffic, and

Timing Advance (TA) Type 1.

13. The cell anomaly detecting device of claim 12 , wherein the at least one processor is further configured to:

perform data pre-processing on the input data of the DL KPIs to obtain pre-processed data of a plurality of DL features derived from the DL KPIs, and

perform the cluster selection and the label selection, using the pre-processed data of the plurality of DL features,

wherein the plurality of DL features comprises at least one selected from the group consisting of:

Radio Network Availability Rate (%),

ERAB SSR (%),

Maximum User Equipment (UE) Number,

DL PRB Utilization,

Residual Block Error Rate (BLER) DL,

multiple DL MCSs (%) in corresponding non-overlapping ranges of DL MCS indices,

multiple CCE Utilizations (%) at corresponding aggregation levels (AGG), and

TA Distribution.

14. The cell anomaly detecting device of claim 13 , wherein the at least one processor is further configured to:

perform the supervised machine learning on training data to obtain the trained machine learning model, based on a plurality of rules, wherein

a cell satisfying at least two of the plurality of rules is determined as anomalous, and

a cell satisfying less than two of the plurality of rules is determined as non-anomalous,

wherein the plurality of rules comprises at least one selected from the group consisting of:

ERAB SSR being less than a second threshold,

Residual BLER DL being greater than a third threshold,

DL MCS in a range of MCS indices from 23 to 26 being less than a fourth threshold,

TA Distribution being less than a fifth threshold, and

DL MCS in a range of MCS indices from 0 to 9 being greater than a sixth threshold, while CCE Utilization at AGG of 8 being greater than a seventh threshold.

15. The cell anomaly detecting device of claim 13 , wherein the at least one processor is further configured to indicate RCA based on a plurality of rules comprising at least one selected from the group consisting of:

Radio Network Availability Rate being zero, corresponding to RCA being Zero Availability,

Residual BLER DL being greater than a first threshold, corresponding to RCA being High BLER,

DL MCS in a range of MCS indices from 0 to 9 being greater than a second threshold, corresponding to RCA being Bad DL MCS, and

CCE Utilization at AGG of 8 being greater than a fourth threshold, corresponding to RCA being High CCE Utilization.

16. A computer-readable medium including instructions that are executable by a computer to cause the computer to perform operations comprising:

clustering a plurality of cells into a plurality of clusters, based on input data of a plurality of uplink (UL) key performance indicators (KPIs) of the plurality of cells;

performing cluster selection to identify one or more anomalous clusters among the plurality of clusters; and

identifying a Root Cause Analysis (RCA) for each cell in the one or more anomalous clusters, based on the input data of the UL KPIs of said anomalous cell,

wherein, in the cluster selection,

a cluster satisfying at least two of a plurality of rules is determined as anomalous, and

a cluster satisfying less than two of the plurality of rules is determined as non-anomalous.

17. The computer-readable medium of claim 16 , wherein

the UL KPIs comprise at least one selected from the group consisting of:

Network Availability, Radio Access Bearer (ERAB) Setup Success Rate (SSR),

ERAB Success Rate at Quality of Service (QoS) Class Identifier (QCI) 9 and 5,

UL Noise, and

UL MCSs.

18. The computer-readable medium of claim 17 , wherein the operations further comprise:

performing data pre-processing on the input data of the UL KPIs to obtain pre-processed data of a plurality of UL features derived from the UL KPIs, and

perform the cluster selection, using the pre-processed data of the plurality of UL features,

wherein the plurality of UL features comprises at least one selected from the group consisting of:

Radio Network Availability Rate (%),

ERAB SSR (%),

ERAB SSR for QCI 5,

ERAB SSR for QCI 9,

Maximum UE Number,

UL PRB Utilization,

Residual BLER UL,

multiple UL MCSs (%) in corresponding non-overlapping ranges of UL MCS indices,

DL MCS in a range of MCS indices from 23 to 26, and

Full Duplex (FD) UL Average Noise.

19. The computer-readable medium of claim 18 , wherein

in the cluster selection,

a cluster satisfying only one of the plurality of rules is determined as non-anomalous, and

the plurality of rules comprises at least one selected from the group consisting of:

ERAB SSR being less than a first threshold, and

FD UL Average Noise being greater than a third threshold.

20. The computer-readable medium of claim 18 , wherein said indicating RCA for each anomalous cell is based on a plurality of further rules comprising at least one selected from the group consisting of:

Radio Network Availability Rate being zero, corresponding to RCA being Zero Availability,

ERAB SSR being zero, corresponding to RCA being ERAB Failure,

FD UL Average Noise being greater than a first threshold, corresponding to RCA being High UL Noise, and

Residual BLER UL being greater than a second threshold, corresponding to RCA being High UL BLER.