Intelligent anomaly detection and root cause analysis in mobile networks

1. A method comprising:

receiving radio access network data generated by a set of base stations;

determining a plurality of user sessions from the radio access network data;

detecting anomalies, the anomalies comprising anomalous user sessions and anomalous cells, wherein detecting the anomalies comprises:

detecting the anomalous user sessions from the plurality of user sessions; and

detecting the anomalous cells based on the radio access network data;

determining one or more root causes for each of the anomalies;

for each determined root cause, determining:

a number of anomalous user sessions associated with the root cause; and

cell identifiers for anomalous cells associated with the root cause; and

generating an alert for a root cause from the determined root causes, the alert comprising the respective cell identifiers associated with the root cause and a severity score determined based on a percentage of user sessions impacted by the root cause,

wherein determining the severity score comprises:

determining the radio access network data associated with the root cause;

determining a number of unique user sessions from the radio access network data; and

determining the percentage of user sessions impacted by the root cause based on the number of unique user sessions and the number of anomalous user sessions associated with the root cause.

2. The method of claim 1 , wherein determining the root cause comprises classifying the respective anomaly with a root cause classifier based on the radio access network data associated with the respective anomaly.

3. The method of claim 2 , wherein the anomaly is detected using an anomaly detector, wherein the root cause is determined using a plurality of root cause classifiers comprising the root cause classifier.

4. The method of claim 1 , wherein:

detecting the anomaly comprises determining a set of anomaly key performance indicators (KPIs) from the radio access network data and detecting the anomaly based on the set of anomaly KPIs;

determining the root cause comprises determining a set of root cause KPIs, different from the anomaly KPIs, and determining the root cause based on the set of root cause KPIs.

5. The method of claim 1 , wherein detecting the anomalous user sessions comprises:

determining a set of anomaly key performance indicators (KPIs) for each user session of the plurality of user sessions;

determining a baseline for each user session of the plurality of user sessions; and

detecting the anomalous user session in response to the set of anomaly KPIs deviating from the baseline for the user session.

6. The method of claim 1 , further comprising:

determining a recommended set of network operation parameters to resolve the root cause; and

automatically controlling the set of base stations based on the recommended set of network operation parameters.

7. The method of claim 1 , wherein the alert indicates the number of anomalous user sessions associated with the root cause.

8. The method of claim 1 , wherein:

the anomalous cells are detected by a cell anomaly detector; and

the anomalous user sessions are detected by a user session anomaly detector, different from the cell anomaly detector.

9. A method comprising:

receiving radio access network data generated by a set of base stations;

determining a plurality of user sessions from the radio access network data;

detecting anomalous user sessions, from the plurality of user sessions, based on the radio access network data;

for each anomalous user session of the plurality of user sessions, determining one or more root causes;

for each determined root cause, determining a number of anomalous user sessions associated with the root cause; and

generating an alert, for a determined root cause, based on a severity score,

wherein determining the severity score comprises:

determining the radio access network data associated with the root cause;

determining a number of unique user sessions from the radio access network data; and

determining whether a percentage of user sessions impacted by the root cause based on the number of unique user sessions and the number of anomalous user sessions associated with the respective root cause.

10. The method of claim 9 , wherein determining the root cause comprises classifying the respective anomaly with one or more root cause classifiers based on the radio access network data associated with the respective anomaly, wherein the anomaly is detected using an anomaly detector, wherein the root cause is determined using a plurality of root cause classifiers comprising the root cause classifier.

11. The method of claim 9 , further comprising presenting the alert to a user; wherein the alert is ordered, within a list of alerts, based on the severity score.

12. The method of claim 9 , wherein the alert comprises a severity score, determined based on the radio access network data associated with the respective root cause.

13. The method of claim 9 , further comprising determining a recommendation to resolve a determined root cause.

14. The method of claim 13 , wherein the recommendation comprises a set of network operation parameters.

15. The method of claim 14 , further comprising automatically controlling the set of base stations based on the set of network operation parameters.

16. The method of claim 9 , wherein the alert further comprises:

a duration of the root cause,

a percentage of user sessions impacted by the root cause, and

a set of KPI factors symptomatic of the root cause.

17. The method of claim 9 , wherein determining the plurality of user sessions comprises:

extracting a plurality of device identifiers from the radio access network data; and

for each device identifier of the plurality of device identifiers: extracting a user session, comprising data segments associated with the device identity, from the radio access network data.

18. The method of claim 9 , further comprising generating radio access network data with the set of base stations.

19. The method of claim 9 , wherein the alert indicates the number of anomalous user sessions associated with the root cause.