capbtabboxtable[][]

AAS

    Active Antenna Systems
AC

    Actor Critic
AI

     Artificial Intelligence
ABS

    Almost Blank Subframes
AIP

    Administrative Incentive Pricing
ANA

    Autonomic Network Architecture
ANR

    Automatic Neighbour Relation
ANN

    Artificial Neural Network
AP

    Access Point
API

    Application Programming Interface
B5G

    beyond 5G
BeFemto

    Broadband Evolved FEMTO Networks
BER

    Bit Error Rate
BLER

    Block Error Rate
BIONETS

    Genetically inspired networks
2TBN

    two-stage temporal Bayesian network
BS

    Base Station
CESC

    Cloud-Enabled Small Cell
COGEU

    Cognitive radio systems for efficient sharing of TV white spaces in EUropean context
CAPEX

    Capital Expenditure
CASCADAS

    Component-ware for Autonomic, Situation-aware Communications, and Dynamically Adaptable Services
CATNETS

    Evaluation of the Catallaxy Paradigm for Decentralized Operation of Dynamic Application Networks
CET

    Changes Electrical Tilt
CG

    Coordination Game
C-SON

    centralized SON
C-RRM

    centralized RRM
CIO

    Cell Individual Offset
CCO

    Coverage and Capacity Optimization
COR

    Cell Outage Recovery
CDF

    Cumulative Distribution Function
CDR

    Charging Data Records
COC

    Cell Outage Compensation
COD

    Cell Outage Detection
COM

    Cell Outage Management
CNN

    Convolutional Neural Network
LSTM

    Long Short-Term Memory
RNN

    Recurrent Neural Network
CoMP

    Coordinated Multi Points
COOPCOM

    Comunicaciones Cooperativas y Oportunistas en Redes Inalámbricas
COGNET

    Cognitive networks
CRF

    Conditional Random Field
CRS

    Cognitive Radio System
CQI

    Channel Quality Indicator
CM

    Configuration Management
IM

    Inventory Management
CTTC

    Centre Tecnològic de Telecomunicacions de Catalunya
DA

    Discriminant Analysis
D-SON

    distributed SON
D-RRM

    distributed RRM
DCI

    Data Control Indication
DBSCAN

    Density-Based Spatial Clustering of Applications with Noise
HDBSCAN

    Hierachical-Density-Based Spatial Clustering of Applications with Noise
DBM

    Deep Boltzmann Machine
DBN

    Deep Belief Network
DNN

    Deep Neural Network
DL

    Downlink
DP

    Dynamic Programming
DSA

    Dynamic Spectrum Access
DT

    Decision Trees
E3

    End-to-End Efficiency
eNB

    Enhanced Node Base station
eNBs

    Enhanced Node Base stations
EIRP

    Equivalent Isotropically Radiated Power
EPC

    Evolved Packet Core
ETRI

    Electronics and Telecomunications Research Institute
ES

    Energy Saving
E-UTRAN

    Evolved Universal Terrestrial Radio Access Network
ETSI

    European Telecommunications Standards Institute
FFR

    Fractional Frequency Reuse
FL

    Fuzzy Logic
FE

    Feature Extraction
FS

    Feature Selection
GT

    Game Theory
Gandalf

    Monitoring and Self-tuning of RRM parameters in a Multi-System Network
GLM

    Generalized Linear Models
GPI

    Generalized Policy Iteration
GPRS

    General Packet Radio Service
GSM

    Global System for Mobile Communications
3GPP

    3rd Generation Partnership Project
5GPPP

    5G Infrastructure Public Private Partnership
GPRS

    General Packet Radio Service
GSM

    General System for Mobile Communications
HAGGEL

    An Innovative Paradigm for Autonomic Opportunistic Communication
HeNB

    Home eNodeB
Het-Net

    Heterogenous Network
HMM

    Hidden Markov Model
HO

    Handover
HOF

    Handover Failure
HII

    High Interference Indicator
IRP

    Integration Reference Point
IS

    Information Service
IEEE

    Institute of Electrical and Electronics Engineers
ICIC

    Inter-Cell Interference Coordination
IMS

    IP Multimedia Subsystem
IoT

    Internet of Things
IRAT

    Inter-Radio Access Technology
$k$-NN

     $k$-Nearest Neighbors
KPI

    Key Performance Indicator
LENA

    LTE-EPC Network Simulator
LTE

    Long Term Evolution
LTE-Advanced

    Long Term Evolution Advanced
LB

    Load Balancing
LTE-U

    LTE-Unlicensed
LAA

    Licensed Assisted Access
MAC

    Media Access Control
MDT

    Minimization of Drive Tests
M2M

    Machine to Machine
MIMO

    Multiple-input Multiple-output
MC

    Monte Carlo
MCS

    Modulation and Coding Scheme
MEC

    Mobile Edge Computing
MDP

    Markov Decision Process
MME

    Mobility Management Entity
MONOTAS

    Mobile Network Optimisation Through Advanced Simulation
MCC

    Mobile Cloud Computing
MLB

    Mobility Load Balancing
ML

    Machine Learning
ML

    Maximum Likelihood
MRO

    Mobility Robustness$/$Handover Optimisation
MWC

    Mobile World Congress
NB

    Naive Bayes
NBs

    Node Base station
NE

    Network Element
NET-REFOUND

    Network research foundations
NF

    Network Function
NGMN

    Next Generation Mobile Networks
NMS

    Network Management Systems
NM

    Network Management
NRM

    Network Resource Model
NFV

    Network Functions Virtualisation
NFVI

    NFV Infraestructure
OFDMA

    Orthogonal Frequency Division Multiple Access
OI

    Overload Indicator
OSS

    Operation and Support System
OPEX

    Operational Expenditure
OAM

    Operation and Maintenance Center
PCI

    Physical Cell ID
PC

    Principal Component
Pc

    Power control
PCA

    Principal component analysis
PCI

    Automated Configuration of Physical Cell Identity
PItoRC

    Policy Iteration to Resource Conflicts
PDF

    Probability Density Function
PGW

    PDN Gateway
PDSCH

    Physical Downlink Shared Channel
PDU

    Protocol Data Unit
PDSCH

    Physical Downlink Shared Channel
PUSCH

    Physical Uplink Shared Channel
PDCCH

    Physical Downlink Control Channel
PGW

    PDN Gateway
SGW

    Serving Gateway
PF

    Proportional Fair Scheduler
PHR

    Power Headroom Report
PM

    Performance Management
PRB

    Physical Resource Block
PS

    Packet Switched
PSD

    Power Spectral Density
PU

    Primary User
QoS

    Quality of Service
QoE

    Quality of Experience
QAM

    Quadrature Amplitude Modulation
RBF

    Radial basis function
RBM

    Restricted Botlzmann Machine
RACH

    Random Access Channel
RAN

    Radio Access Network
RAT

    Radio Access Technologies
RET

    Remote Electrical Tilt
RF

    Random Forest
RB

    Resource Block
RBG

    Resource Block Group
RBG

    Restricted Boltzmann Machine
REM

    Radio Environment Map
RL

    Reinforcement Learning
RLF

    Radio Link Failure
RNTP

    Relative Narrowband Transmit Power
RLC

    Radio Link Control
RMSE

    Root Mean Squared Error
RRC

    Radio Resource Control
RRM

    Radio Resource Management
RS

    Reference Signal
RSRP

    Reference Symbol Received Power
RSRQ

    Reference Symbol Received Quality
SAC

    Situated Autonomic Communications
SDN

    Self-Organized Network
SDSE

    Strongly Dominant Strategy Equilibrium
SELFNET

    Framework for Self-Organized Network Management in virtualized and Software Defined Networks
SEMAFOUR

    Self-Management for Unified Heterogeneous Radio Access Networks
SESAME

    Small cell coordination for multi-tenancy and edge services
SG

    Stochastic Games
SGSN

    Serving GPRS Support Node
SH

    Self Healing
SINR

    Signal to Interference and Noise Ratio
SLA

    Service Level Agreement
SM

    Saturation Mode
SML

    Stochastic Maximum Likelihood
SPCA

    Sparse Principal Component Analysis
SVMs

    Support Vector Machines
SVR

    Support Vector Regression
SDN

    Software Defined Network
TCE

    Trace Collection Entity
SL

    Supervised Learning
SO

    Self organization
SOCRATES

    Self-Optimisation and self-ConfiguRATion in wirelEss networkS
SOFOCLES

    Self-organized FemtOCeLls for broadband sErviceS
SOM

    Self-organizing Map
SON

    Self-organizing Networks
SOS

    Self organized System
SS

    Solution Sets
SL

    Supervised Learning
SIMO

    Single-input Multiple-output
subMDP

    Markov decision sub-process
TA

    Timing Advance
TCE

    Trace Collection Entity
TCP

    Transmission Control Protocol
TD

    Temporal Difference
TTT

    Time to Trigger
TTI

    Transmission Time Interval
TBS

    Transport Block Size
TXP

    Transmission Power
UDN

    Ultra Dense Network
UE

    User Equipment
UEs

    User Equipments
UMTS

    Universal Mobile Telecommunications System
UL

    Unsupervised Learning
UTRAN

    Universal Terrestrial Radio Access Network
WLAN

    Wireless Local Area Network
WCQI

    wideband CQI
AMF

    Access and Mobility Function
UPF

    User Plane Function
5G

    5th generation
5GC

    Fifth Generation Core Network
NG-RAN

    Next Generation RAN
NG-RAN

    Next Generation SON
NRT

    Neighbor Relation Table
NR

    New Radio
IT

    Information Technology
COTS

    Commercial off-the-shelf
VNN

    vehicular nomadic nodes
V-SON

    virtualized SON
VNF

    Virtual Network Function
ONF

    Open Networking Foundation
URLLC

    ultra-reliable and low-latency communications
mMTC

    massive machine-type communications
eMBB

    enhanced mobile broadband
RNTI

    Radio Network Temporary Identifier
IMSI

    International Mobile Subscriber Identity
TB

    Transport Block
PDCP

    Packet Data Convergence Protocol
PHY

    Physical layer
EOS

    Experience Oriented SON

# Big Data-driven Automated Anomaly Detection and Performance Forecasting in
Mobile Networks * ††thanks: This project has received funding from the
European Union’s Horizon 2020 research and innovation programme under the
Marie Skłodowska-Curie grant agreement No 712949 (TECNIOspring PLUS) and from
the Agency for Business Competitiveness of the Government of Catalonia. The
work by Mario García-Lozano has been funded by the Spanish ministry of science
through the project CRIN-5G (RTI2018-099880-B-C32) and with ERFD funds.

Jessica Moysen  Elisa Corporation, Helsinki, Finland
and Fundaciò i2CAT
<EMAIL_ADDRESS>Furqan Ahmed  Elisa Corporation
Helsinki, Finland
<EMAIL_ADDRESS>Mario García-Lozano  Universitat Politècnica de
Catalunya
Barcelona, Spain
<EMAIL_ADDRESS>Jarno Niemelä  Elisa Corporation
Helsinki, Finland
<EMAIL_ADDRESS>
###### Abstract

The massive amount of data available in operational mobile networks offers an
invaluable opportunity for operators to detect and analyze possible anomalies
and predict network performance. In particular, application of advanced
machine learning (ML) techniques on data aggregated from multiple sources can
lead to important insights, not only for the detection of anomalous behavior
but also for performance forecasting, thereby complementing classic network
operation and maintenance solutions with intelligent monitoring tools. In this
paper, we propose a novel framework that aggregates diverse data sets (e.g.
configuration, performance, inventory, locations, user speeds) from an
operational LTE network and applies ML algorithms to diagnose network issues
and analyze their impact on key performance indicators. To this end, pattern
identification and time-series forecasting algorithms are used on the ingested
data. Results show that proposed framework can indeed be leveraged to automate
the identification of anomalous behaviors associated with the spatial-temporal
characteristics, and predict customer impact in an accurate manner.

###### Index Terms:

Mobile networks, network management, big data, machine learning, anomaly
detection, algorithms

##  I Introduction

The 5th generation (5G) networks differ substantially from the previous
generations, leading to new challenges and opportunities. Most importantly, 5G
must be able to support new types of frequency bands, multi-connectivity,
spectrum and technologies. To fulfill these requirements, automation is
becoming increasingly important. Increased operation and management complexity
calls for novel intelligent solutions capable of not only handling the growing
complexity, heterogeneity, and dynamic nature of the network, but also the
monitoring of massive amounts of performance data and detection of anomalous
patterns in it. Another key driving factor is the challenging requirements of
5G and beyond 5G networks, which differ from Long Term Evolution (LTE) in a
multitude of ways. For example, the first version of LTE (Release 8) has about
8$\times$ less layer 1 parameters to be controlled via Radio Resource Control
(RRC), when compared to the first version of New Radio (Release 15).
Therefore, intelligent automation is of paramount importance for the network
management, optimization, and monitoring. Unsurprisingly, operators and
vendors have tremendous interest in evaluating the potential benefits of
automation and related challenges that future mobile networks will face as
advanced features of 5G networks are rolled-out[1, 2].

Recent advances in the field of cloud technologies and data processing
capabilities have paved the way for powering mobile network automation
solutions using machine learning (ML) techniques [3, 4]. In regards to this, a
key issue is the efficient processing of network data characterized by
challenges related to data volume, variety, velocity, and veracity. In the
context of mobile networks, data with such properties is referred to as _big
data_ [5]. In the context of mobile network automation, ML in conjunction with
big data is emerging as a potent tool for optimizing increasingly complex
networks[6, 5]. Moreover, apart from network optimization, it can be used for
enabling data-driven intelligence for performance monitoring in mobile
networks[7, 8, 9, 10]. Existing work on the monitoring and diagnosis of
network faults using ML techniques includes pattern identification, grouping,
and learning[11, 12]. This approach is motivated by the fact that massive
amounts of data generated in mobile networks necessitates pre-processing tasks
such as data reduction using feature selection and/or feature extraction
techniques. In [11], the authors propose a framework for managing high-
dimensional data and optimizing the performance of root cause analysis,
whereas [12] proposes an automatic diagnosis system that takes advantage of
self-organizing maps to build a system capable of identifying anomalous
behaviors in networks. Likewise, the approaches discussed for mobile traffic
forecasting in [13] and [14] are inspired by the estimation problem. In [13],
causal analysis and long short term memory (LSTM) models are used to predict
call detailed records. On the other hand, in [14], the authors focus on
extracting and modeling traffic patterns of base stations in a network. Based
on a time series analysis approach, mobile traffic is decomposed into
regularity and randomness components, which is subsequently used to forecast
the traffic patterns.

Figure 1: Big data-driven automated anomaly detection and prediction
framework.

In this paper, we propose a framework for analyzing possible anomalies and
monitoring mobile network performance using data aggregated from a variety of
data sources. The proposed framework: (1) collects the most representative key
performance indications (KPIs) from the data ingested from a live mobile
network; (2) constructs time series and applies clustering to classify them
based on geographical characteristics; and (3) makes use of feature extraction
techniques and regression models for performance forecasting. The approach is
based on identifying patterns in the spatio-temporal signatures of cells. The
capability of predicting the performances based on the grouping patterns
identified using clustering paves the way for designing fine grained
mitigating actions for each individual group of cells.

The rest of the paper is organized as follows. Section II describes the
proposed framework including data processing and ML workflow used for its
processing and analysis. Section III presents the details regarding
implementation of the propose framework and results. Finally, we draw our
conclusions and discuss possible directions for future work in Section IV.

##  II Framework

The proposed framework comprises of two main steps namely input data
processing and ML workflow. Data processing involves ingestion of mobile
network data from different sources and its aggregation, followed by
clustering and KPI forecasting which constitutes ML workflow step as depicted
in Fig. 1. Next, we discuss these steps in more detail.

###  II-A Data Processing

The main challenges involved in mobile network data ingestion, cleaning, and
aggregation, stem from the challenging characteristics of the data sets in
terms of volume, velocity, variety, and veracity. For example, inventory
management (IM) data consists of equipment information, which is almost
static. On the other hand, performance management (PM) data involves thousands
of counters that collect raw measurements from that network. Thus, it grows
continuously and requires time-series database for efficient storage and
querying. Long term storage is particularly challenging, but nevertheless
inevitable for some ML based use-cases. In this work, we consider following
mobile network data sources.

####  II-A1 CM and IM Data

Configuration Management (CM) data set essentially consists of radio access
network configuration parameters such eNB/cell ID, frequency bands, neighbor
relations, and settings of various features etc. These parameters determine
the performance of the network, and are adjusted during the roll-out and
optimization activities. On the contrary, IM data consists of information
related to location and inventory items such as equipment (base station,
antenna types etc.), services, and other infrastructure.

####  II-A2 PM Data

Performance Management (PM) data comprises of performance counters which
collect different measurements at regular intervals with a very high
granularity (e.g. 15 minutes to one hour), resulting in massive amounts of
time-series data. Moreover, measurements are collected at various levels e.g.
cell, neighbor relation etc. For example, cell throughput counter collects
cell level throughput, whereas handover counters collect handover statistics
per neighbor relation. However, PM data is used not only in performance
monitoring but also in the ML based prediction algorithms.

####  II-A3 Movement and Speed Data

Mobility characteristics such as movement patterns and speed of the mobile
users are very important for predicting network performance from a user
perspective. Here, we use Google Maps platform to estimate user’s speed at a
given location. By using this information in conjunction with the cell
location, it is possible to estimate the speed of users in a cluster of cells
located in a certain area.

###  II-B Workflow

The ML workflow comprises of two main steps, namely _clustering_ and _time
series forecasting_. As shown in Fig. 1, the first step creates a group of
clusters based on spatial characteristics e.g. cell location and estimated
user’s speed, followed by the detection of anomalous behaviours associated
with temporal characteristics. In the second step, features are extracted and
network performances is predicted using time-series forecasting to enable
proactive troubleshooting in the cases where anomalous behavior is expected.

####  II-B1 Clustering

The idea is to create of groups of signatures to understand the spatio-
temporal characteristics and how they correlate with the performance
experienced by end users. To this end, the first step creates clusters using
data on cell location, estimated user speeds. The PM data considered includes
different cell KPIs related to traffic, congestion, and mobility problem
activities during a number of hours. The number of cells and duration of the
raw measurement intervals determines the granularity of the data. Let us
consider a cell $i\in\mathcal{I}$, where the number of cells in the whole
network is $N$. Let $\mathbf{x}_{i}=\left[x_{i,1}\dots
x_{i,m}\right]^{T}\in\mathbb{R}^{m}$ denote the vector of KPI values for cell
$i$. The data for all the cells is collected in a matrix
$\mathbf{X}=[\mathbf{x}_{1},\dots,\mathbf{x}_{N}]\in\mathbb{R}^{{N}\times m}$.
Once the time series is created, signatures belonging to same geographical
regions are grouped together. We consider geographical information for
partitioning $\mathbf{X}$, the resulting partition $\mathcal{C}$ comprises of
$K$ labelled clusters $\mathcal{C}\coloneqq\left(C_{1},\dots C_{k}\dots
C_{K}\right)$. That is, the output is a set of classes of signatures, denoted
as $\mathcal{C}$. We aggregate statistics of each KPI considered for the cells
in each cluster. The location and velocities of users present in the coverage
area of each cell is also taken into account. The output is a correlation
analysis that allows us to detect if a cluster is associated to a particular
set of anomalies. By analysing each group of signatures over time, anomalous
behaviour impacting network performances can be identified.

####  II-B2 KPI forecasting

The next step is to predict how the considered KPIs will evolve (e.g. when and
in which cluster anomalous behavior is likely to occur). This gives a dynamic
picture of the network state, including information that can be used to handle
expected performance degradation in a preemptive manner. Following the
approach in [15], an efficient reduction of time-series data is done first via
feature extraction process, where each feature captures a specific measurable
characteristic of the time-series. The statistical features considered are
derived from basic summary statistics and aspects of sample distribution.
Moreover, features from observed dynamics are also considered. These include
Auto-regressive integrated moving average (ARIMA) model coefficients obtained
by fitting the unconditional maximum likelihood of an autoregressive process
on the time-series with a maximum lag $m_{\rm T}$, mean absolute change, and
mean auto-correlation. A full summary of the features is delineated in TABLE
I.

Table I: Extracted features From sample statistics |  Description
---|---
Maximum($\mathbf{x}$) |  Maximum sample of time series $\mathbf{x}$.
Minimum($\mathbf{x}$) |  Minimum sample time series $\mathbf{x}$.
Mean($\mathbf{x}$) |  Arithmetic mean of time series $\mathbf{x}$.
Var($\mathbf{x}$) |  Expectation of the squared deviation of time series $\mathbf{x}$ from its mean $\mathbf{X}$ without bias.
Skewness($\mathbf{x}$) |  Sample calculated with adjusted Fisher-Pearson standardized moment coefficient.
Kurtosis($\mathbf{x}$) |  Fourth central moment of time series $\mathbf{x}$ divided by the square of its variance
Median($\mathbf{x}$) |  For a time series $\mathbf{x}$ with an uneven number of samples, the median is the middle of the sorted time series values.
From sample distribution |  Description
Variance greater than std($\mathbf{x}$) |  The feature indicates if the variance is greater than the standard deviation.
Number of values that are above/below median |  Number of values, which are larger/lower than the median value of the time series sample
From observed dynamics |  Description
ARIMA model coefficients |  The feature meets the unconditional maximum likelihood of an auto-regressive process with a maximum lag $m_{\rm T}$.
Mean absolute change($\mathbf{x}$) |  Arithmetic mean of absolute differences between subsequent time series values.
Mean auto-correlation($\mathbf{x}$) |  Average auto-correlation over possible lags $l$ ranging from $1$ to $m$.

The new features are used to train an ensemble method to predict the next time
step. As highlighted in [16], ensemble methods are learning models, which
combine the opinions of multiple learners[17]. The learning algorithm is run
several times, each one with different subset of training samples. We use Ada-
Boost regressor, which maintains a set of weights over the original training
set, and adjusts these weights by increasing the weight of examples that are
miss-classified, and decreasing the weight of examples that are correctly
classified. For every value, the historical data is used to fit the model and
predict the next value. We evaluate the performance by via a comparison of
predicted value against the true value in terms of mean absolute error (MAE),
which measures the error between the predicted and true value in terms of the
arithmetic average of the absolute errors $|e_{i}|=|\hat{y}_{i}-y_{i}|$, where
$\hat{y}_{i}$ is the prediction and $y_{i}$ is the true value.

##  III Implementation & Results

For implementation, we use commercial LTE network datasets from a major
Finnish mobile operator. The total number of cells in the dataset is $N$ =
$5672$, with one week of PM data $m$ = $168$ (i.e granularity of sixty
minutes). Following four cell level KPIs described in TABLE II are considered
to construct time-series matrices
$\mathbf{X_{1}},\mathbf{X_{2}},\mathbf{X_{3}},\mathbf{X_{4}}$: handover
success rate (HOSR), downlink throughput, downlink traffic, and RRC connection
request rate.

The CM and IM data used for implementing spatial clustering includes cell ID,
latitude, longitude, name of the site and eNB, value of bearing(s) and
neighbouring cells. The expected cell size of each cell as the $90$-th
percentile distance from source cell to target cell. The data related to
users’ locations and speed measurements comprising of actual traces is
downloaded from the Google Maps APIs. This API allows us to get information
such as speed limits (from $0$ to $100$ Km/h) and the way points of different
travel modes (i.e. driving, walking, cycling and public transportation), which
is used to estimate the speed of users likely present in the coverage area.
Spatial clustering yields a set of $11$ clusters in the network with different
speeds and locations. The matrices
$\mathbf{X_{1}},\mathbf{X_{2}},\mathbf{X_{3}},\mathbf{X_{4}}$ are split
accordingly for the detection of anomalies in the resulting time-series, at
the level of individual clusters. The cluster level time series analysis helps
to identify the signatures of mobility related anomalies. For instance,
results for a cluster where the average speed is greater than $50$ Km/h (i.e.
travel mode of users is driving and$/$or public transportation) are shown in
Figures 2 and 3, for normal and the abnormal KPI signatures respectively. The
x-axis represents the number of hours in one week, while the y-axis represents
the normalised value of each KPI considered. From this figure, we can observe
the trend and seasonality KPI variations at the daily and weekly level. Figure
3 suggests that on the first three days of the week (Monday, Tuesday, and
Wednesday) the trend component deviates from the normal signature, and is
clearly identified as an anomaly.

Table II: KPIs analyzed from PM data KPI |  Description
---|---
Handover successful rate (HOSR) percentage |  This indicator is calculated as the ratio between successful handovers divided by the total number of handovers every hour.
Downlink cell throughput (Mbps) |  This indicator is calculated as the downlink throughput at the Packet Data Convergence Protocol (PDCP) layer in cell $i$ divided by total duration for transmitting downlink data at the PDCP layer $/$ 1000.
Downlink traffic (MB) |  This indicator is calculated by the downlink throughput at the PDCP layer.
RRC Connection Request rate percentage |  This indicator is calculated as the success ratio for the RRC connection establishment divided by RRC connection request attempts.
Figure 2: KPI signatures representing normal behaviours (average speed $>50$
Km/h). Figure 3: KPI signatures representing abnormal behaviours (average
speed $>50$ Km/h). Figure 4: Predicted, last, and real KPI value. Time series
with abnormal behaviours. Figure 5: Predicted, last, and real KPI value. Time
series with normal behaviours.

(a)

(b)

Figure 6: Mean absolute error considering time series with normal (Fig. 6(a))
and abnormal behaviours (Fig. 6(b)).

Following this procedure, anomalies can be localized and detected at cluster
level. The first step towards predicting KPI values is the extraction of
features in TABLE I from the data. We consider a number of basic features from
sample statistics (e.g. maximum, minimum, mean, variance, skewness, kurtosis,
and median) and sample distribution (e.g. variance greater than standard
deviation, and number of values that are above/below median). From observed
dynamics, ARIMA model coefficients with the maximum lag of $m_{\rm T}=20$,
mean absolute change, and mean auto-correlation are extracted. For the
detection, we use Ada-Boost regressor with a linear loss function. The
parameters include learning rate and the number of estimators, which are set
to the default values of one and ten respectively. In the plots shown in
Figures 4 and 5, the red curve is the output of the Ada-Boost regressor, the
green curve is the true value, and as a benchmark we consider the last value
before the prediction (blue curve). Figure 4 shows the performance on the time
series with anomalous behaviours, whereas Fig. 5 corresponds to time series
with normal or expected behaviour. From these figures, we observe that both
approaches perform quite well. However, Ada-Boost outperforms the benchmark
approach on the time series with normal behaviours. This can also be observed
in Fig. 6, which shows the MAE performance metric for each KPI. The dark grey
bar corresponds to the error between Ada-Boost regressor (labeled as
_predicted_) and benchmark value (labeled as _last value_), whereas the light
grey bar corresponds to the error between predicted and real value. It is
clear that Ada-Boost regressor outperforms the benchmark approach, as it leads
to a smaller error. However, opposite behavior can be observed in Fig. 6(b),
where the error between predicted and real value is greater than the error
between the predicted value and benchmark last value. It is worth noting that
since historical values are used to generate new features, the accuracy of the
Ada-Boost regressor model decreases if anomalies are presented in the data. In
such case, considering only the last value for the prediction gives us better
results. The insights thus gained from different KPIs can be used to not only
analyze the performance in detail but also to identify the root-cause and
nature of the anomalies, and suggest corrective actions.

##  IV Conclusion

We have proposed a framework that makes use of various mobile network data
sets supplemented by external data sources, for the automated analysis and
prediction of mobile network KPIs. The framework is implemented by using some
of the common KPIs used by radio network engineers for the diagnosis and
troubleshooting tasks. Results demonstrate that clustering based KPI analysis
and anomaly detection, and the use of feature extraction and time-series
prediction models enables efficient analysis of network data and helps in
identifying possible anomalous behavior. This paves the way for improved
network performance and operational efficiency, thereby reducing the time that
engineers spend analysing huge amount of network performance data. Possible
directions for future work include automated root cause analysis of the
detected anomalies followed by intelligent and pro-active self-healing
mechanisms.

## References

  * [1] W. Saad, M. Bennis, and M. Chen, “A vision of 6g wireless systems: Applications, trends, technologies, and open research problems,” 2019.
  * [2] F. Tariq, M. Khandaker, K.-K. Wong, M. Imran, M. Bennis, and M. Debbah, “A speculative study on 6g,” 2019.
  * [3] M. Chen, U. Challita, W. Saad, C. Yin, and M. Debbah, “Artificial neuralnetworks-based machine learning for wireless networks,” _A tutorial, IEEE Communications Surveys and Tutorials_ , 2019.
  * [4] J. Moysen and L. Giupponi, “From 4G to 5G: Self-Organized Network Management meets Machine Learning,” _Journal on Computer on Communications, ELSEVIER_ , vol. 129, pp. 248–268, 2018.
  * [5] A. Imran, A. Zoha, and A. Abu-Dayya, “Challenges in 5g: how to empower son with big data for enabling 5g,” _IEEE Network_ , vol. 28, no. 6, pp. 27–33, 2014.
  * [6] J. Joseph, F. Ahmed, T. Jokela, O. Tirkkonen, J. Poutanen, and J. Niemela, “Big data enabled mobility robustness optimization for commercial lte networks,” in _2020 IEEE Wireless Communications and Networking Conference (WCNC)_ , 2020, pp. 1–6.
  * [7] J. Ma and S. Lin, “Big data enabled anomaly user detection in mobile wireless networks,” in _2019 IEEE 5th International Conference on Computer and Communications (ICCC)_ , 2019, pp. 479–484.
  * [8] S. Han, I. Chih-Lin, G. Li, S. Wang, and Q. Sun, “Big data enabled mobile network design for 5g and beyond,” _IEEE Communications Magazine_ , vol. 55, no. 9, pp. 150–157, 2017.
  * [9] K. Zheng, Z. Yang, K. Zhang, P. Chatzimisios, K. Yang, and W. Xiang, “Big data-driven optimization for mobile networks toward 5g,” _IEEE Network_ , vol. 30, no. 1, pp. 44–51, 2016.
  * [10] P. Chiu, J. Reunanen, R. Luostari, and H. Holma, “Big data analytics for 4.9g and 5g mobile network optimization,” in _2017 IEEE 85th Vehicular Technology Conference (VTC Spring)_ , 2017, pp. 1–4.
  * [11] D. Palacios, S. Fortes, I. de-la-Bandera, and R. Barco, “Self-Healing Framework for Next-Generation Networks through Dimensionality Reduction,” _IEEE Communications Magazine_ , vol. 56, no. 7, pp. 170–176, 2018.
  * [12] A. Gómez-Andrades, P. Muñoz, I. Serrano, and R. Barco, “Automatic root cause analysis for lte networks based on unsupervised techniques,” _IEEE Transactions on Vehicular Technology_ , vol. 65, no. 4, pp. 2369–2386, 2016.
  * [13] Zhang et al., “A new method for traffic forecasting in urban wireless communication network ,” _EURASIP Journal on Wireless Communications and Networking_ , 2019.
  * [14] F. Xu et.al, “Big Data Driven Mobile Traffic Understanding and Forecasting: A Time Series Approach,” _IEEE Transactions on Services Computing_ , vol. 9, no. 5, pp. 796–805, 2016.
  * [15] Maximilian Christ, Andreas W. Kempa-Liehr, Michael Feindt. (Accessed on April 6, 2020) Distributed and parallel time series feature extraction for industrial big data applications. [Online]. Available: https://arxiv.org/abs/1610.07717
  * [16] J. Moysen, L. Giupponi, J. Mangues-Bafalluy, “On the Potential of Ensemble Regression Techniques for Future Mobile Network Planning,” _IEEE Symposium on Computers and Communications (ISCC)_ , 2016.
  * [17] T. Dietterich, “An experimental comparison of three methods for constructing ensembles of decision trees: bagging, boosting and randomization,” _Machine Learning_ , vol. 40, p. 139–157, 2000.

  *[LTE]: Long Term Evolution
  *[RRC]: Radio Resource Control
  *[CM]: Configuration Management
  *[PM]: Performance Management
  *[PDCP]: Packet Data Convergence Protocol