KR102389909B1 - Apparatus and method for detecting abnormality of wireless network - Google Patents

Abstract

The present invention relates to an apparatus and a method for detecting abnormality of wireless network, which is to detect abnormality of wireless network by each cell based on the Mahalanobis distance considering the cluster characteristics of data. The apparatus according to an embodiment includes: a quality data receiving unit receiving wireless network quality data collected from a cell; a preprocessing unit preprocessing the received wireless network quality data; a Mahalanobis distance calculation unit calculating the distance between preset clusters of the corresponding cell and the preprocessed wireless network quality data and determining and storing the minimum Mahalanobis distance therefrom; and an abnormality detection unit. In a case where the minimum Mahalanobis distance exceeds a first threshold, the abnormality detection unit defines a predetermined number of preprocessed and latest wireless network quality data of the corresponding cell as a temporary cluster. In a case where the total distance between the temporary cluster and preset clusters related to the temporary cluster exceeds a second threshold, the abnormality detection unit determines that the wireless network quality of the cell is abnormal.

Description

Apparatus and method for detecting abnormality of wireless network }

The present invention relates to an apparatus and method for detecting anomaly in a wireless network, and more particularly, to an apparatus and method for detecting anomaly in a wireless network for detecting anomaly in a wireless network based on a cluster-aware Mahalanobis distance.

In a mobile communication system, wireless network monitoring is performed to detect abnormalities such as failures. In general, the NMS (Network Management System) of a mobile communication system periodically collects data from the EMS (Element Management System) that manages base station equipment and performs statistical analysis, and the wireless network quality management system utilizes the statistical data analyzed in the NMS Alternatively, if necessary, each regional office detects anomalies in the wireless network by directly collecting some of the data collected from the EMS and deriving a wireless network quality indicator (eg, Key Performance Indicator). For example, anomalies in the wireless network are detected by deriving wireless network quality indicators such as SINR, BLER, and the number of call cuts. As described above, since some wireless network quality indicators calculated from the raw data are monitored without using all of the raw data on the wireless network quality, abnormal conditions other than the case where the corresponding wireless network quality indicator deteriorates are detected. has the disadvantage of being difficult.

On the other hand, although the failure occurrence standards are clear for failures such as failure of wireless network equipment or cable breakage, there is a problem in that the quality deterioration standards are not clear in the detection of abnormalities using wireless network quality indicators. In general, quality abnormalities are judged by monitoring wireless network quality indicators based on absolute thresholds. And, despite the fact that each cell (Radio Unit) of the radio network has different radio network quality indicator probability distribution characteristics according to the geographic characteristics of the region and the traffic trends of users by time, the absolute same for all cells across the country Standards are applied collectively. These absolute standards depend on the manager's experience. Therefore, it is difficult to accurately detect anomalies in the wireless network. The normal state may be determined to be an abnormal state, or an abnormal state may be determined to be a normal state.

The present invention provides a wireless network anomaly detection device and wireless network anomaly detection device for detecting wireless network anomalies in units of each cell based on Mahalanobis distance in consideration of cluster characteristics of data using all data related to wireless network quality The purpose is to provide a method.

A wireless network anomaly detection apparatus for detecting an abnormality in a wireless network according to an embodiment includes: a quality data receiver configured to receive wireless network quality data collected in a cell; a pre-processing unit for pre-processing the received wireless network quality data; a Mahalanobis distance calculator for calculating a distance between the preprocessed wireless network quality data and a plurality of preset clusters of the cell, and determining and storing a minimum Mahalanobis distance among them; and if the minimum Mahalanobis distance is greater than the first threshold, defining a recent predetermined number of preprocessed radio network quality data of the cell as a temporary cluster, and the distance between the temporary cluster and a preset cluster associated with the temporary cluster When the sum is greater than the second threshold, an anomaly detection unit that determines that the wireless network quality of the corresponding cell is abnormal is included.

The anomaly detector may determine that the radio network quality is abnormal when a sum of the minimum Mahalanobis distances of each of the radio network quality data belonging to the temporary cluster is greater than the second threshold value.

The anomaly detection unit classifies the temporary cluster into a plurality of sub-clusters, and determines that the wireless network quality is abnormal when a sum of distances between each sub-cluster and a corresponding preset cluster is greater than the second threshold. can

The anomaly detection unit may classify the temporary cluster into the plurality of sub-clusters according to the type of a preset cluster for which the minimum Mahalanobis distance of each wireless network quality data belonging to the temporary cluster is calculated.

In calculating the distance between each sub-cluster and a corresponding preset cluster, the anomaly detection unit may calculate the distance for each element by applying a weight to each element of the vector, and then add the distances.

The anomaly detection unit is configured to classify the temporary cluster into a plurality of sub-clusters, and each sub-cluster and its When the sum of all distances between corresponding preset clusters is greater than the fourth threshold, it may be determined that the quality of the wireless network is abnormal.

If the minimum Mahalanobis distance is less than or equal to a first threshold, the wireless network anomaly detection device may further include a cluster management unit that adds the wireless network quality data preprocessed in the preprocessor to a preset cluster and performs a clustering update. can

The wireless network anomaly detection device may further include a cluster management unit that adds wireless network quality data in which a minimum Mahalanobis distance is smaller than a cutoff criterion among wireless network quality data belonging to the temporary cluster to a preset cluster and performs a clustering update. can

A method of detecting anomaly in a wireless network in a wireless network anomaly detection apparatus according to an embodiment includes: receiving wireless network quality data collected in a cell; pre-processing the received radio network quality data; calculating a distance between the preprocessed wireless network quality data and a plurality of preset clusters of the cell, and determining and storing the minimum Mahalanobis distance among them; and if the minimum Mahalanobis distance is greater than the first threshold, defining a recent predetermined number of preprocessed radio network quality data of the cell as a temporary cluster, and the distance between the temporary cluster and a preset cluster associated with the temporary cluster and when the sum is greater than the second threshold, determining that the wireless network quality of the corresponding cell is higher than that of the corresponding cell.

In the determining of the wireless network quality abnormality, when the sum of the minimum Mahalanobis distances of each wireless network quality data belonging to the temporary cluster is greater than the second threshold value, the wireless network quality abnormality may be determined. .

In the step of determining that the radio network quality is abnormal, the temporary cluster is classified into a plurality of sub-clusters, and when the sum of all distances between each sub-cluster and a corresponding preset cluster is greater than the second threshold, the It can be judged more than the network quality.

The determining of the wireless network quality abnormality may include: classifying the temporary cluster into the plurality of sub-clusters according to the type of a preset cluster from which the minimum Mahalanobis distance of each wireless network quality data belonging to the temporary cluster is calculated may include

In the determining of the wireless network quality abnormality, in calculating the distance between each sub-cluster and a preset cluster corresponding thereto, a weight is applied to each element of the vector to calculate the distance for each element, and then the distance can be summed. .

In the determining of the wireless network quality abnormality, if the sum of the minimum Mahalanobis distances of each wireless network quality data belonging to the temporary cluster is less than or equal to a third threshold, classifying the temporary cluster into a plurality of sub-clusters, , when the sum of all distances between each sub-cluster and a corresponding preset cluster is greater than the fourth threshold, it may be determined that the quality of the wireless network is abnormal.

The method may further include, if the minimum Mahalanobis distance is equal to or less than a first threshold, adding the radio network quality data preprocessed in the preprocessing step to a preset cluster and performing a clustering update.

The method may further include adding radio network quality data having a minimum Mahalanobis distance smaller than a cutoff criterion among radio network quality data belonging to the temporary cluster to a preset cluster and performing a clustering update.

The present invention enables precise analysis of wireless network quality by detecting wireless network anomalies using all data on wireless network quality without relying on specific wireless network quality indicators.

The present invention enables general-purpose anomaly detection for the wireless network of the entire mobile communication system by detecting wireless network anomalies in each cell unit based on the Mahalanobis distance in consideration of data characteristics.

1 is a network configuration diagram of a system for detecting anomalies in a wireless network according to an embodiment of the present invention.
2 is a diagram showing the configuration of a wireless network anomaly detection apparatus according to an embodiment of the present invention.
3 is an example illustrating a Mahalanobis distance between radio network quality data of a specific cell and a plurality of preset clusters according to an embodiment of the present invention.
4 is a graph for explaining a process of defining N recent wireless network quality data as temporary clusters according to an embodiment of the present invention.
5 is an example illustrating a distance between a temporary cluster for each element and a preset cluster according to an embodiment of the present invention.
6 is a flowchart illustrating a wireless network anomaly detection method according to an embodiment of the present invention.
7 is a flowchart illustrating a wireless network anomaly detection method according to another embodiment of the present invention.
8 is a flowchart illustrating a wireless network anomaly detection method according to another embodiment of the present invention.

The above-described objects, features, and advantages will become more apparent through the following detailed description in relation to the accompanying drawings, whereby those of ordinary skill in the art to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in the description of the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a network configuration diagram of a system for detecting anomalies in a wireless network according to an embodiment of the present invention. 1, the system according to this embodiment, a radio unit (RU: Radio Unit) 110, a distributed unit (DU: Distributed Unit) 120, a central unit (CU: Central Unit) 130, It includes an element management system (EMS) 140 and a wireless network anomaly detection device 150 .

A radio unit (RU) 110 , a distribution unit (DU) 120 and a central unit (CU) 130 constitute a 5G NR base station. The 5G NR base station is divided according to function in a three-tier structure to maximize network operation efficiency. Each component is generally constructed separately, but a distributed unit (DU) 120 - a central unit (CU) 130 integrated or a radio unit (RU) 110 - a distributed unit (DU) ( 120) may be configured as an integral type or the like.

A radio unit (RU) 110 is a basic unit constituting a cell in a base station system, and performs an RF function. One or more radio units (RU) 110 are connected to one distributed unit (DU) 120 , and one or more radio units (RU) 110 distributed geographically to cover a specific area are installed can be A connection network between the radio unit (RU) 110 and the distribution unit (DU) 120 may be referred to as a 'fronthaul'. To operate the front hall, an interface such as, for example, a common public radio interface (CPRI) may be used.

The central unit (CU) 130 may configure RRC and PDCP network functions, and the distributed unit (DU) 120 may configure RLC, MAC, and PHY network functions to form a separate structure. Alternatively, the central unit (CU) 130 may configure RRC, PDCP, RLC, and MAC network functions, and the distributed unit (DU) 120 may configure only the PHY network functions. In addition, some functions that allow non-real-time processing of RLC or MAC may be configured by distributing them in the central unit (CU) 130 and some functions requiring real-time processing in the distributed unit (DU) 120 as needed. .

The EMS 140 manages network devices. In this embodiment, the EMS 140 manages the units constituting the above-described base station system. The radio network quality data collected in the radio unit (RU) 110 is transmitted to the EMS 140 via the distribution unit (DU) 120 and the central unit (CU) 130 . The EMS 140 receives the radio network quality data collected from all radio units (RUs) 110 within the jurisdiction in a predetermined format, and transmits the received radio network quality data to the radio network anomaly detection device 150 . . In another embodiment, the EMS 140 may be connected to a Network Management System (NMS) to transmit wireless network quality data to the NMS, and the NMS may transmit the wireless network quality data to the wireless network anomaly detection device 150 .

The radio network anomaly detection device 150 uses the radio network quality data of each radio unit (RU) 110 collected through the EMS 140 to each radio unit (RU) 110 , that is, in units of cells. Perform network anomaly detection. A method of performing wireless network anomaly detection in the wireless network anomaly detection apparatus 150 will be described in detail below with reference to the drawings.

2 is a diagram showing the configuration of a wireless network anomaly detection apparatus according to an embodiment of the present invention. Referring to FIG. 2 , the wireless network anomaly detection device 150 includes a quality data receiving unit 210 , a preprocessing unit 220 , a Mahalanobis distance calculating unit 230 , an anomaly detecting unit 240 , and a cluster management unit 250 . ) is included. These components may be implemented as a program and stored in the memory of the wireless network anomaly detection device 150 and may be executed and operated by at least one or more processors, or may be implemented and operated by a combination of software and hardware.

The quality data receiving unit 210 receives radio network quality data collected from each radio unit (RU) 110 , that is, each cell. The quality data receiving unit 210 may receive radio network quality data from the EMS 140 or may receive radio network quality data from the NMS. The quality data receiving unit 210 may receive wireless network quality data at regular intervals. Here, the radio network quality data is raw data collected from each RIDOR unit (RU) 110, and is vector type data. For example, it may be composed of radio network quality data x(n)={P ₀ , P ₁ ,..., P _m } received at the first time in the first radio unit, P ₀ ,... , P _m are respective parameter values collected by the first radio unit.

로 표기할 수 있다.The pre-processing unit 220 performs pre-processing on the received wireless network quality data and stores it in a storage unit such as a memory. Here, the preprocessing includes, for example, removal of unnecessary values such as Not-A-Number value processing, normalization operations, weight setting, dimension reduction, and the like. In the case of dimensionality reduction, an auto-encoder, principal component analysis (PCA), or the like can be used. Dimension reduction means, for example, processing such as reducing 100 elements constituting a vector to 50. Since this pre-processing is a technique commonly used in data processing, a detailed description thereof will be omitted here. Preprocessed wireless network quality data

can be denoted as

The Mahalanobis distance calculating unit 230, the distance between the radio network quality data of each cell preprocessed by the preprocessing unit 220, and a plurality of preset clusters of each cell, that is, the Mahalanobis Distance (MD) ) is calculated. For example, in the first cell, past radio quality data selected for the first to third clusters are stored in a storage unit such as a memory or a database, and the first radio network quality data collected in the first cell is When present, the Mahalanobis distance between the first cluster and the first wireless network quality data, and the Mahalanobis distance between the second cluster and the first wireless network quality data, and the Mahalanobis distance between the third cluster and the first wireless network quality data Calculate the Novice distance, respectively.

Here, a cluster is a set of data. In a general base station wireless environment, wireless network quality data has a plurality of different distribution characteristics due to various causes, such as different user distribution characteristics for each time period in the same cell. For example, the wireless network quality data has different distribution characteristics during dawn, daytime, and night time zones. A cluster is a set of wireless network quality data according to these different distribution characteristics. A plurality of clusters are set for one cell, and the Mahalanobis distance to each cluster is calculated whenever wireless network quality data is periodically collected. do.

The Mahalanobis distance calculating unit 230, the distance between the radio network quality data of each cell preprocessed by the preprocessing unit 220, and a plurality of preset clusters of each cell, that is, the Mahalanobis Distance (MD) ) is calculated, and the smallest Mahalanobis distance is selected among them and stored in the storage unit. The Mahalanobis distance calculating unit 230 calculates the minimum Mahalanobis distance for each cell whenever wireless network quality data is collected from each cell and stores the calculated minimum Mahalanobis distance in the storage unit.

는 다음 수학식1과 같이 계산된다.Minimum Mahalanobis distance for radio network quality data x(n) in this embodiment

is calculated as in Equation 1 below.

(Equation 1)

는 전처리된 무선망 품질 데이터이며,

은 m번째 클러스터에 속하는 벡터 데이터에 대한 무게 중심(Centroid)이고,

은 m번째 클러스터에 속하는 벡터 데이터에 대한 공분산 행렬(Covariance Matrix)의 역행렬(Inverse Matrix)이다. where m is the index of the cluster,

is the pre-processed wireless network quality data,

is the centroid of the vector data belonging to the mth cluster,

is the inverse matrix of the covariance matrix for vector data belonging to the mth cluster.

라면, 해당 무선망 품질 데이터와 기 설정된 각 클러스터 간의 마할라노비스 거리가 상기 (수학식1)에 의해 산출되고, 그 중에서 가장 짧은

이 최소 마할라노비스 거리가 결정된다. 3 is an example illustrating a Mahalanobis distance between radio network quality data of a specific cell and a plurality of preset clusters according to an embodiment of the present invention. Referring to FIG. 3 , in a specific cell, three (m=1, 2, 3) preset clusters exist. Each of the white circles in each cluster represents past preprocessed radio network quality data belonging to each cluster. Each radio network quality data is vector data. The recently received and preprocessed wireless network quality data

, then the Mahalanobis distance between the wireless network quality data and each preset cluster is calculated by Equation 1 above, and the shortest

This minimum Mahalanobis distance is determined.

)을 비교하여, 최소 마할라노비스 거리가 제1임계값 보다 크면, 해당 셀에 대한 이상 탐지 여부를 판단하는 세부 절차를 수행하고, 최소 마할라노비스 거리가 제1임계값 이하인 경우, 해당 셀은 정상으로 판단하여 세부 절차를 수행하지 않는다.Anomaly detection unit 240, the minimum Mahalanobis distance selected by the Mahalanobis distance calculating unit 230, and a first threshold value (

), and if the minimum Mahalanobis distance is greater than the first threshold, a detailed procedure for determining whether to detect anomalies for the cell is performed, and if the minimum Mahalanobis distance is less than or equal to the first threshold, the cell is It is judged to be normal and detailed procedures are not performed.

)의 최소 마할라노비스 거리(

)가 제1임계값(

) 보다 크면, 해당 가장 최근의 무선망 품질 데이터를 포함하여 최근 N개의 무선망 품질 데이터를 임시 클러스터로 정의한다. 본 실시예에서는 최근 5개의 무선망 품질 데이터를 임시 클러스터로 정의한다.When the minimum Mahalanobis distance in a specific cell is greater than the first threshold value, the anomaly detection unit 240 defines N most recent radio network quality data of the corresponding cell as a temporary cluster. 4 is a graph for explaining a process of defining N recent wireless network quality data as temporary clusters according to an embodiment of the present invention. As shown in FIG. 4, 100 radio network quality data were collected from a specific cell, and the most recent radio network quality data (

) of the minimum Mahalanobis distance (

) is the first threshold (

), the latest N radio network quality data including the most recent radio network quality data is defined as a temporary cluster. In this embodiment, the last five radio network quality data are defined as temporary clusters.

The anomaly detection unit 240 calculates a distance between the temporary cluster and preset clusters associated with the N pieces of wireless network quality data, and when the calculated distance is equal to or greater than a second threshold, the wireless network quality of the corresponding cell is abnormal can be judged as A method of calculating the distance between the temporary cluster and the associated preset clusters can be divided into two types.

)을 비교하여, 최근 N개의 최소 마할라노비스 거리들을 모두 더한 값이 제3임계값 보다 크면, 무선망 품질 이상으로 판단할 수 있다. 최근 N개의 최소 마할라노비스 거리들을 합하는 수식은 다음 (수학식2)와 같다.As a first method, the anomaly detection unit 240 adds up all the minimum Mahalanobis distances of each of the N most recent preprocessed radio network quality data belonging to the temporary cluster. And the anomaly detection unit 240, the added value and the third threshold value (

), if the sum of all recent N minimum Mahalanobis distances is greater than the third threshold, it can be determined that the quality of the wireless network is abnormal. The formula for summing the recent N minimum Mahalanobis distances is as follows (Equation 2).

(Equation 2)

Here, K ₁ is a final distance to be obtained, n is an index of the most recent wireless network quality data, and N may be, for example, a natural number such as 5.

)을 비교하여, 그 더한 값이 제4임계값 보다 크면, 무선망 품질 이상으로 판단할 수 있다. 이때, 이상 탐지부(240)는, 각 서브 클러스터와 이에 대응하는 기 설정된 클러스터 간의 거리를 계산하는데 있어서, 벡터의 각 원소별로 가중치를 적용하여 각 원소별 거리를 계산한 후 이를 합산할 수 있다. 이를 수식으로 표현하면 다음 (수학식3)과 같다.As a second method, the anomaly detection unit 240 uses the N most recent pre-processed radio network quality data belonging to the temporary cluster according to the type of a preset cluster for which each minimum Mahalanobis distance is calculated, and a plurality of sub-clusters , and all distances between each sub-cluster and a corresponding preset cluster are added. And the anomaly detection unit 240, the added value and the fourth threshold value (

), and if the added value is greater than the fourth threshold, it can be determined that the quality of the wireless network is abnormal. In this case, in calculating the distance between each sub-cluster and a preset cluster corresponding thereto, the anomaly detection unit 240 may calculate the distance for each element by applying a weight to each element of the vector, and then sum the distances. Expressing this as a formula is as follows (Equation 3).

(Equation 3)

와

는 각각 m번째 기 설정된 클러스터에 속한 벡터들의 l번째 원소 값들의 평균과 표준편차,

와

는 각각 m번째 기 설정된 클러스터와 연관된 서브 클러스터에 속한 벡터들의 l번째 원소 값들의 평균과 표준편차이다.Here, K ₂ is the final distance to be obtained, C is the preset cluster associated with the temporary cluster, m is the preset cluster index, l is the element index of the vector, β is the element weight,

Wow

is the mean and standard deviation of the l-th element values of vectors belonging to the m-th preset cluster, respectively,

Wow

are the mean and standard deviation of the values of the l-th element of vectors belonging to the sub-cluster associated with the m-th preset cluster, respectively.

Taking (Equation 3) as an example, it is as follows.

Of the recent 9 pre-processed wireless network quality data, 4 wireless network quality data have the smallest Mahalanobis distance from the first cluster among the preset clusters, and the three wireless network quality data are the second wireless network quality data among the preset clusters. When the Mahalanobis distance to the cluster is the smallest, and the remaining two wireless network quality data have the smallest Mahalanobis distance to the third cluster among the preset clusters, the four wireless network quality data are the first sub clusters, three radio network quality data are classified into a second sub-cluster, and two radio network quality data are classified into a third sub-cluster.

The average and standard deviation of the lth element value of each vector (ie, each radio network quality data) of the first sub-cluster, and the l-th element value of each vector of the first cluster associated with the first sub-cluster among the preset clusters Using the mean and standard deviation, J _m (l) is obtained by the above (Equation 3). In this way, J _m (l) obtained for each element of the vector belonging to the first subpluster is multiplied by the weight β for each element and summed. In this way, the second sub-cluster and the second sub-cluster are calculated in the same manner and summed up to obtain K ₂ of (Equation 3).

)을 비교하여, 최소 마할라노비스 거리가 제1임계값 보다 크면, 상기 (수학식2)에 의해 구한 K₁이 제3임계값(

) 보다 큰지 확인하고, 제3임계값 보다 큰 경우, 무선망 품질 이상으로 판단하고, 그렇지 않다면, 추가적으로 상기 (수학식3)에 의해 구한 K2가 제4임계값(

) 보다 큰지 확인하여, 제4임계값 보다 큰 경우, 무선망 품질 이상으로 판단할 수 있다. In an embodiment, the anomaly detection unit 240 includes the minimum Mahalanobis distance selected by the Mahalanobis distance calculating unit 230 and a first threshold value (

), if the minimum Mahalanobis distance is greater than the first threshold, K ₁ obtained by the above (Equation 2) is the third threshold (

), and if it is greater than the third threshold, it is determined that the quality of the wireless network is higher than the quality of the wireless network.

), and if it is greater than the fourth threshold, it can be determined that the quality of the wireless network is abnormal.

When it is determined that the radio network quality is abnormal, the anomaly detection unit 240 provides related cell information, radio network quality data, the final calculation results of (Equation 2) and (Equation 3), or an intermediate value, etc. to the operator. can be notified to

) 보다 큰 경우, 무선망 품질 이상으로 판단된다. 5 is an example illustrating a distance between a temporary cluster for each element and a preset cluster according to an embodiment of the present invention. In the embodiment with reference to FIG. 5 , the temporary cluster including the recent N pieces of radio network quality data is classified into two sub-clusters 510 and 520 . Among them, the radio network quality data belonging to the first sub-cluster 510 has a minimum Mahalanobis distance from the first cluster (m=1), and the radio network quality data belonging to the second sub-cluster 520 is the second cluster. The Mahalanobis distance to (m=2) is the minimum. Accordingly, after the element-by-element distance between the first sub-cluster 510 and the first cluster (m=1) is obtained, the weights for each element are multiplied and summed, and also the second sub-cluster 510 and the second cluster (m=2) ) is calculated, the weights for each element are multiplied and summed, and then K ₂ that sums them all up becomes the fourth threshold (

), it is judged to be more than the quality of the wireless network.

Referring back to FIG. 2 , when the abnormality detection unit 240 completes the wireless network quality abnormality detection procedure, the cluster management unit 250 sets the recently received wireless network quality data that is determined not to be a wireless network quality abnormality as a preset. can be added to the cluster.

Alternatively, the cluster management unit 250 is configured to, when a radio network quality abnormality is determined based on the recently received radio network quality data, a radio that satisfies a specific condition among the N most recent preprocessed radio network quality data used in the anomaly detection procedure. Network quality data may be added to a preset cluster.

) 보다 작은 무선망 품질 데이터를 기 설정된 클러스터에 추가한다. 만약 컷오프 기준을 0으로 설정하면, 최근 N개의 무선망 품질 데이터는 모두 기 설정된 클러스터에 추가되지 않고, 컷오프 기준을 매우 큰 값으로 설정하면 최근 N개의 무선망 품질 데이터 모두를 기 설정된 클러스터에 추가할 수 있다.For example, the cluster management unit 250 determines that the minimum Mahalanobis distance among the recent N pieces of wireless network quality data is the cutoff criterion (

) smaller wireless network quality data is added to the preset cluster. If the cutoff criterion is set to 0, all of the latest N wireless network quality data are not added to the preset cluster. If the cutoff criterion is set to a very large value, all of the latest N wireless network quality data are added to the preset cluster. can

와, 관련 공분산 행렬의 역행렬인

을 갱신하여 저장한다. The cluster management unit 250 updates clustering information by performing clustering on a preset cluster at regular intervals. The cluster management unit 250 updates the clustering information, and the latest center of gravity vector for each cluster used in the minimum Mahalanobis distance derivation and wireless network quality anomaly detection procedure.

and the inverse of the related covariance matrix

update and save

6 is a flowchart illustrating a method for detecting anomaly in a radio network according to an embodiment of the present invention, and describes a method of detecting anomaly in a radio network of a corresponding cell by using radio network quality data collected from one cell.

Referring to FIG. 6 , in step S601 , the radio network anomaly detection apparatus 150 receives radio network quality data collected from a radio unit (RU) 110 , that is, a cell. The radio network anomaly detection apparatus 150 may receive radio network quality data from the EMS 140 or may receive radio network quality data from the NMS. The wireless network anomaly detection apparatus 150 may receive wireless network quality data at regular intervals. Here, the radio network quality data is raw data collected from the radio unit (RU) 110, and is vector type data.

로 표기할 수 있다.In step S602, the radio network anomaly detection apparatus 150 performs pre-processing on the received radio network quality data and stores it in a storage unit such as a memory. Here, the preprocessing includes, for example, removal of unnecessary values such as Not-A-Number value processing, normalization operations, weight setting, dimension reduction, and the like. In the case of dimensionality reduction, an auto-encoder, principal component analysis (PCA), or the like can be used. Dimension reduction means, for example, processing such as reducing 100 elements constituting a vector to 50. Pre-processed wireless network quality data

can be denoted as

In step S603, the radio network anomaly detection apparatus 150 calculates a distance between the pre-processed radio network quality data and a plurality of preset clusters of the corresponding cell, that is, a Mahalanobis Distance (MD).

)를 결정하여 저장부에 저장한다. 최소 마할라노비스 거리는 상기 수학식1에 의해 계산될 수 있다. In step S604, the wireless network anomaly detection device 150, the smallest Mahalanobis distance (MD: Mahalanobis distance) of the cell

) is determined and stored in the storage unit. The minimum Mahalanobis distance may be calculated by Equation 1 above.

)을 비교하여, 최소 마할라노비스 거리가 제1임계값 보다 큰지 확인한다. 최소 마할라노비스 거리가 제1임계값 이하인 경우, 단계 S610으로 진행하여, 무선망 이상 탐지 장치(150)는, 전처리된 무선망 품질 데이터를 기존 클러스터에 추가한다.In step S605, the wireless network anomaly detection device 150, the minimum Mahalanobis distance and a first threshold (

) and check whether the minimum Mahalanobis distance is greater than the first threshold. If the minimum Mahalanobis distance is less than or equal to the first threshold, the process proceeds to step S610, and the radio network anomaly detection apparatus 150 adds the pre-processed radio network quality data to the existing cluster.

If the minimum Mahalanobis distance is greater than the first threshold, in step S606, the radio network anomaly detection apparatus 150 defines the latest N radio network quality data of the cell as a temporary cluster, and the most recent data belonging to the temporary cluster The minimum Mahalanobis distances of each of the N preprocessed radio network quality data are all summed up. The sum can be expressed as K ₁ .

)을 비교하여, 상기 K₁이 제3임계값 보다 큰지 확인한다. 상기 K₁이 제3임계값 이하인 경우에는, 단계 S610으로 진행하여, 무선망 이상 탐지 장치(150)는, 전처리된 무선망 품질 데이터를 기존 클러스터에 추가한다.In step S607, the wireless network anomaly detection device 150, the K ₁ and a third threshold (

) to determine whether the K ₁ is greater than the third threshold. If the K ₁ is less than or equal to the third threshold, the process proceeds to step S610, and the radio network anomaly detection apparatus 150 adds the pre-processed radio network quality data to the existing cluster.

If the K ₁ is greater than the third threshold, in step S608, the wireless network anomaly detection apparatus 150 determines that the wireless network quality is abnormal.

) 보다 작은 무선망 품질 데이터를 기 설정된 클러스터에 추가한다. In step S609, the wireless network anomaly detection device 150 determines that the minimum Mahalanobis distance among the latest N preprocessed wireless network quality data used in the anomaly detection procedure is the cutoff criterion (

) smaller wireless network quality data is added to the preset cluster.

와, 관련 공분산 행렬의 역행렬인

을 갱신하여 저장한다. In step S611, the radio network anomaly detection apparatus 150 updates the clustering information by performing clustering on the preset cluster to which the radio network quality data is added in the step S610 or S609. Preferably, the wireless network anomaly detection device 150 updates the clustering information, and the latest center of gravity vector for each cluster used in the minimum Mahalanobis distance derivation and wireless network quality anomaly detection procedure.

and the inverse of the related covariance matrix

update and save

7 is a flowchart illustrating a method for detecting anomaly in a radio network according to another embodiment of the present invention, and describes a method of detecting anomaly in a radio network of a corresponding cell using radio network quality data collected from one cell.

Referring to FIG. 7 , in step S701 , the radio network anomaly detection apparatus 150 receives radio network quality data collected from the radio unit (RU) 110 , that is, a cell. The radio network anomaly detection apparatus 150 may receive radio network quality data from the EMS 140 or may receive radio network quality data from the NMS. The wireless network anomaly detection apparatus 150 may receive wireless network quality data at regular intervals. Here, the radio network quality data is raw data collected from the radio unit (RU) 110, and is vector type data.

로 표기할 수 있다.In step S702, the radio network anomaly detection apparatus 150 performs pre-processing on the received radio network quality data and stores it in a storage unit such as a memory. Here, the preprocessing includes, for example, removal of unnecessary values such as processing of Not-A-Number values, normalization operations, weight setting, dimension reduction, and the like. In the case of dimensionality reduction, an auto-encoder or principal component analysis (PCA) may be used. Dimension reduction means, for example, processing such as reducing 100 elements constituting a vector to 50. Preprocessed wireless network quality data

can be denoted as

In step S703, the radio network anomaly detection apparatus 150 calculates a distance between the pre-processed radio network quality data and a plurality of preset clusters of the corresponding cell, that is, a Mahalanobis Distance (MD).

)를 결정하여 저장부에 저장한다. 최소 마할라노비스 거리는 상기 수학식1에 의해 계산될 수 있다. In step S704, the wireless network anomaly detection device 150, the smallest Mahalanobis distance (MD: Mahalanobis distance) of the cell

) is determined and stored in the storage unit. The minimum Mahalanobis distance may be calculated by Equation 1 above.

)을 비교하여, 최소 마할라노비스 거리가 제1임계값 보다 큰지 확인한다. 최소 마할라노비스 거리가 제1임계값 이하인 경우, 단계 S711로 진행하여, 무선망 이상 탐지 장치(150)는, 전처리된 무선망 품질 데이터를 기존 클러스터에 추가한다.In step S705, the wireless network anomaly detection device 150, the minimum Mahalanobis distance and a first threshold (

) and check whether the minimum Mahalanobis distance is greater than the first threshold. If the minimum Mahalanobis distance is less than or equal to the first threshold, the process proceeds to step S711, where the wireless network anomaly detection apparatus 150 adds the preprocessed wireless network quality data to the existing cluster.

If the minimum Mahalanobis distance is greater than the first threshold, in step S706, the radio network anomaly detection apparatus 150 defines the latest N radio network quality data of the cell as a temporary cluster, and the most recent data belonging to the temporary cluster The N pieces of preprocessed wireless network quality data are classified into a plurality of sub-clusters according to the type of a preset cluster for which each minimum Mahalanobis distance is calculated.

In step S707, the radio network anomaly detection apparatus 150 sums all distances between each sub-cluster and a corresponding preset cluster. The sum can be expressed as K ₂ . In this case, in calculating the distance between each sub-cluster and a preset cluster corresponding thereto, a weight may be applied to each element of the vector to calculate the distance for each element, and then the distance may be summed. This is the same as (Equation 3) above.

)을 비교하여, 상기 K₂이 제4임계값 보다 큰지 확인한다. 상기 K₂이 제4임계값 이하인 경우, 무선망 이상 탐지 장치(150)는, 단계 S711로 진행하여, 전처리된 무선망 품질 데이터를 기존 클러스터에 추가한다.In step S708, the wireless network anomaly detection device 150, the K ₂ and a fourth threshold (

) to determine whether the K ₂ is greater than the fourth threshold. When the K ₂ is equal to or less than the fourth threshold, the radio network anomaly detection apparatus 150 proceeds to step S711 to add the pre-processed radio network quality data to the existing cluster.

If the K ₂ is greater than the fourth threshold, in step S709, the radio network anomaly detection apparatus 150 determines that the radio network quality is abnormal.

) 보다 작은 무선망 품질 데이터를 기 설정된 클러스터에 추가한다. In step S710, the wireless network anomaly detection apparatus 150 determines that the minimum Mahalanobis distance among the latest N preprocessed wireless network quality data used in the anomaly detection procedure is the cutoff criterion (

) smaller wireless network quality data is added to the preset cluster.

와, 관련 공분산 행렬의 역행렬인

을 갱신하여 저장한다. In step S712, the radio network anomaly detection apparatus 150 updates the clustering information by performing clustering on the preset cluster to which the radio network quality data is added in the step S711 or S710. Preferably, the wireless network anomaly detection device 150 updates the clustering information, and the latest center of gravity vector for each cluster used in the minimum Mahalanobis distance derivation and wireless network quality anomaly detection procedure.

and the inverse of the related covariance matrix

update and save

8 is a flowchart illustrating a method for detecting anomaly in a radio network according to another embodiment of the present invention, and describes a method of detecting anomaly in a radio network of a corresponding cell using radio network quality data collected from one cell.

Referring to FIG. 8 , in step S801 , the radio network anomaly detection apparatus 150 receives radio network quality data collected from the radio unit (RU) 110 , that is, a cell. The radio network anomaly detection apparatus 150 may receive radio network quality data from the EMS 140 or may receive radio network quality data from the NMS. The wireless network anomaly detection apparatus 150 may receive wireless network quality data at regular intervals. Here, the radio network quality data is raw data collected from the radio unit (RU) 110, and is vector type data.

로 표기할 수 있다.In step S802, the radio network anomaly detection apparatus 150 performs pre-processing on the received radio network quality data and stores it in a storage unit such as a memory. Here, the preprocessing includes, for example, removal of unnecessary values such as Not-A-Number value processing, normalization operations, weight setting, dimension reduction, and the like. In the case of dimensionality reduction, an auto-encoder, principal component analysis (PCA), or the like can be used. Dimension reduction means, for example, processing such as reducing 100 elements constituting a vector to 50. Preprocessed wireless network quality data

can be denoted as

In step S803, the radio network anomaly detection apparatus 150 calculates a distance between the pre-processed radio network quality data and a plurality of preset clusters of the corresponding cell, that is, a Mahalanobis Distance (MD).

)를 결정하여 저장부에 저장한다. 최소 마할라노비스 거리는 상기 수학식1에 의해 계산될 수 있다. In step S804, the wireless network anomaly detection device 150, the smallest Mahalanobis distance (MD) among the Mahalanobis distances (MD) of the cell

) is determined and stored in the storage unit. The minimum Mahalanobis distance may be calculated by Equation 1 above.

)을 비교하여, 최소 마할라노비스 거리가 제1임계값 보다 큰지 확인한다. 최소 마할라노비스 거리가 제1임계값 이하인 경우, 단계 S812으로 진행하여, 무선망 이상 탐지 장치(150)는, 전처리된 무선망 품질 데이터를 기존 클러스터에 추가한다.In step S805, the wireless network anomaly detection device 150, the minimum Mahalanobis distance and a first threshold (

) and check whether the minimum Mahalanobis distance is greater than the first threshold. If the minimum Mahalanobis distance is less than or equal to the first threshold, the process proceeds to step S812, and the radio network anomaly detection apparatus 150 adds the pre-processed radio network quality data to the existing cluster.

If the minimum Mahalanobis distance is greater than the first threshold, in step S806, the radio network anomaly detection apparatus 150 defines the latest N radio network quality data of the cell as a temporary cluster, and the most recent data belonging to the temporary cluster The minimum Mahalanobis distances of each of the N preprocessed radio network quality data are all summed up. The sum can be expressed as K ₁ .

)을 비교하여, 상기 K₁이 제3임계값 보다 큰지 확인한다. 상기 K₁이 제3임계값 보다 큰 경우, 단계 S810으로 진행하여 바로 무선망 품질 이상으로 판단한다. In step S807, the wireless network anomaly detection device 150, the K ₁ and a third threshold (

) to determine whether the K ₁ is greater than the third threshold. If K ₁ is greater than the third threshold, the process proceeds to step S810 and the quality of the wireless network is determined to be higher.

On the other hand, if the K ₁ is less than or equal to the third threshold, proceeding to step S808, the radio network anomaly detection apparatus 150 collects the N most recent pre-processed radio network quality data belonging to the temporary cluster, each of the minimum Mahalanobis According to the type of the preset cluster for which the distance is calculated, it is classified into a plurality of sub-clusters, and all distances between each sub-cluster and the corresponding preset cluster are summed. The sum can be expressed as K ₂ . In this case, in calculating the distance between each sub-cluster and a preset cluster corresponding thereto, a weight may be applied to each element of the vector to calculate the distance for each element, and then the distance may be summed. This is the same as (Equation 3) above.

)을 비교하여, 상기 K₂이 제4임계값 보다 큰지 확인한다. 상기 K₂이 제4임계값 이하인 경우, 무선망 이상 탐지 장치(150)는, 단계 S812로 진행하여, 전처리된 무선망 품질 데이터를 기존 클러스터에 추가한다.In step S809, the wireless network anomaly detection device 150, the K ₂ and a fourth threshold (

) to determine whether the K ₂ is greater than the fourth threshold. If the K ₂ is equal to or less than the fourth threshold, the radio network anomaly detection apparatus 150 proceeds to step S812 and adds the pre-processed radio network quality data to the existing cluster.

When the K ₂ is greater than the fourth threshold, in step S810 , the wireless network anomaly detection apparatus 150 determines that the wireless network quality is abnormal.

) 보다 작은 무선망 품질 데이터를 기 설정된 클러스터에 추가한다. In step S811, the wireless network anomaly detection apparatus 150 determines that the minimum Mahalanobis distance among the recent N preprocessed wireless network quality data used in the anomaly detection procedure is the cutoff criterion (

) smaller wireless network quality data is added to the preset cluster.

와, 관련 공분산 행렬의 역행렬인

을 갱신하여 저장한다. In step S813, the radio network anomaly detection apparatus 150 updates the clustering information by performing clustering on the preset cluster to which the radio network quality data is added in the step S812 or S813. Preferably, the wireless network anomaly detection device 150 updates the clustering information, and the latest center of gravity vector for each cluster used in the minimum Mahalanobis distance derivation and wireless network quality anomaly detection procedure.

and the inverse of the related covariance matrix

update and save

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in individual embodiments herein may be implemented in combination in a single embodiment. Conversely, various features described herein in a single embodiment may be implemented in various embodiments individually, or may be implemented in appropriate combination.

Although acts are described in the drawings in a specific order, it should not be understood that the acts are performed in the specific order as shown, or that all of the described acts are performed in a continuous order, or to obtain a desired result. . Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a computer-readable form in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.). Since this process can be easily performed by a person skilled in the art to which the present invention pertains, it will not be described in detail any longer.

The present invention described above, for those of ordinary skill in the art to which the present invention pertains, various substitutions, modifications and changes are possible within the scope without departing from the technical spirit of the present invention. It is not limited by the drawings.

110: RU
120 : DU
130: CU
140: EMS
150: wireless network anomaly detection device
210: quality data receiving unit
220: preprocessor
230: Mahalanobis distance calculator
240: anomaly detection unit
250: cluster management unit

Claims (16)

A wireless network anomaly detection device for detecting abnormalities in a wireless network, the apparatus comprising:
a quality data receiving unit for receiving wireless network quality data collected from a cell;
a pre-processing unit for pre-processing the received wireless network quality data;
a Mahalanobis distance calculator for calculating a distance between the preprocessed wireless network quality data and a plurality of preset clusters of the cell, and determining and storing a minimum Mahalanobis distance among them;
If the minimum Mahalanobis distance is greater than the first threshold, a predetermined number of recently preprocessed radio network quality data of the corresponding cell is defined as a temporary cluster, and the sum of the distances between the temporary cluster and a preset cluster associated with the temporary cluster When it is greater than the second threshold, the apparatus for detecting anomaly in the radio network including an anomaly detecting unit that determines that the quality of the radio network of the corresponding cell is abnormal. According to claim 1,
The anomaly detection unit,
Wireless network anomaly detection apparatus, characterized in that when the sum of the minimum Mahalanobis distances of each of the wireless network quality data belonging to the temporary cluster is greater than the second threshold value, it is determined that the wireless network quality is abnormal. According to claim 1,
The anomaly detection unit,
Classifying the temporary cluster into a plurality of sub-clusters, and when the sum of all distances between each sub-cluster and a corresponding preset cluster is greater than the second threshold value, it is determined that the quality of the wireless network is abnormal. network anomaly detection device. 4. The method of claim 3,
The anomaly detection unit,
and classifying the temporary cluster into the plurality of sub-clusters according to a type of a preset cluster from which the minimum Mahalanobis distance of each of the wireless network quality data belonging to the temporary cluster is calculated. 4. The method of claim 3,
The anomaly detection unit,
A wireless network anomaly detection apparatus, characterized in that in calculating the distance between each sub-cluster and a preset cluster corresponding thereto, a weight is applied to each element of the vector to calculate the distance for each element, and then summing the distances. According to claim 1,
The anomaly detection unit,
When the sum of the minimum Mahalanobis distances of each of the radio network quality data belonging to the temporary cluster is less than or equal to the third threshold, the temporary cluster is classified into a plurality of sub-clusters, and each sub-cluster and a corresponding preset cluster Wireless network anomaly detection apparatus, characterized in that when the sum of all distances is greater than the fourth threshold value, it is determined that the wireless network quality is abnormal. According to claim 1,
If the minimum Mahalanobis distance is less than or equal to a first threshold, wireless network anomaly detection further comprising a cluster management unit that adds the radio network quality data preprocessed in the preprocessor to a preset cluster and performs clustering update Device. According to claim 1,
Wireless network anomaly detection, characterized in that it further comprises a cluster manager for adding wireless network quality data having a minimum Mahalanobis distance smaller than a cutoff criterion among wireless network quality data belonging to the temporary cluster to a preset cluster and performing clustering update Device. A method for detecting an abnormality in a wireless network in a wireless network anomaly detection device, the method comprising:
receiving wireless network quality data collected in a cell;
pre-processing the received radio network quality data;
calculating a distance between the preprocessed wireless network quality data and a plurality of preset clusters of the cell, and determining and storing the minimum Mahalanobis distance among them; and
If the minimum Mahalanobis distance is greater than the first threshold, a predetermined number of recently preprocessed radio network quality data of the corresponding cell is defined as a temporary cluster, and the sum of the distances between the temporary cluster and a preset cluster associated with the temporary cluster If it is greater than the second threshold, the method comprising the step of determining that the radio network quality of the corresponding cell or more. 10. The method of claim 9,
The step of determining that the wireless network quality is abnormal,
When the sum of the minimum Mahalanobis distances of each of the radio network quality data belonging to the temporary cluster is greater than the second threshold value, it is determined that the radio network quality is abnormal. 10. The method of claim 9,
The step of determining that the wireless network quality is abnormal,
Classifying the temporary cluster into a plurality of sub-clusters, and determining that the wireless network quality is abnormal when the sum of all distances between each sub-cluster and a corresponding preset cluster is greater than the second threshold value . 12. The method of claim 11,
The step of determining that the wireless network quality is abnormal,
and classifying the temporary cluster into the plurality of sub-clusters according to the type of a preset cluster for which the minimum Mahalanobis distance of each radio network quality data belonging to the temporary cluster is calculated. 12. The method of claim 11,
The step of determining that the wireless network quality is abnormal,
In calculating the distance between each sub-cluster and a predetermined cluster corresponding thereto, a weight is applied to each element of the vector to calculate the distance for each element, and then summing the distances. 10. The method of claim 9,
The step of determining that the wireless network quality is abnormal,
When the sum of the minimum Mahalanobis distances of each of the radio network quality data belonging to the temporary cluster is less than or equal to the third threshold, the temporary cluster is classified into a plurality of sub-clusters, and each sub-cluster and a corresponding preset cluster When the sum of all distances is greater than the fourth threshold, it is determined that the wireless network quality is higher than the value. 10. The method of claim 9,
If the minimum Mahalanobis distance is less than or equal to a first threshold, adding the radio network quality data preprocessed in the preprocessing step to a preset cluster and performing a clustering update. 10. The method of claim 9,
The method further comprising the step of adding radio network quality data having a minimum Mahalanobis distance smaller than a cutoff criterion among radio network quality data belonging to the temporary cluster to a preset cluster and performing clustering update.

Images