EP-4128660-B1 - DETERMINING AN ALARM CONDITION

Inventors

• GEMME, Luciano
• CAPPELLI, Marco

Dates

Publication Date

20260506

Application Date

20200327

Claims (9)

1. A method for determining an alarm condition in equipment, the method comprising: receiving values (320) of an operating parameter of the equipment (105, 110) over time (205A, 205B); calculating (210A) first predicted values (340A) of the operating parameter at future times using a first model (325A) over a first time series (335A) of the received values; calculating (210B) second predicted values (340B) of the operating parameter at the future times using a second model (325B) over a second and different time series (335B) of the received values, wherein the first time series (335A) is associated to more recently received values than the second time series (335B); determining (225, 230) the alarm condition using the first (340A) and second (340B) predicted values, wherein determining the alarm condition comprises calculating (215A, 215B) first and second residuals (345A, 345B) between the first and second predicted values (340A, 340B) and the corresponding received values (320) for respective times, and wherein determining the alarm condition comprises interpolating (220A, 220B) the first and second residuals (345A, 345B) and calculating first and second derivatives (355A, 355B) for the respective interpolations (350A, 350B), and wherein determining the alarm condition comprises calculating (225) an alarm parameter (360) by summing the absolute values of the first and second residuals, summing the absolute values of the first and second derivatives, and adding the summed residuals and derivatives; and indicating an alarm if the alarm parameter is above a threshold (230).
2. The method of claim 1, wherein the first and second models are autoregressive integrated moving average, ARIMA, models.
3. The method of claim 1 or 2, wherein the first and second models are the same and the second time series (335B) is delayed with respect to the first time series (335A).
4. The method of claim 1 or 3, wherein determining the alarm condition comprises integrating and/or digitizing the alarm parameter (360).
5. The method of any one preceding claim, wherein the equipment is one or more nodes of a communications network (100).
6. The method of claim 5, wherein the operating parameter is one or more of the following: traffic load; traffic error rate.
7. Apparatus for determining an alarm condition in equipment, the apparatus (600) comprising a processor (610) and memory (630) said memory containing instructions (635): receive values of an operating parameter of the equipment over time (640); calculate first predicted values of the operating parameter at future times using a first model over a first time series of the received values (645); calculate second predicted values of the operating parameter at the future times using a second model over a second and different time series of the received values (650); wherein the first time series (335A) is associated to more recently received values than the second time series (335B); determine the alarm condition using the first and second predicted values (655), wherein the alarm condition is determined by: calculating first and second residuals between the first and second predicted values and the corresponding received values for respective times (215A, 215B); and interpolating the first and second residuals and calculating a first and second derivative for the respective interpolations (220A, 220B), wherein determining the alarm condition comprises calculating an alarm parameter by summing the absolute values of the first and second residuals, summing the absolute values of the first and second derivatives, and adding the summed residuals and derivatives (225); and indicating an alarm if the alarm parameter is above a threshold (230).
8. A computer program comprising instructions which, when executed on a processor, cause the processor to carry out the method of any one of claims 1 to 6.
9. A computer program product comprising non-transitory computer readable media having stored thereon a computer program according to claim 8.

Description

Technical Field Embodiments disclosed herein relate to methods and apparatus for determining alarm conditions in equipment, for example communications network equipment. Background The alarm condition of various equipment, such as communications network equipment, may be determined and used by an operator of that equipment to monitor that the equipment is operating within normal parameters or to take corrective action if it is not. For example in communications equipment, a traffic load or error rate above a threshold may indicate that operator action is required such as provisioning additional capacity and/or identifying equipment faults or failure. The alarm condition may be determined by predicting certain operating parameter values of the equipment using received or measured parameter values together with a prediction model. The prediction model may use trends in the received values in order to predict future values which may then be compared with the future actual or received value to determine a difference or residual between the actual and predicted value. An increasing residual may indicate an anomaly which can be used to trigger an alert and may be indicative of a fault in equipment somewhere in a network, a malicious attack or even bad weather. One category of predictive model used is an autoregressive integrated moving average (ARIMA) which provides a "next" value in a data series showing seasonality or repeated trends, for example over a day, week or year. For example, the traffic load in a communications network can follow a seasonality of a day with peaks during working hours and lower values during the night. The seasonality has a repeatability frequency measured for example in hours, days or weeks. ARIMA models may use a higher weighting for more recent data which enables them to quickly detect a sudden anomaly. However, such models are less well able to detect slowly arising anomalies because the slowly changing values may be "learned" and considered part of a new normal trend. WO 2018/160177 A1 relates to techniques for detecting anomalous values in data streams using forecasting models. US 2019/102718 A1 relates to predictive analysis techniques as applied to business variables. Summary According to certain embodiments described herein there is a method for determining an alarm condition in equipment according to claim 1. The method comprises receiving values of an operating parameter of the equipment over time, calculating first predicted values of the operating parameter at future times using a first model over a first time series of the received values and calculating second predicted values of the operating parameter at the future times using a second model over a second and different time series of the received values. The method then determines the alarm condition using the first and second predicted values. By predicting operating parameter values using modelling over two different time series of received or measured values, an improved determination of an alarm condition can be achieved. This may include detecting anomalies associated with slowly changing as well as fast changing parameter values. In addition, anomalies may be detected more quickly. According to certain embodiments described herein there is provided an apparatus for determining an alarm condition in equipment according to claim 7. The apparatus comprises a processor and memory which contains instructions executable the processor whereby the apparatus is operative to receive values of an operating parameter of the equipment over time, calculate first predicted values of the operating parameter at future times using a first model over a first time series of the received values, calculate second predicted values of the operating parameter at the future times using a second model over a second and different time series of the received values, and determine an alarm condition using the first and second predicted values. According to certain embodiments described herein there is provided a computer program comprising instructions which, when executed on a processor, causes the processor to carry out the methods described herein. The computer program may be stored on a non transitory computer readable media. The protection scope of the disclosure is defined by the accompanying claims. Brief Description of Drawings For a better understanding of the embodiments of the present disclosure, and to show how it may be put into effect, reference will now be made, by way of example only, to the accompanying drawings, in which: Figure 1 is a schematic diagram illustrating a communications system according to some embodiments;Figure 2 is a flow diagram illustrating a method according to some embodiments;Figure 3 is a schematic diagram illustrating determination of an alarm condition according to some embodiments;Figure 4 is a graph showing various parameters used according to some embodiments;Figure 5 is a detail of part of the gra