US-20260128999-A1 - ANOMALY DETECTION BASED ON CONGESTION NOTIFICATIONS

Abstract

Systems, methods, and software are disclosed herein for anomaly detection in a wireless communication network based on congestion notification in various implementations. In one example, a computing apparatus processes network telemetry data and congestion data using a machine learning model trained to detect anomalous behavior on wireless communication network. In response to detecting the anomalous behavior, the computing apparatus identifies a source of the anomalous behavior on the network and initiates an action with respect to a network function associated with the source of the anomalous behavior to mitigate one or more effects of the anomalous behavior.

Inventors

• Timur Kochiev
• Relin Thomas

Assignees

• T-MOBILE INNOVATIONS LLC

Dates

Publication Date

20260507

Application Date

20241106

Claims (20)

1. 1 . A computing apparatus comprising: one or more computer readable storage media; one or more processors operatively coupled with the one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media that, when executed by the one or more processors, direct the computing apparatus to at least: process network telemetry data and congestion data using a machine learning model trained to detect anomalous behavior on a wireless communication network; in response to detecting the anomalous behavior, identify a source of the anomalous behavior on the wireless communication network; and initiate an action with respect to a network function associated with the source of the anomalous behavior to mitigate one or more effects of the anomalous behavior.
2. 2 . The computing apparatus of claim 1 , wherein the congestion data comprises data based on Explicit Congestion Notification (ECN) congestion notifications.
3. 3 . The computing apparatus of claim 2 , wherein the congestion data is computed based on a quantity of ECN bits which include an ECN congestion notification with respect to ECN-enabled data traffic on the wireless communication network.
4. 4 . The computing apparatus of claim 1 , wherein the network telemetry data comprises Quality of Service metrics of the wireless communication network.
5. 5 . The computing apparatus of claim 4 , wherein the network telemetry data further comprises signal quality metrics of the wireless communication network.
6. 6 . The computing apparatus of claim 1 , wherein to process the network telemetry data and the congestion data, the program instructions direct the computing apparatus to generate an input vector based on segmenting the network telemetry data and the congestion data and submit the input vector to the machine learning model.
7. 7 . The computing apparatus of claim 6 , wherein the machine learning model comprises a recurrent neural network trained for anomaly detection using historical network telemetry data and historical congestion data.
8. 8 . The computing apparatus of claim 1 , wherein the computing apparatus comprises a Network Data Analytics Function of the wireless communication network.
9. 9 . A method of operating a computing apparatus, comprising: processing network telemetry data and congestion data using a machine learning model trained to detect anomalous behavior on a wireless communication network; in response to detecting the anomalous behavior, identifying a source of the anomalous behavior on the wireless communication network; and initiating an action with respect to a network function associated with the source of the anomalous behavior to mitigate one or more effects of the anomalous behavior.
10. 10 . The method of claim 9 , wherein the congestion data comprises data based on Explicit Congestion Notification (ECN) congestion notifications.
11. 11 . The method of claim 10 , wherein the congestion data is computed based on a quantity of ECN bits which include an ECN congestion notification with respect to ECN-enabled data traffic on the wireless communication network.
12. 12 . The method of claim 9 , wherein the network telemetry data comprises Quality of Service metrics of the wireless communication network.
13. 13 . The method of claim 12 , wherein the network telemetry data further comprises signal quality metrics of the wireless communication network.
14. 14 . The method of claim 9 , wherein processing the network telemetry data and the congestion data comprises generating an input vector based on segmenting the network telemetry data and the congestion data and submitting the input vector to the machine learning model.
15. 15 . The method of claim 14 , wherein the machine learning model comprises a recurrent neural network trained for anomaly detection using historical network telemetry data and historical congestion data.
16. 16 . The method of claim 9 , wherein the computing apparatus comprises a Network Data Analytics Function of the wireless communication network.
17. 17 . A method of operating a computing apparatus, comprising: executing a machine learning model to detect anomalous behavior in channels of input data, wherein the input data comprises network telemetry data and congestion data of a wireless communication network; receiving output from the machine learning model comprising an indication of the anomalous behavior; and identifying a source of the anomalous behavior based on the output.
18. 18 . The method of claim 17 , wherein the congestion data comprises data based on Explicit Congestion Notification (ECN) congestion notifications.
19. 19 . The method of claim 17 , further comprising generating a feature vector based on segmenting the input data synchronized in time and submitting the feature vector to the machine learning model.
20. 20 . The method of claim 17 , wherein identifying the source of the anomalous behavior based on the output comprises identifying a channel of the channels of input data associated with the indication of anomalous behavior.

Description

TECHNICAL FIELD Aspects of the disclosure are related to the field of wireless communication networks, particularly anomaly detection and root cause analysis of anomalies. BACKGROUND In wireless network communications, excessive traffic congestion can lead to excess latency, buffer bloat, and packet loss, where packets are dropped to signal congestion to the sender. Network congestion is particularly detrimental to transmissions associated with time-critical applications such as VoIP (voice over IP), videoconferencing, live streaming, online gaming, and other types of traffic which rely on low latency and low packet loss to provide a high-quality user experience. For example, in cloud gaming and augmented/virtual reality (AR/VR) applications, network congestion can lead to jitter and freezing which degrades the user experience. Conventional efforts to detect congestion within the network infrastructure include detecting excessive packet loss, monitoring network latency, tracking bandwidth utilization, and analyzing patterns of retransmissions. To address the challenges to speed and reliability of time-critical data transmission, Low Latency, Low Loss, Scalable Throughput (L4S) technology enables traffic management to reduce congestion build-up, thereby reducing the detrimental effects of congestion on transmission. L4S relies on an extension of the Internet Protocol (IP) defining Explicit Congestion Notification (ECN) by which network traffic can be marked in such a way as to signal to ECN-enabled senders to reduce their transmission rates to alleviate a congestion build-up, rather than dropping packets to signal the build-up to a sender. More specifically, when an ECN-aware router detects that traffic congestion is exceeding a traffic congestion threshold, the router marks the IP header of a packet queued at the router to indicate “Congestion Experienced.” This mark, when received at an ECN-aware endpoint, causes the endpoint to echo the congestion indication back to the ECN-aware sender, which in turn causes the sender to reduce its transmission rate. By reducing the transmission rate, congestion is alleviated, resulting in reduced packet loss and improved latency. OVERVIEW Technology is disclosed herein for anomaly detection in a wireless communication network based on congestion notification in various implementations. In one example, a computing apparatus comprises one or more computer readable storage media, one or more processors operatively coupled with the one or more computer readable storage media and program instructions stored on the one or more computer readable storage media that, when executed by the one or more processors, direct the computing apparatus to process network telemetry data and congestion data using a machine learning model trained to detect anomalous behavior on wireless communication network; in response to detecting the anomalous behavior, identify a source of the anomalous behavior on the wireless communication network; and initiate an action with respect to a network function associated with the source of the anomalous behavior to mitigate one or more effects of the anomalous behavior. In another example, a method of operating a computing apparatus comprises processing network telemetry data and congestion data using a machine learning model trained to detect anomalous behavior on wireless communication network; in response to detecting the anomalous behavior, identifying a source of the anomalous behavior on the wireless communication network; and initiating an action with respect to a network function associated with the source of the anomalous behavior to mitigate one or more effects of the anomalous behavior. This Overview is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. It may be understood that this Overview is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS Many aspects of the disclosure may be better understood with reference to the following drawings. The components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Moreover, in the drawings, like reference numerals designate corresponding parts throughout the several views. While several embodiments are described in connection with these drawings, the disclosure is not limited to the embodiments disclosed herein. On the contrary, the intent is to cover all alternatives, modifications, and equivalents. FIG. 1 illustrates an operational environment for radio resource partitioning based on congestion notification in an implementation. FIG. 2 illustrates a process for radio resource allocation based on congestion notification in an implementation. FIG. 3 illustrates an operational environme