# US 10,320,970 B2 · System and method for anomaly detection for non-homogenous arrival rate > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,970 B2 - Document ID: US10320970B2 - Status: Granted - Kind: B2 - Application number: 15/690,953 - Filed: 2017-08-30 - Published: 2018-03-29 - Granted: 2019-06-11 - Earliest claimed: 2016-09-28 - Assignees: Nokia of America Corporation - Applicants: Nokia of America Corporation - Inventors: Jin Cao; Sining Chen; Jeffery J. Spiess; Alasdhair R. Campbell - Web page: https://patentgrep.com/patent/US10320970B2 ## CPC - H04M 3/36: Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks - G06F 7/556: Logarithmic or exponential functions - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - H04M 3/5175: {Call or contact centers supervision arrangements} - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The method includes receiving a plurality of calls from users of the communication network, the plurality of calls having a non-homogenous arrival rate that is defined by first arrival rate information, transforming the first arrival rate information into second arrival rate information, the second arrival rate information having a homogenous arrival rate, and detecting at least one first anomaly of the received plurality of calls using the second arrival rate information. A network node may be configured to perform this method. ## Claims ### Claim 1 A method of anomaly detection for a communication network, comprising: receiving, by at least one first processor of at least one first network node, a plurality of calls from users of the communication network, the plurality of calls having a non-homogenous arrival rate that is defined by first arrival rate information; transforming, by the at least one first processor, the first arrival rate information into second arrival rate information, the second arrival rate information having a homogenous arrival rate; and detecting, by the at least one first processor, at least one first anomaly of the received plurality of calls using the second arrival rate information. ### Claim 2 (depends on 1) The method of claim 1, wherein, the first arrival rate information is a non-homogenous Poisson process where the received plurality of calls are represented on non-constant time-scale, and the second arrival rate information is a homogenous Poisson process where the received plurality of calls are represented on constant time-scale. ### Claim 3 (depends on 1) The method of claim 1, wherein the transforming further includes, warping the first arrival rate information in order to represent the received plurality of calls on a stationary time-scale. ### Claim 4 (depends on 1) The method of claim 1, wherein the detecting further includes, identifying at least one first change in the second arrival rate information, the at least one first change being the at least one first anomaly. ### Claim 5 (depends on 1) The method of claim 1, wherein the detecting further includes, monitoring an initial set of calls, of the received plurality of calls, over a first period of time, calculating an average number of incoming calls based on the initial set of calls, determining a first set of cumulative sum (CUSUM) parameters for the at least one first network node, based on the initial set of calls and the average number of incoming calls, determining at least one first arrival rate threshold, based on the first set of CUSUM parameters. ### Claim 6 (depends on 1) The method of claim 1, wherein the detecting further includes, comparing the at least one first threshold to the second arrival rate information in order to detect the at least one first anomaly. ### Claim 7 (depends on 1) The method of claim 1, wherein the transforming and the detecting steps are performed each time a call, of the plurality of calls, is received. ### Claim 8 (depends on 7) The method of claim 7, wherein the transforming and the detecting steps are not performed at fixed time increments. ### Claim 9 A network node, comprising: a memory storing computer readable instructions; at least one first processor configured to execute the computer readable instructions such that the at least one first processor is configured to, receive a plurality of calls from users of the communication network, the plurality of calls having a non-homogenous arrival rate that is defined by first arrival rate information; transform the first arrival rate information into second arrival rate information, the second arrival rate information having a homogenous arrival rate; and detect at least one first anomaly of the received plurality of calls using the second arrival rate information. ### Claim 10 (depends on 9) The network node of claim 9, wherein, the first arrival rate information is a non-homogenous Poisson process where the received plurality of calls are represented on non-constant time-scale, and the second arrival rate information is a homogenous Poisson process where the received plurality of calls are represented on constant time-scale. ### Claim 11 (depends on 9) The network node of claim 9, wherein the at least one first processor performs the transforming by being configured to, warp the first arrival rate information in order to represent the received plurality of calls on a stationary time-scale. ### Claim 12 (depends on 9) The network node of claim 9, wherein the at least one first processor performs the detecting by being configured to, identify at least one first change in the second arrival rate information, the at least one first change being the at least one first anomaly. ### Claim 13 (depends on 9) The network node of claim 9, wherein the at least one first processor further performs the detecting by being configured to, monitor an initial set of calls, of the received plurality of calls, over a first period of time, calculate an average number of incoming calls based on the initial set of calls, determine a first set of cumulative sum (CUSUM) parameters for the at least one first network node, based on the initial set of calls and the average number of incoming calls, determine at least one first arrival rate threshold, based on the first set of CUSUM parameters. ### Claim 14 (depends on 9) The network node of claim 9, wherein the at least one first processor is further configured to detect by being configured to, compare the at least one first threshold to the second arrival rate information in order to detect the at least one first anomaly. ### Claim 15 (depends on 9) The network node of claim 9, wherein the at least one first processor is further configured to perform the transforming and detecting each time a call, of the plurality of calls, is received. ### Claim 16 (depends on 15) The network node of claim 15, wherein the at least one first processor is further configured to perform the transforming and the detecting steps without the steps being performed at fixed time increments.