Key performance indicator anomaly detection in telephony networks

A method of operating a system to detect traffic anomalies comprising:

• inputting input values into a trained neural network, said input values including:
• i) a set of key performance indicator values and ii) one or more selector values corresponding to a first anomaly group classification instance;
• operating the trained neural network to output values corresponding to a subset of the inputted values;
• determining a score for the first anomaly group classification instance based on one or more of the output values of the trained neural network, said one or more output values corresponding to one or more of the key performance indicator values included in the set of key performance indicator values;
• comparing the score to a first threshold;
• when said score is above the first threshold determining that an anomaly condition exists with respect to the first anomaly group classification instance;
• and
• wherein said trained neural network includes:
• an input layer for receiving the input values;
• an output layer which contains the computed output values, said output layer being smaller than said input layer;
• at least three neural network layers including neural network nodes, said at least three neural network layers including neural network nodes including a first neural network processing layer, a second neural network processing layer, and a bottleneck layer, said bottleneck layer having the fewest nodes of any neural network layer of the neural network containing neural network nodes, said bottleneck layer receiving inputs from said first processing neural network layer and providing outputs to said second neural network layer;
• said neural network having been trained to minimize the error between the output values and a subset of the input values.

A system to detect traffic anomalies comprising:

• a trained neural network;
• and
• a processor, said processor being configured to control the operations of the system to:
• input into the trained neural network input values, said input values including:
• i) a set of key performance indicator values and ii) one or more selector values corresponding to a first anomaly group classification instance;
• operate the trained neural network to output values corresponding to the inputted set of key performance indicator values;
• determine a score for the first anomaly group classification instance based on the output values of the trained neural network corresponding to the key performance indicator values, each of said output values corresponding to one key performance indicator input value;
• compare the score to a first threshold;
• and
• when said score is above the first threshold determine that an anomaly condition exists with respect to the first anomaly group classification instance;
• wherein said trained neural network is an autoencoder neural network trained to minimize the error between the outputted values corresponding to the inputted set of key performance indicator values, said autoencoder neural network being a neural network including:
• i) a number of neural network nodes in a bottleneck layer of the neural network, said bottleneck layer of the neural network having the fewest number of nodes of any layer of the neural network containing neural network nodes;
• ii) one or more encoding layers, each of said encoding layers containing more neural network nodes than said bottleneck layer;
• and
• iii) one or more decoding layers, each of said decoding layers containing more neural network nodes than said bottleneck layer.

A non-transitory computer readable medium including a first set of computer executable instructions which when executed by a processor of a traffic anomaly detection node cause the traffic anomaly detection node to:

• input into a trained neural network input values, said input values including:
• i) a set of key performance indicator values and ii) one or more selector values corresponding to a first anomaly group classification instance;
• operate the trained neural network to output values corresponding to the inputted set of key performance indicator values;
• determine a score for the first anomaly group classification instance based on the output values of the trained neural network corresponding to the key performance indicator values, each of said output values corresponding to one key performance indicator input value;
• compare the score to a first threshold;
• when said score is above the first threshold determining that an anomaly condition exists with respect to the first anomaly group classification instance;
• and
• wherein said trained neural network is an autoencoder neural network trained to minimize the error between the outputted values corresponding to the inputted set of key performance indicator values, said autoencoder neural network being a neural network including:
• i) a number of neural network nodes in a bottleneck layer of the neural network, said bottleneck layer of the neural network having the fewest number of nodes of any layer of the neural network containing neural network nodes;
• ii) one or more encoding layers, each of said encoding layers containing more neural network nodes than said bottleneck layer;
• and
• iii) one or more decoding layers, each of said decoding layers containing more neural network nodes than said bottleneck layer.