# US 2023/0054625 A1 · Network anomaly detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0054625 A1
- Document ID: US20230054625A1
- Status: Published application
- Kind: A1
- Application number: 17/979,508
- Filed: 2022-11-02
- Published: 2023-02-23
- Earliest claimed: 2019-04-29
- Assignees: Google Inc.
- Applicants: Google LLC
- Inventors: James PEROULAS; Poojita THUKRAL; Dutt KALAPATAPU; Andreas TERZIS; Krishna SAYANA
- Web page: https://patentgrep.com/patent/US20230054625A1

## CPC

- H04L 43/028: by filtering
- G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
- G06N 3/0455: Auto-encoder networks; Encoder-decoder networks
- G06N 3/08: Learning methods
- G06N 3/09: Supervised learning
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W 24/08: Testing, {supervising or monitoring} using real traffic
- H04L 41/149: for prediction of maintenance
- H04L 43/16: Threshold monitoring
- H04W 84/042: {Public Land Mobile systems, e.g. cellular systems}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A method for detecting network anomalies includes receiving a control message from a cellular network and extracting one or more features from the control message. The method also includes predicting a potential label for the control message using a predictive model configured to receive the one or more extracted features from the control message as feature inputs. Here, the predictive model is trained on a set of training control messages where each training control message includes one or more corresponding features and an actual label. The method further includes determining that a probability of the potential label satisfies a confidence threshold. The method also includes analyzing the control message to determine whether the control message corresponds to a respective network performance issue. When the control message impacts network performance, the method includes communicating the network performance issue to a network entity responsible for the network performance issue.

## Claims

### Claim 1

A computer-implemented method comprising:
extracting one or more first features and an actual label from a first network control message collected from a network;
predicting a predicted label for a second network control message collected from the network based on one or more second features extracted from the second network control message, the one or more second features being input to a predictive model that is trained based on the one or more first features and the actual label; and
detecting a network anomaly of the network based on the predicted label.

### Claim 2 (depends on 1)

The method of claim 1, wherein the predictive model is trained by:
forming a training control message including the one or more first features and the actual label; and
setting the actual label as a ground truth for the training control message.

### Claim 3 (depends on 1)

The method of claim 1, wherein the detecting comprises:
determining whether the predicted label matches the actual label; and
in response to a determination that the predicted label matches the actual label,
determining whether the second network control message corresponds to a behavior having a detrimental impact on the network.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
in response to a determination that the second network control message corresponds to the behavior having the detrimental impact on the network,
flagging the behavior having the detrimental impact on the network to be fixed; and
informing a network entity to fix the behavior.

### Claim 5 (depends on 1)

The method of claim 1, wherein each of the one or more first features and the actual label corresponds to a characteristic derived from the first network control message, the characteristic corresponding to each first feature being different from the characteristic corresponding to the actual label.

### Claim 6 (depends on 1)

The method of claim 1, wherein the extracting comprises:
extracting the one or more first features from the first network control message based on different control message protocols.

### Claim 7 (depends on 1)

The method of claim 1, wherein, when two or more first features are extracted from the first network control message, the predictive model is trained based on a crossed feature that is generated based on a combination of a portion of the two or more first features.

### Claim 8 (depends on 1)

The method of claim 1, wherein the extracting comprises:
extracting the one or more first features and the actual label from log data corresponding to the first network control message.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
prior to the extracting,
collecting the log data as a sequence;
dissecting the sequence into sub-sequences of a fixed length; and
associating an identifier of the sequence to each sub-sequence.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
determining whether a subset of the sub-sequences fails to be transferred based on a label of the sequence.

### Claim 11

An apparatus, comprising:
processing circuitry configured to
extract one or more first features and an actual label from a first network control message collected from a network,
predict a predicted label for a second network control message collected from the network based on one or more second features extracted from the second network control message, the one or more second features being input to a predictive model that is trained based on the one or more first features and the actual label, and
detect a network anomaly of the network based on the predicted label.

### Claim 12 (depends on 11)

The apparatus of claim 11, wherein the predictive model is trained by:
forming a training control message including the one or more first features and the actual label; and
setting the actual label as a ground truth for the training control message.

### Claim 13 (depends on 11)

The apparatus of claim 11, wherein the processing circuitry is configured to:
determine whether the predicted label matches the actual label, and
in response to a determination that the predicted label matches the actual label,
determine whether the second network control message corresponds to a behavior having a detrimental impact on the network.

### Claim 14 (depends on 13)

The apparatus of claim 13, wherein the processing circuitry is configured to:
in response to a determination that the second network control message corresponds to the behavior having the detrimental impact on the network,
flag the behavior having the detrimental impact on the network to be fixed, and
inform a network entity to fix the behavior.

### Claim 15 (depends on 11)

The apparatus of claim 11, wherein each of the one or more first features and the actual label corresponds to a characteristic derived from the first network control message, the characteristic corresponding to each first feature being different from the characteristic corresponding to the actual label.

### Claim 16 (depends on 11)

The apparatus of claim 11, wherein the processing circuitry is configured to:
extract the one or more first features from the first network control message based on different control message protocols.

### Claim 17 (depends on 11)

The apparatus of claim 11, wherein, when two or more first features are extracted from the first network control message, the predictive model is trained based on a crossed feature that is generated based on a combination of a portion of the two or more first features.

### Claim 18 (depends on 11)

The apparatus of claim 11, wherein the processing circuitry is configured to:
extract the one or more first features and the actual label from log data corresponding to the first network control message.

### Claim 19 (depends on 18)

The apparatus of claim 18, wherein the processing circuitry is configured to:
prior to the extracting,
collect the log data as a sequence,
dissect the sequence into sub-sequences of a fixed length, and
associate an identifier of the sequence to each sub-sequence.

### Claim 20

A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method, the method comprising:
extracting one or more first features and an actual label from a first network control message collected from a network;
predicting a predicted label for a second network control message collected from the network based on one or more second features extracted from the second network control message, the one or more second features being input to a predictive model that is trained based on the one or more first features and the actual label; and
detecting a network anomaly of the network based on the predicted label.