Artificial intelligence-driven traffic analysis and anomaly detection for telecommunication networks and internet of things devices

A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising:

• receiving unknown communication traffic in a radio communication network;
• identifying a closest cluster among a plurality of clusters, the plurality of clusters corresponding to traffic patterns in the radio communication network, wherein traffic patterns in a respective cluster share common traffic characteristics, the closest cluster having a smallest spatial distance from the unknown communication traffic;
• adding the unknown communication traffic to the closest cluster;
• decomposing all communication traffic in the closest cluster, forming a decomposed time series;
• removing noise from the decomposed time series;
• reconstructing a baseline of the closest cluster based on trend information and period information of the decomposed time series, forming a reconstructed cluster;
• comparing values of the unknown communication traffic with a range of values for the reconstructed cluster to identify an anomaly in the unknown communication traffic;
• and
• identifying a device or an application operating on the device associated with the anomaly.

A method, comprising:

• receiving, by a processing system including a processor, application traffic from a plurality of Internet of Things (IoT) devices processing an application, wherein the receiving the application traffic comprises receiving the application traffic over a mobile communication network;
• clustering, by the processing system, the application traffic to identify clusters of similar IoT devices based on common characteristics of the application traffic from the plurality of IoT devices;
• receiving, by the processing system, unknown traffic over the mobile communication network;
• determining, by the processing system, a closest cluster, the closest cluster being determined based on similarities between the unknown traffic and respective clusters of the clusters of IoT devices;
• decomposing, by the processing system, traffic signals of the closest cluster into trend information, period information and noise information, forming decomposed traffic;
• reconstructing, by the processing system, the decomposed traffic into reconstructed traffic, wherein the reconstructing is based on the trend information and the period information to remove noise information from the traffic signals of the closest cluster, forming a baseline for the closest cluster;
• detecting, by the processing system, an anomaly in the reconstructed traffic, wherein the detecting the anomaly is based on a variation in data of the reconstructed traffic from data of the baseline for the closest cluster exceeding a statistical threshold;
• and
• initiating, by the processing system, a corrective action to limit a security threat, wherein the corrective action is based on the anomaly in the reconstructed traffic.