Adaptive filtering based network anomaly detection

A controller for wireless network communication, the controller comprising:

• a processor;
• and
• a storage device coupled to the processor, the storage device having code for execution by the processor to perform a method comprising:
• performing adaptive filtering on a wireless network quality indicator to predict future values of the wireless network quality indicator;
• calculating residues between the predicted future values and measured values of the wireless network quality indicator;
• analyzing the residues over at least one selected frequency band to determine if a threshold has been exceeded for the at least one selected frequency band, including performing a residue clustering algorithm, using the residues and data streams generated by IIR filters, to determine time slots in which predicted future values deviate from measured values;
• and
• detecting an anomaly event of the wireless network in a frequency band in which a threshold has been exceeded using the residues and measured values of the wireless network quality indicator.

A machine readable storage device comprising instructions that, when executed by a machine processor, cause the processor to:

• perform adaptive filtering on a wireless network quality indicator to predict future values of the wireless network quality indicator;
• determine residues between the predicted future values and measured values of the wireless network quality indicator;
• analyze the residues over at least one selected frequency band to determine if a threshold has been exceeded for the at least one selected frequency band, including performing a residue clustering algorithm, using the residues and data streams generated by an IIR filter or FIR filter, to determine time slots in which predicted future values deviate from measured values;
• and
• detect an anomaly event in the wireless network.

A computer program stored on a nonvolatile computer readable medium, the program comprising instructions that, when executed by a machine processor, cause the processor to:

• perform adaptive filtering on a wireless network quality indicator to predict future values of the wireless network quality indicator;
• determine residues between the predicted future values and measured values of the wireless network quality indicator;
• analyze the residues over at least one selected frequency band to determine if a threshold has been exceeded for the at least one selected frequency band, including performing a residue clustering algorithm, using the residues and data streams generated by an IIR filter or FIR filter, to determine time slots in which predicted future values deviate from measured values;
• and
• detect an anomaly event in the wireless network.

A method comprising:

• performing, via a controller, adaptive filtering on a network quality indicator to predict future values of the network quality indicator;
• calculating, via the controller, residues between the predicted future values and measured values of the network quality indicator;
• analyzing, via the controller, the residues over at least one selected frequency band, including using an infinite impulse response (IIR) filter or finite impulse response (FIR) filter for the at least one selected frequency band and performing a residue clustering algorithm, using the residues and data streams generated by the IIR filter or the FIR filter, to determine time slots in which predicted future values deviate from measured values, to determine if a threshold has been exceeded for the at least one selected frequency band;
• and
• detecting, via the controller, an anomaly event of the network in a frequency band in which a threshold has been exceeded using the residues and measured values of the network quality indicator.