• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    A computer implemented method of network monitoring and control. The method comprises receiving (11) alerts related to monitored devices; analyzing (12) the alerts to identify a first alert related to a first monitored device; automatically performing (13) at least one predefined action for the first monitored device based on the first alert; and after a first predefined period of time, checking whether the first alert has reappeared and responsively taking a further action.
    公开号:FI20185596A1
    申请号:FI20185596
    申请日:2018-06-29
    公开日:2019-12-30
    发明作者:Henri Karikallio
    申请人:Elisa Oyj；
    IPC主号:
    专利说明:

    AUTOMATED NETWORK MONITORING AND CONTROL
    20185596 prh 29 -06- 2018
    TECHNICAL FIELD [0001] The present application generally relates to automated network monitoring and control.
    BACKGROUND [0002] This section illustrates useful background information without admission of any technique described herein representative of the state of the art.
    [0003] A network operation center (NOC) is generally a location from which NOC personnel exercises monitoring and control over a network. NOC personnel are responsible for monitoring one or many networks for certain conditions that may require special attention to avoid degraded service. NOC personnel follow screens showing events received from network devices, ongoing incidents and general network performance. NOC personnel decide upon required actions based on information they see on the screens.
    [0004] Automation of NOC functionality of telecommunication networks has been developed in order to improve efficiency of network monitoring and control and to reduce the amount of manual work and human errors. But automation of network monitoring and control is not a straightforward task to implement.
    SUMMARY [0005] Various aspects of examples of the invention are set out in the claims.
    [0006] According to a first example aspect of the present invention, there is provided a computer implemented method of network monitoring and control. The method comprises receiving alerts related to monitored devices;
    analyzing the alerts to identify a first alert related to a first monitored device; automatically performing at least one predefined action for the first monitored device based on the first alert; and after a first predefined period of time, checking whether the first alert has reappeared and responsively taking a further action.
    [0007] In an embodiment, the method further comprises, prior to analyzing
    20185596 prh 29 -06- 2018 the alerts, filtering the received alerts to reduce the number of alerts to be analyzed.
    [0008] In an embodiment, filtering the received alerts comprises reducing number of alerts per monitored device per a second predefined period of time below a certain maximum number.
    [0009] In an embodiment, filtering the received alerts comprises removing alerts considered not to require reparative actions and/or not to have customer impact.
    [0010] In an embodiment, the method further comprises identifying that the first alert has not reappeared and responsively terminating processing of the first alert.
    [0011] In an embodiment, the method further comprises identifying that the first alert has reappeared and performing another predefined action for the first network device.
    [0012] In an embodiment, the method further comprises identifying that the first alert has reappeared and responsively repeating said predefined action.
    [0013] In an embodiment, the method further comprises identifying that the first alert has reappeared and responsively generating a ticket for manual handling.
    [0014] In an embodiment, the received alerts indicate one or more of the following: faulty or degraded operation, degraded performance, unavailable service, and a change in external conditions.
    [0015] In an embodiment, the predefined action is an action affecting operation of the first monitored device.
    [0016] In an embodiment, the predefined action comprises one or more of the following: resetting the monitored device, changing value of at least one parameter in the monitored device, closing a port in the monitored device, opening a port in the monitored device, and automatically generating a ticket for manual action.
    [0017] In an embodiment, the first alert is an indication of a faulty cell and the predefined action comprises resetting the first monitored device.
    [0018] In an embodiment, the first alert is an indication of a faulty cell and the predefined action comprises resetting the first monitored device and changing value of at least one parameter in the first monitored device.
    [0019] In an embodiment, the first alert is an indication of no data transmission in a cell and the predefined action comprises reactivating data transmission in the first monitored device.
    20185596 prh 29 -06- 2018 [0020] In an embodiment, the method further comprises identifying a second alert related to the first monitored device and selecting the predefined action based on combination of the first alert and the second alert.
    [0021] In an embodiment, the first alert is an indication of a faulty cell and the second alert is an indication of a link failure and the predefined action comprises generating a ticket for manual action.
    [0022] In an embodiment, the method further comprises identifying that more than two alerts related to the first monitored device have occurred during a third predefined period of time and responsively generating a ticket for manual action as the predefined action.
    [0023] In an embodiment, the monitored devices are network devices of a telecommunication network, network devices of a radio access network, .devices of a power grid, and/or devices of a cable or television network.
    [0024] In an embodiment, the monitored devices are electronic devices that are communicatively connected to a network monitoring and control system performing the method.
    [0025] According to a second example aspect of the present invention, there is provided an apparatus comprising a processor and a memory including computer program code; the memory and the computer program code configured to, with the processor, cause the apparatus to perform the method of the first aspect or any related embodiment.
    [0026] According to a third example aspect of the present invention, there is provided a computer program comprising computer executable program code which when executed by a processor causes an apparatus to perform the method of the first aspect or any related embodiment.
    [0027] The computer program of the third aspect may be a computer program product stored on a non-transitory memory medium.
    [0028] Different non-binding example aspects and embodiments of the present invention have been illustrated in the foregoing. The embodiments in the foregoing are used merely to explain selected aspects or steps that may be utilized in implementations of the present invention. Some embodiments may be presented only with reference to certain example aspects of the invention. It should be appreciated that corresponding embodiments may apply to other example aspects as well.
    20185596 prh 29 -06- 2018
    BRIEF DESCRIPTION OF THE DRAWINGS [0029] For a more complete understanding of example embodiments of the present invention, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:
    [0030] Fig. 1 shows an example scenario according to an embodiment;
    [0031] Fig. 2 shows a system according to an embodiment;
    [0032] Fig. 3 shows logical components of an example system suited for implementing certain embodiments;
    [0033] Figs. 4A-4E show flow diagrams illustrating example methods according to certain embodiments; and [0034] Fig. 5 shows an apparatus according to an embodiment.
    DETAILED DESCRIPTON OF THE DRAWINGS [0035] Example embodiments of the present invention and its potential advantages are understood by referring to Figs. 1 through 5 of the drawings. In this document, like reference signs denote like parts or steps.
    [0036] In an embodiment of the invention there is provided an automated network monitoring and control system. The developed automated solution can be employed in NOC functionality of a telecommunication network. Additionally or alternatively, the developed automated solution can be employed in monitoring and control of devices of a power grid or of devices of a cable or television network or some other group of monitored devices. In general, the developed automated solution can be employed for monitoring and control of any electronic devices that are communicatively connected to a network monitoring and control system implementing the automated solution. Various embodiments of the invention discussed in the following relate to monitoring of a telecommunication network, but it is to be understood that disclosed embodiments may be applied to other monitored devices, too. A monitored device in the sense of present disclosure can be any electronic device that is being monitored and/or controlled. It is to be noted that the group of monitored devices may be part of a larger system comprising also devices that are not being monitored. For example a telecommunication network may comprise a plurality of devices that are not being monitored or controlled through the present automated solution.
    20185596 prh 29 -06- 2018 [0037] As operational load and network complexity increase due to increasing number of base stations and other network devices as well as increasing amount of manual work required for maintaining quality of network, there is increasing need for automation of network monitoring and control of telecommunication networks. At the same time the need for automated monitoring increases in other application areas, too.
    [0038] Fig. 1 shows an example scenario according to an embodiment. The scenario shows a group of monitored devices 101 and an automated monitoring and control system 111. Alerts related to the monitored devices 101 are conveyed to the automated monitoring and control system 111 in phase 11. The cause for generation of an alert may be for example a fault in a monitored device such as one or more of the following: abnormal behaviour of a monitored device, hardware failure in a monitored device, exceeding a predefined threshold, synchronization problem, failure in operation of a functionality, excess load, insufficient storage capacity, insufficient processing resources, degraded performance etc. Performance of the monitored device or the whole system comprising the monitored device may be based on suitable performance indicators. The performance indicators may comprise for example counter values and/or Key Performance Indicator, KPI, values derived on the basis of one or more other performance indicators. In an example implementation, the performance indicators are observed over a predefined time and, if needed, an alert is generated on the basis of the observations. Additionally or alternatively, in a telecommunication network the cause for generation of an alert may be for example one or more of the following: abnormal behaviour of a base station, transmission problem in a network link, existence of an SNMP (Simple Network Management Protocol) trap, degraded throughtput etc. Additionally or alternatively, the source of the alert may be an external system, such as a weather database or a traffic data source or a call data record (CDR) database.
    [0039] The automated monitoring and control system 111 analyses the alerts in 12 to automatically decide on actions to be taken. The automatically decided actions are performed on one or more monitored devices in phase 13. It is to be noted that the action is decided and performed autonomously without human interaction. Furthermore, it is to be noted that the device originating the alert may be different from the device in which the automated action is applied. Additionally or alternatively, the automatically decided action may be generation of a ticket for
    20185596 prh 29 -06- 2018 manual action. In this case human actions may be used for solving the issue. The shown process is continuously repeated. Additionally, if the fault causing the alert(s) is not fixed by the automatic action and/or the alert reappears, a ticket for manual action may be generated.
    [0040] Fig. 2 shows a system according to an embodiment. The system comprises a telecommunication network 110, user devices 109, cloud and service platforms 107 and Internet 108. The telecommunication network 110 serves user devices 109 connected to the telecommunication network 110. The telecommunication network 110 provides communication services to the user devices such as for example access to cloud and service platforms 107 and Internet 108 and other systems. The telecommunication network 110 may be divided into a radio access network 102 comprising base stations that provide radio interface for connecting to the telecommunication network 110, a backhaul portion 103 that connects the radio interface of the radio access network 110 to other parts of the network, IP/MPLS (Internet Protocol I Multiprotocol Label Switching) portion 104 that provides data-carrying services for both circuit switched and packet switched communications, a circuit switched core network 105 for circuit switched communications and a packet switched core network 106 for packet switched communications.
    [0041] Further the system of Fig. 2 comprises an OSS (Operations Support System) 110 and an automated monitoring and control system 111. The OSS continuously collects alerts from one or more monitored devices of the telecommunication network 110. For example hardware failure in a base station of the radio access network 102 causes generation of an alert that is then conveyed to the OSS. The alerts received in the OSS are conveyed to the automated monitoring and control system 111. The automated monitoring and control system 111 analyses the alerts to automatically decide on actions that may be required. The action may be an automatic action 112 performed on one or more monitored devices of the telecommunication network, such as resetting a monitored device, changing value of at least one parameter in a monitored device, closing a port in a monitored device, or opening a port in a monitored device. Alternatively or additionally the action may be generation of an alert ticket for manual action.
    [0042] Fig. 3 shows logical components of an example system suited for implementing certain embodiments. The system is divided into a hardware
    20185596 prh 29 -06- 2018 supervision block 310, a performance supervision block 320, a predictive supervision block 330 and a manual actions block 340. The hardware supervision block 310 concerns collecting and analyzing 311, 312 alerts received from physical monitored devices, and automatically deciding and performing actions based on the analysis 112 and possibly generating tickets for manual actions 113. The performance supervision block 320 concerns collecting and analyzing performance data related to monitored devices 321, 322, and automatically deciding and performing actions based on the analysis 112 and possibly generating tickets for manual actions 113. The predictive supervision block 330 concerns collecting 331 data from the monitored devices, the data comprising for example alerts and/or performance data, and predicting forthcoming alerts or incidents based on collected data 332. The predicted alerts or incidents are then used for deciding and performing actions 112 and possibly for generating tickets for manual actions 113. The manual actions block 340 concerns manually performed work, such as 342: handling of tickets relating to customer complaints and 341: handling of tickets generated by the automatic process of one of the blocks 310-330. It is to be noted that data for the hardware supervision, performance supervision and predictive supervision blocks 310, 320, 330 may be collected from other external sources, too. For example weather or traffic data may be collected. Certain embodiments of present invention relate mainly but not exclusively to the hardware supervision block 310 and the performance supervision block 320.
    [0043] Figs. 4A-4E show flow diagrams illustrating example methods according to certain embodiments. The methods may be implemented in the automated monitoring and control system 111 of Figs. 1 and 2. The methods are implemented in a computer and do not require human interaction. It is to be noted that the methods may however provide output that may be further processed by humans. The methods of Figs. 4A-4E may be combined with each other and the order of phases conducted in each method may be changed expect where otherwise explicitly defined. Furthermore it is to be noted that performing all phases of the flow charts is not mandatory.
    [0044] Fig. 4A shows a flow diagram illustrating a method according to an embodiment of the invention. The method comprises following phases:
    [0045] Phase 401: Alerts are received. The alerts may be alerts concerning faults in operation of monitored devices. The faults may concern hardware problems,
    20185596 prh 29 -06- 2018 unavailable services or degraded performance as discussed in connection with Fig
    1. Additionally or alternatively the source of alerts may be an external source, such as weather database or traffic surveillance database.
    [0046] Phase 402: The received alerts are analyzed and an alert related to a monitored device is identified. This phase may comprise filtering the alerts to reduce the number of alerts in further processing and/or classifying the alerts to different categories.
    [0047] Phase 405: An action is performed for the monitored device based on the identified alert. The action may be chosen for example based on predefined rules or predefined logic charts. It is to be noted that more than one alert related to the monitored device may have been identified and the action may be chosen on the basis of more than one identified alert. That is, there may be a certain alert pattern that leads to a certain action, while one single alert may lead to another action. It is to be noted that in this context an action may comprise a single action or more than one actions.
    [0048] Phase 406: After performing the action, the process waits for a predefined period of time. This may be for example 5 min, 10 min, 20 min, 30 min, 1 h or 3 h.
    [0049] Phase 407: It is checked whether the fault causing the alert identified in phase 402 was fixed. In an example embodiment this is implemented by checking if the identified alert reappears. If the fault was fixed, the process stops in phase 409 and a report is generated to log the action that was taken by the automatic process. If the fault was not fixed, a ticket for manual action is generated in phase 404. Alternatively or additionally, the process may return to phase 405 to repeat the action for the monitored device. Yet another alternative (not shown in Fig 4A) is to perform for the monitored device another action different from the action performed in phase 405. In yet another alternative the process simply reports the action that was attempted without an actual ticket being generated.
    [0050] By checking whether the alert reappears and generating a ticket for manual action if necessary, one achieves that the automatic system does not continue to perform the automatic action forever, if the action is not fixing the problem.
    [0051] In an embodiment the alert that is identified in phase 402 is a cell faulty alert in a telecommunication network and the action that is performed in phase
    20185596 prh 29 -06- 2018
    405 is resetting the network device (the monitored device may be for example a base station). For example existence of one or more of the following alerts may be considered a cell faulty alert: monitored device disconnected, base station down, cell out of service, cell unavailable, and transmission interruption.
    [0052] Other embodiments comprise the following different embodiments:
    - The alert that is identified in phase 402 is an indication of no data transmission in a cell and the action that is performed in phase 405 is reactivating data transmission in the cell by resetting the monitored device.
    - The alert that is identified in phase 402 is an indication of no data transmission in a cell and the action that is performed in phase 405 is reactivating data transmission in the cell by deactivating and activating a GPRS (General Packet Radio Service) parameter.
    - The alert that is identified in phase 402 is an indication of a fault in VSWR (Voltage Standing Wave Ratio) antenna monitoring or a VSWR alarm and the action that is performed in phase 405 is generation of a ticket for manual action.
    - The alert that is identified in phase 402 is an indication of a power unit output voltage fault and the action that is performed in phase 405 is generation of a ticket for manual action.
    - The alert that is identified in phase 402 is an indication of a fault in the chain between a power unit and MHA (Masthead Amplifier) and the action that is performed in phase 405 is generation of a ticket for manual action.
    - The alert that is identified in phase 402 is an indication of a LAN (Local Area Network) error or a communication error and the action that is performed in phase 405 is resetting the monitored device.
    - The alert that is identified in phase 402 is an indication of a control plane problem and the action that is performed in phase 405 is deactivating and activating LTE (Long Term Evolution) S1 link.
    - The alert that is identified in phase 400 is an indication of exceeded threshold in Twamp (Two-Way Active Measurement Protocol) measurement and the action that is performed in phase 405 is resetting the network device.
    - The alert that is identified in phase 400 is an indication of over 20 Bad Uplink events in a day or an indication of over 20 abnormal distribution
    20185596 prh 29 -06- 2018 events and the action that is performed in phase 405 is locking and opening a cell. It is to be noted that instead of 20, the threshold may be some other number such as for example 10, 30 or 50.
    [0053] Fig. 4B shows a flow diagram illustrating a method according to an embodiment of the invention. The method comprises following phases:
    [0054] Phase 420: A first alert related to a monitored device is identified as a result of analyzing received alerts. Similarly to phase 402 of Fig. 4A, this phase may comprise filtering the alerts to reduce the number of alerts in further processing and/or classifying the alerts to different categories.
    [0055] Phases 422 and 423: The process waits for a predefined period of time and checks if also a second alert is identified during this period of time. The predefined time may be for example 5 min, 10 min, 20 min, 30 min, 1 h or 3 h. The second alert may be different from the first alert or the same alert as the first alert. Additionally or alternatively, the second alert may be related to the same monitored device as the first alert or the second alert may concern some other monitored device.
    [0056] If the second alert is identified, a ticket for manual action is generated in phase 408. In this way it is possible to quickly escalate the matter to manual handling in case there appears to be a more extensive problem in the group of monitored devices.
    [0057] If the second alert is not identified within the predefined period of time, the process proceeds to phase 405 and an action is performed for the monitored device based on the identified first alert similarly as in Fig 4A.
    [0058] Phase 406: After performing the action, the process waits for a predefined period of time. This may be for example 5 min, 10 min, 20 min, 30 min or an hour. It is to be noted that the waiting time in phases 422 and 406 may be the same or different.
    [0059] Phase 407: It is checked whether the fault causing the first alert was fixed. In an example embodiment this is implemented by checking if the first alert reappears. If the fault was fixed, the process stops in phase 409 and a report is generated to log the action that was taken by the automatic process. If the fault was not fixed, a ticket for manual action is generated in phase 404. Alternatively or additionally, the process may return to phase 405 to repeat the action for the monitored device. Yet another alternative (not shown in Fig 4B) is to perform for the
    20185596 prh 29 -06- 2018 monitored device another action different from the action performed in phase 405. It is to be noted that the type of tickets generated in phases 404 and 408 may be different and targeted to different operations.
    [0060] In an embodiment the alert that is identified in phase 420 is a cell faulty alert in a telecommunication network and the second alert in phase 423 is a link faulty alert in the telecommunication network. The action that is performed in phase 405 may be resetting the monitored device (the monitored device may be for example a base station). For example existence of one or more of the following alerts may be considered a cell faulty alert: monitored device disconnected, base station down, cell out of service, cell unavailable, and transmission interruption. The link faulty alert may be for example an SCTP (Stream Control Transmission Protocol) link fault alert. The ticket generated in phase 408 may be for transmission operations and the ticket generated in phase 404 may be for radio network operations.
    [0061] Fig. 4C shows a flow diagram illustrating a method according to an embodiment of the invention. The method comprises following phases:
    [0062] Phase 430: Alerts related to a monitored device are monitored and identified over a predefined period of time. The predefined time may be for example 5 min, 10 min, 20 min, 30 min, 1 h or 3 h. The time may be the same or different as in phase 406 or 422.
    [0063] Phases 431 and 432: One alert is identified and a first set of automatic actions is performed for the monitored device. In an example embodiment, the first set of automatic actions comprises resetting the monitored device. The identified alert may be a cell faulty alert in a telecommunication network or some other alert.
    [0064] Phases 433 and 434: Two alerts are identified and a second set of automatic actions is performed for the network device. In an example embodiment, the second set of automatic actions comprises resetting the monitored device and changing value of a parameter in the monitored device. The identified alerts may be consecutive cell faulty alerts or the alerts may be different types of alerts.
    [0065] Phase 435: More than two alerts are identified for the monitored device. Consequently the process proceeds to phase 404 and a ticket for manual action is generated.
    [0066] Fig. 4D shows a flow diagram illustrating a method according to an
    20185596 prh 29 -06- 2018 embodiment of the invention. The method concerns filtering the alerts prior to further processing. This may be part of phase 402 or 420 of Figs. 4A and 4B for example. The filtering may be performed on the basis of predefined rules. The method comprises following phases:
    [0067] Phase 401: Alerts are received.
    [0068] Phase 442: Filtering of the received alerts is started to reduce the number of alerts in further processing.
    [0069] Phase 445: Alerts considered not to have customer impact are removed. There may be for example some alerts that a known not to affect customer experience or some alerts that cannot be avoided but do not require any actions to be taken. Such filtering may reduce the number of alerts considerably. For example in an example scenario concerning a telecommunication network only 50 000 alerts out of 1 000 000 alerts may be considered to have customer impact. Additionally or alternatively, alerts that are considered not to require reparative actions may be removed in this phase. Not having customer impact is one reason for this, but also other reasons exist. For example some alerts may come and go regularly without requiring any action or some alerts may relate to behavior that cannot be fixed. There may be for example some alerts that are known to cause for example degraded performance, but that cannot be fixed or that is known to automatically disappear.
    [0070] Phase 446: Alerts per monitored device per a predefined time period are reduced below a maximum number. The maximum number may be for example 3, 4, 5, 6, 7 or 10 and the time period may be for example 10 min, 30 min, 1 h or 3 h.
    [0071] Fig. 4E shows a flow diagram illustrating a method according to an embodiment of the invention. The method concerns monitoring of a telecommunication network and deciding what type of ticket to generate in case a ticket for manual action is generated in response to the automatic actions failing to fix the problems. In general, the ticket may be generated to different operations depending on the alerts that have been identified. In this way it is possible to select appropriate operations for the action based on importance of fixing the problem. The method comprises following phases:
    [0072] Phase 450: A need to generate ticket for manual action is identified for example as disclosed in connection with Figs. 4A-4C.
    [0073] Phases 451 and 452: One alert has been identified and the ticket is
    20185596 prh 29 -06- 2018 generated to radio network operations.
    [0074] Phases 453 and 454: A second alert related to transmission problems has been identified and the ticket is generated to transmission operations.
    [0075] Phases 455 and 456: A second alert related to controller problems has been identified and the ticket is generated to centralized platform operations.
    [0076] Fig. 5 shows an apparatus 50 according to an embodiment. The apparatus 50 is for example a general-purpose computer or server or some other electronic data processing apparatus. The apparatus 50 can be used for implementing embodiments of the invention. That is, with suitable configuration the apparatus 50 is suited for operating for example as the network monitoring and control system 111 of foregoing disclosure.
    [0077] The general structure of the apparatus 50 comprises a processor 51, and a memory 52 coupled to the processor 51. The apparatus 50 further comprises software 53 and database 54 stored in the memory 52 and operable to be loaded into and executed in the processor 51. The software 53 may comprise one or more software modules and can be in the form of a computer program product. The database 54 may be usable for storing e.g. rules and patterns for use in data analysis. Further, the apparatus 50 comprises a communication interface 55 coupled to the processor 51.
    [0078] The processor 51 may comprise, e.g., a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a graphics processing unit, or the like. Fig. 5 shows one processor 51, but the apparatus 50 may comprise a plurality of processors.
    [0079] The memory 52 may be for example a non-volatile or a volatile memory, such as a read-only memory (ROM), a programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), a random-access memory (RAM), a flash memory, a data disk, an optical storage, a magnetic storage, a smart card, or the like. The apparatus 50 may comprise a plurality of memories. The memory 52 may be constructed as a part of the apparatus 50 or it may be inserted into a slot, port, or the like of the apparatus 50 by a user.
    [0080] The communication interface 55 may comprise communication modules that implement data transmission to and from the apparatus 50. The communication modules may comprise, e.g., a wireless or a wired interface module. The wireless interface may comprise such as a WLAN, Bluetooth, infrared (IR), radio
    20185596 prh 29 -06- 2018 frequency identification (RF ID), GSM/GPRS, CDMA, WCDMA, or LTE (Long Term Evolution) radio module. The wired interface may comprise such as Ethernet or universal serial bus (USB), for example. Further the apparatus 50 may comprise a user interface (not shown) for providing interaction with a user of the apparatus. The user interface may comprise a display and a keyboard, for example. The user interaction may be implemented through the communication interface 55, too.
    [0081] The database 54 may be certain memory area in the memory 52 or alternatively the database 54 may be a separate component or the database 54 may be located in a physically separate database server that is accessed for example through the communication unit 55. The database unit 54 may be a relational (SQL) or a non-relational (NoSQL) database.
    [0082] A skilled person appreciates that in addition to the elements shown in Fig. 5, the apparatus 50 may comprise other elements, such as microphones, displays, as well as additional circuitry such as memory chips, application-specific integrated circuits (ASIC), other processing circuitry for specific purposes and the like. Further, it is noted that only one apparatus is shown in Fig. 5, but the embodiments of the invention may equally be implemented in a cluster of shown apparatuses.
    [0083] Without in any way limiting the scope, interpretation, or application of the claims appearing below, a technical effect of one or more of the example embodiments disclosed herein is ability to automate network monitoring and control in telecommunication networks.
    [0084] Another technical effect of one or more of the example embodiments disclosed herein is that increasing number of issues in monitored devices can be solved before they are visible to end users thereby improving user experience. Another technical effect of one or more of the example embodiments disclosed herein is that complex systems with increasing traffic amount can be handled without necessarily needing additional personnel for network monitoring tasks.
    [0085] Another technical effect of one or more of the example embodiments disclosed herein is that risk of human errors may be reduced. For example in a NOC functionality it is likely that due to huge amount of alerts to be monitored, some alerts may go unnoticed by the monitoring personnel. Whereas, in the automated solution, all alerts are equally processed.
    [0086] If desired, the different functions discussed herein may be performed in a different order and/or concurrently with each other. Furthermore, if desired, one or more of the before-described functions may be optional or may be combined.
    [0087] Although various aspects of the invention are set out in the independent claims, other aspects of the invention comprise other combinations of features from the described embodiments and/or the dependent claims with the features of the independent claims, and not solely the combinations explicitly set out in the claims.
    [0088] It is also noted herein that while the foregoing describes example embodiments of the invention, these descriptions should not be viewed in a limiting sense. Rather, there are several variations and modifications, which may be made without departing from the scope of the present invention as defined in the appended claims.
    权利要求:
    Claims (21)
    [1] 20185596 prh 29 -06- 2018
    1. A computer implemented method of network monitoring and control, the method comprising receiving (11) alerts related to monitored devices;
    analyzing (12, 402) the alerts to identify a first alert related to a first monitored device;
    automatically performing (13, 405) at least one predefined action for the first monitored device based on the first alert; and after a first predefined period of time, checking (407) whether the first alert has reappeared and responsively taking a further action.
    [2] 2. The method of claim 1, further comprising prior to analyzing the alerts, filtering (442) the received alerts to reduce the number of alerts to be analyzed.
    [3] 3. The method of claim 2, wherein filtering the received alerts comprises reducing (446) number of alerts per monitored device per a second predefined period of time below a certain maximum number and/or removing (445) alerts considered not to require reparative actions or not to have customer impact.
    [4] 4. The method of any preceding claim, further comprising identifying that the first alert has not reappeared and responsively terminating (409) processing of the first alert.
    [5] 5. The method of any preceding claim, further comprising identifying that the first alert has reappeared and performing another predefined action for the first network device.
    [6] 6. The method of any preceding claim, further comprising identifying that the first alert has reappeared and responsively repeating said predefined action or generating (404) a ticket for manual handling.
    20185596 prh 29 -06- 2018
    [7] 7. The method of any preceding claim, wherein the received alerts indicate one or more of the following: faulty or degraded operation, degraded performance, unavailable service, and a change in external conditions.
    [8] 8. The method of any preceding claim, wherein the predefined action is an action affecting operation of the first monitored device.
    [9] 9. The method of any preceding claim, wherein the predefined action comprises one or more of the following: resetting the monitored device, changing value of at least one parameter in the monitored device, closing a port in the monitored device, opening a port in the monitored device, and automatically generating a ticket for manual action.
    [10] 10. The method of any preceding claim, wherein the first alert is an indication of a faulty cell and the predefined action comprises resetting the first monitored device.
    [11] 11. The method of any preceding claim, wherein the first alert is an indication of a faulty cell and the predefined action comprises resetting the first monitored device and changing value of at least one parameter in the first monitored device.
    [12] 12. The method of any preceding claim, wherein the first alert is an indication of no data transmission in a cell and the predefined action comprises reactivating data transmission in the first monitored device.
    [13] 13. The method of any preceding claim, further comprising identifying (423) a second alert related to the first monitored device and selecting the predefined action based on combination of the first alert and the second alert.
    [14] 14. The method of claim 14, wherein the first alert is an indication of a faulty cell and the second alert is an indication of a link failure and the predefined action comprises generating a ticket for manual action.
    [15] 15. The method of any preceding claim, further comprising identifying (435) that more than two alerts related to the first monitored device have occurred during a third predefined period of time and responsively generating (404) a ticket for manual action as the predefined action.
    [16] 16. The method of any preceding claim, wherein network devices of a telecommunication network (110).
    the monitored devices are
    [17] 17. The method of any preceding claim, wherein network devices of a radio access network (102).
    the monitored devices are the monitored
    [18] 18. The method of any preceding claim, wherein devices of a power grid or devices of a cable or television network.
    devices are
    [19] 19. The method of any preceding claim, wherein the monitored electronic devices that are communicatively connected to a network monitoring and control system performing the method.
    devices are
    [20] 20. An apparatus (50, 111) comprising a processor (51), and a memory (52) including computer program code; the memory and the computer program code configured to, with the processor, cause the apparatus to perform the method of any one of claims 1-19.
    20185596 prh 29 -06- 2018
    [21] 21. A computer program comprising computer executable program code (53) which when executed by a processor causes an apparatus to perform the method of any one of claims 1 -19.
    类似技术:
    公开号 | 公开日 | 专利标题
    US9680722B2|2017-06-13|Method for determining a severity of a network incident
    CN105744553B|2021-05-04|Network association analysis method and device
    CN108768710B|2021-12-24|Dynamic weight evaluation method, model and device for optical transmission network health
    US11252066B2|2022-02-15|Automated network monitoring and control
    US20210226840A1|2021-07-22|Automated network monitoring and control
    US20210226853A1|2021-07-22|Automated network monitoring and control
    EP3051750A1|2016-08-03|Collection adaptor management method and system
    KR20190047809A|2019-05-09|Ict equipment management system and method there of
    US10338544B2|2019-07-02|Communication configuration analysis in process control systems
    CN105471621A|2016-04-06|Alarm processing system and method
    CN110609761B|2020-10-16|Method and device for determining fault source, storage medium and electronic equipment
    US11196841B1|2021-12-07|Smart remote agent on an access CPE with an agile OpenWrt software architecture
    WO2021233224A1|2021-11-25|Fault processing method, apparatus, and system
    EP3836599A1|2021-06-16|Method for detecting permanent failures in mobile telecommunication networks
    CN110430093B|2021-07-02|Data processing method and device and computer readable storage medium
    CN110505715B|2021-08-06|Base station device
    WO2021208979A1|2021-10-21|Network fault handling method and apparatus
    CN113760634A|2021-12-07|Data processing method and device
    CN107645395A|2018-01-30|Multicast Routing data checking and device
    CN111600759A|2020-08-28|Method and device for positioning deadlock fault in topological structure
    Firdaus et al.2019|Sleeping Cell Analysis in LTE Network with Self-Healing Approach
    CN109728935A|2019-05-07|One kind being based on SDN Wide Area Network control method and system
    CN113537687A|2021-10-22|Internet of things equipment framework management method, system and equipment
    CN114221874A|2022-03-22|Traffic analysis and scheduling method and device, computer equipment and readable storage medium
    CN111200520A|2020-05-26|Network monitoring method, server and computer readable storage medium
    同族专利:
    公开号 | 公开日
    US20210226840A1|2021-07-22|
    CA3101258A1|2020-01-02|
    FI129101B|2021-07-15|
    EP3815303A1|2021-05-05|
    WO2020002770A1|2020-01-02|
    AU2019293862A1|2020-12-10|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US6665262B1|1999-02-16|2003-12-16|Telefonaktiebolaget Lm Ericsson |Distributed fault management architecture|
    US8823536B2|2010-04-21|2014-09-02|Microsoft Corporation|Automated recovery and escalation in complex distributed applications|
    US10193742B2|2015-10-29|2019-01-29|Kodacloud Inc.|Selecting a corrective action for a network connection problem based on historical data|
    US20180091369A1|2016-09-28|2018-03-29|Intel Corporation|Techniques to detect anomalies in software defined networking environments|
    法律状态:
    2021-07-15| FG| Patent granted|Ref document number: 129101 Country of ref document: FI Kind code of ref document: B |
    优先权:
    申请号 | 申请日 | 专利标题
    FI20185596A|FI129101B|2018-06-29|2018-06-29|Automated network monitoring and control|FI20185596A| FI129101B|2018-06-29|2018-06-29|Automated network monitoring and control|
    AU2019293862A| AU2019293862A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    EP19737572.8A| EP3815303A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    CA3101258A| CA3101258A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    US15/734,401| US20210226840A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    PCT/FI2019/050497| WO2020002770A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    [返回顶部]