KR20240114666A - Electronic device and method for performing quality management of network - Google Patents

Abstract

According to one embodiment, a method for an electronic device includes identifying an abnormality in a key performance indicator (KPI) related to network quality based on the value of the KPI being outside a specified range. The method includes an operation of identifying a time interval related to when an abnormality in the KPI occurred. The method includes identifying, within the time interval, a plurality of alarms obtained through at least one network element (NE) for the network. The method includes first correlation information between the KPI and the plurality of alarms, identified using learned data about the KPI, and identified according to the time point and occurrence times of the plurality of alarms. and identifying second correlation information between the KPI and the plurality of alarms. The method includes an operation of identifying an alarm that causes an abnormality in the KPI among the plurality of alarms, based on the first relevance information and the second relevance information.

Description

Electronic device and method for performing quality management of a network {ELECTRONIC DEVICE AND METHOD FOR PERFORMING QUALITY MANAGEMENT OF NETWORK}

This disclosure relates to a wireless communication system, and more specifically to an electronic device and method for performing network quality control in a wireless communication system.

A key performance indicator (KPI) can be defined to indicate the quality of the network. The wireless communication system can determine whether a network anomaly has occurred through values related to the KPI. As values related to KPI are managed in a wireless communication system, the quality of the network can be improved.

According to one embodiment, a method for an electronic device may include identifying an abnormality in a key performance indicator (KPI) related to network quality based on the value of the KPI being outside a specified range. The method may include an operation of identifying a time period related to when an abnormality in the KPI occurred. The method may include identifying a plurality of alarms acquired through at least one network element (NE) for the network within the time interval. The method includes first correlation information between the KPI and the plurality of alarms, identified using learned data about the KPI, and identified according to the time point and occurrence times of the plurality of alarms. The method may include identifying second correlation information between the KPI and the plurality of alarms. The method may include an operation of identifying an alarm that causes an abnormality in the KPI among the plurality of alarms, based on the first relevance information and the second relevance information.

According to one embodiment, an electronic device may include a memory, a transceiver, and at least one processor. The at least one processor may be configured to identify an abnormality in a key performance indicator (KPI) related to network quality based on the value of the KPI being outside a specified range. The at least one processor may be set to identify a time period related to when an error in the KPI occurred. The at least one processor may be configured to identify a plurality of alarms acquired through at least one network element (NE) for the network within the time interval. The at least one processor identifies first correlation information between the KPI and the plurality of alarms identified using learned data about the KPI, and the time point and occurrence times of the plurality of alarms. A second correlation between the KPI and the plurality of alarms may be set to identify information. The at least one processor may be set to identify an alarm that causes an abnormality in the KPI among the plurality of alarms, based on the first relevance information and the second relevance information.

1 shows a wireless communication system.
Figure 2 shows a system including an electronic device for obtaining information about at least one cell.
Figure 3 shows an example of a graph showing changes in KPI according to events.
Figure 4 shows an example of a system for analysis of alarms causing KPI degradation and/or abnormalities.
Figure 5 shows an example of a system for learning association rules between alarms and KPIs.
Figure 6 shows the operation of an electronic device to identify an impacting alarm.
Figure 7 shows an example of the operation of an electronic device for learning association rules between alarms and KPIs.
Figure 8 shows an example of the operation of an electronic device to identify an alarm that causes a KPI abnormality.
Figures 9a and 9b show examples of preprocessing data for generated alarms.
Figures 10a and 10b show an example of an operation for identifying a second candidate alarm group based on time series correlation.
Figure 11 shows a graph showing changes in KPI according to alarms.
Figure 12 shows an interface for displaying a graph showing changes in KPI according to an alarm.
13A-13D show an example of an interface for displaying some of the candidate alarms related to a decline in a KPI.
Figure 14 shows a flow chart regarding the operation of the electronic device.
15 shows an example of the functional configuration of an electronic device.

Terms used in the present disclosure are merely used to describe specific embodiments and may not be intended to limit the scope of other embodiments. Singular expressions may include plural expressions, unless the context clearly dictates otherwise. Terms used herein, including technical or scientific terms, may have the same meaning as commonly understood by a person of ordinary skill in the technical field described in this disclosure. Among the terms used in this disclosure, terms defined in general dictionaries may be interpreted to have the same or similar meaning as the meaning they have in the context of related technology, and unless clearly defined in this disclosure, have an ideal or excessively formal meaning. It is not interpreted as In some cases, even terms defined in the present disclosure cannot be interpreted to exclude embodiments of the present disclosure.

In various embodiments of the present disclosure described below, a hardware approach method is explained as an example. However, since various embodiments of the present disclosure include technology using both hardware and software, the various embodiments of the present disclosure do not exclude software-based approaches.

Terms referring to signals used in the following description (e.g. signal, information, symbol, message, signaling, reference signal (RS), data), terms referring to resources (e.g. symbol, slot) (slot), subframe, radio frame, subcarrier, RE (resource element), RB (resource block), BWP (bandwidth part), opportunity), operation status Terms referring to data (e.g. step, operation, procedure), terms referring to data (e.g. packet, user stream, information, bit, symbol, code) Words (codewords), terms referring to channels, terms referring to network entities, terms referring to device components, etc. are exemplified for convenience of explanation. Accordingly, the present disclosure is not limited to the terms described below, and other terms having equivalent technical meaning may be used.

In addition, in the present disclosure, the expressions greater than or less than may be used to determine whether a specific condition is satisfied or fulfilled, but this is only a description for expressing an example, and the description of more or less may be used. It's not exclusion. Conditions written as ‘more than’ can be replaced with ‘more than’, conditions written as ‘less than’ can be replaced with ‘less than’, and conditions written as ‘more than and less than’ can be replaced with ‘greater than and less than’. In addition, hereinafter, 'A' to 'B' means at least one of the elements from A to (including A) and B (including B). Hereinafter, 'C' and/or 'D' means including at least one of 'C' or 'D', i.e. {'C', 'D', 'C' and 'D'}.

The present disclosure describes various embodiments using terms used in some communication standards (e.g., 3rd Generation Partnership Project (3GPP), extensible radio access network (xRAN), and open-radio access network (O-RAN)), This is only an example for explanation, and various embodiments of the present disclosure can be easily modified and applied to other communication systems.

1 shows a wireless communication system.

Referring to FIG. 1, FIG. 1 illustrates a base station 110 and a terminal 120 as some of the nodes that use a wireless channel in a wireless communication system. Although FIG. 1 shows only one base station, the wireless communication system may further include other base stations that are the same or similar to base station 110.

The base station 110 is a network infrastructure that provides wireless access to the terminal 120. The base station 110 has coverage defined based on the distance at which signals can be transmitted. In addition to the base station, the base station 110 includes 'access point (AP)', 'eNodeB (eNB)', '5G node (5th generation node)', and 'next generation nodeB'. , gNB)', 'wireless point', 'transmission/reception point (TRP)', or other terms with equivalent technical meaning.

The terminal 120 is a device used by a user and communicates with the base station 110 through a wireless channel. The link from the base station 110 to the terminal 120 is called downlink (DL), and the link from the terminal 120 to the base station 110 is called uplink (UL). Additionally, although not shown in FIG. 1, the terminal 120 and another terminal may communicate with each other through a wireless channel. At this time, the link between the terminal 120 and other terminals (device-to-device link, D2D) is referred to as a sidelink, and the sidelink may be used interchangeably with the PC5 interface. In some other embodiments, terminal 120 may be operated without user involvement. According to one embodiment, the terminal 120 is a device that performs machine type communication (MTC) and may not be carried by the user. Additionally, according to one embodiment, the terminal 120 may be a narrowband (NB)-internet of things (IoT) device.

The terminal 120 includes 'user equipment (UE)', 'customer premises equipment (CPE)', 'mobile station', and 'subscriber station' in addition to the terminal. , may be referred to as a ‘remote terminal’, a ‘wireless terminal’, an electronic device’, or a ‘user device’ or other terms with equivalent technical meaning. .

Figure 2 shows a system including an electronic device for obtaining information about at least one cell.

Referring to FIG. 2, the electronic device 210 may be used to obtain information about at least one cell. For example, at least one cell may include cell 220-1, cell 220-2, and cell 220-3. Cell 220-1 may be configured by base station 230-1. Cell 220-2 may be configured by base station 230-2. The cell 220-3 may be configured by the base station 230-3.

The electronic device 210 may be connected to at least one base station (eg, base station 230-1 to base station 230-2) corresponding to at least one cell. For example, one base station may be composed of one or more network elements (NEs). As an example, one or more NEs may include a distributed unit (DU) and/or a radio unit (RU).

For example, one or more NEs may provide an alarm about a network abnormality to the electronic device 210 when an abnormality occurs in the network. The electronic device 210 may identify alarms provided from one or more NEs. The electronic device 210 may store alarms provided from one or more NEs. As an example, an alarm may mean information about CPU usage, information about a mismatch of a common public radio port (CPRI) port, and/or information about a function failure of a component related to the NE. .

For example, the electronic device 210 may identify changes in a key performance indicator (KPI). KPI may refer to one of the performance indicators regarding the quality of the network. As an example, the KPI may include a value related to throughput, a value related to cell capacity, a value related to handover success rate, a value related to packet loss, a value related to transmission capacity, and /Or it may mean a value for the session setup failure rate.

According to one embodiment, an abnormality and/or a decrease in KPI (hereinafter referred to as an anomaly in KPI) may occur depending on the use of the network. The electronic device 210 may identify an alarm that causes an abnormality in the KPI. In the following specification, technical features for identifying alarms that cause KPI abnormalities among a plurality of alarms generated during use of the network will be described.

In FIG. 2, it is explained that the electronic device 210 can perform both an operation of storing an alarm obtained from one or more NEs and an operation of identifying an alarm that causes an abnormality in the KPI, but the present invention is not limited thereto. The electronic device 210 may be composed of one or more devices (or components) classified according to function. For example, the electronic device 210 includes a device for storing changes in KPI over time, a device for storing alarms obtained from one or more NEs, and a device for identifying alarms that cause abnormalities in KPI ( Example: devices for fault management (FM) systems). Each of the devices described above may be comprised of a single device (e.g., the electronic device 210) or may be comprised of independent devices (or functional blocks).

According to one embodiment, data acquired (or identified) from a fault management (FM) system that monitors a mobile communication network may be used to identify (or determine) the cause of malfunction or performance degradation that occurs within the network. For example, the cause (or root cause) for a network problem may be analyzed and identified through alarm data generated by a physical device and/or logical unit (or block).

In the following specification, technical features for analyzing network problems may be described. Specifically, a method and system for analyzing the cause of network quality degradation can be described.

When a decrease and/or abnormality in the KPI (key performance indicator) of a mobile communication network occurs, it is necessary to analyze the cause from various perspectives for troubleshooting. For example, when deterioration and/or anomaly of a KPI (key performance indicator) of a mobile communication network occurs, the cause of the KPI deterioration and/or anomaly must be determined in order to handle the KPI deterioration and/or anomaly. must be identified. For example, abnormal operation due to system or equipment failure, distribution of users in the network, increase or decrease in network traffic, and/or changes in operating parameters may cause deterioration and/or abnormality in KPI.

Hereinafter, an electronic device and method for identifying whether a KPI deterioration and/or abnormality has occurred due to a system and/or equipment failure using alarm data may be described. Additionally, an electronic device and method for identifying (or specifying) at least one alarm related to a KPI decline and/or abnormality among a plurality of alarms generated may be described.

Figure 3 shows an example of a graph showing changes in KPI according to events.

Referring to FIG. 3, the electronic device 210 can identify (or evaluate) the correlation between an alarm identified based on an event sequence type and a KPI identified based on a time series type. there is. For example, the electronic device 210 may acquire a T-score based on the change in KPI during the time period before the alarm (or event) occurs and the change in KPI during the time period after the alarm (or event) occurs. there is. The electronic device 210 may identify the correlation between the alarm and KPI based on the T-score.

For example, the graph 300 shows changes in central processing unit (CPU) usage over time. The x-axis of the graph 300 represents time, and the unit is [s] (second). The y-axis of the graph 300 represents CPU usage, and the unit is [%] (percent).

At point 310, an alarm may be generated. The electronic device 210 may identify values related to CPU usage (or changes in CPU usage) within the time period 321 before the alarm is generated. The electronic device 210 may identify values related to CPU usage (or changes in CPU usage) within the time period 322 after the alarm is generated. The electronic device 210 obtains (or identifies) a t-score based on the values regarding the CPU usage within the time interval 321 and the values regarding the CPU usage within the time interval 322. )can do. As an example, a T-score identified based on values related to CPU usage within the time interval 321 and values related to CPU usage within the time interval 322 may be set as in the following equation.

Referring to Equation 1, is the average of values related to CPU usage within the time interval 321. is the average of values related to CPU usage within the time interval 322. is the standard deviation of values related to CPU usage within the time interval 321. is the standard deviation of the values regarding CPU usage within the time interval 322. n is the number of alarm occurrences.

However, even if an alarm with a statistical relationship occurs, it may be difficult to view the generated alarm (or the cause of the alarm occurrence) as the cause of an abnormality and/or decline in the KPI.

For example, the target NE (or cell) of the alarm data and KPI data may be inconsistent, so the cells actually affected by the alarm may be some of the cells in which the alarm occurred. Therefore, it may be difficult to view the generated alarm (or the cause of the alarm occurrence) as the cause of abnormality and/or deterioration of the KPI.

For example, if the duration of the alarm is short, the cause (or fault) of the alarm may not affect the KPI. As an example, when a KPI is identified as an hourly average value, the alarm may be cleared a few seconds after it is raised. In this case, the generated alarm may not have any effect on the KPI. Therefore, it may be difficult to view the generated alarm (or the cause of the alarm occurrence) as the cause of abnormality and/or deterioration of the KPI.

According to one embodiment, the electronic device 210 may identify a correlation between alarms for a plurality of generated alarms and identify a representative alarm (or parent alarm). For example, the electronic device 210 may identify occurrence probabilities for two alarms based on any two alarms included in a cluster, which is a set of alarms that occurred during the same time period. The electronic device 210 may identify a correlation between alarms based on the occurrence probabilities of the two alarms. However, KPIs and alarms may have different measurement methods, recording methods, and/or data formats. Therefore, when the above embodiment is applied, correlation between KPI and alarm is not obtained. For example, alarm data may be recorded based on alarm generation events and/or release events. Therefore, according to the above embodiment, an alarm regarding the cause of a decrease and/or abnormality in the KPI that changes according to the time measured (or recorded) at a designated period may not be identified. Additionally, in the above embodiment, since the correlation between alarms is obtained based on whether or not an alarm occurs and its probability, the correlation between the KPI and the alarm may not be obtained even if the above embodiment is applied.

Hereinafter, in order to solve the problems of the above-described embodiments, the correlation between the KPI and alarm of the NE (network entity) (or cell) learned (or discovered) from past data and the actually obtained (or observed) KPI Based on the similarity of temporal patterns between time series data and alarm events, technical features for identifying the cause of KPI degradation and/or abnormalities may be described.

According to one embodiment, in order to identify the cause (or alarm for the cause) of KPI degradation and/or abnormality, the similarity of temporal patterns as well as the statistical relationship between the alarm identified (or discovered) from historical data and the KPI may be further considered. You can. Accordingly, the reliability of the detection result of an alarm regarding the cause of KPI deterioration and/or abnormality may be improved. Additionally, the electronic device according to the above embodiment may visually display the detection result of an alarm regarding the cause of a KPI decline and/or abnormality through a graphical user interface (GUI).

For example, association rule learning can be used to identify statistical correlations between KPIs and alarms. Accordingly, not only the combination of alarms that are generated when a KPI abnormality occurs, but also the event for alarm occurrence that is highly related to the occurrence of a KPI deterioration and/or abnormality and the status of the event (e.g., event duration) are identified using association rules. It can be. As an example, a correlation may be identified between the KPI (or anomaly of the KPI) and information indicating the occurrence of Alarm 1, the occurrence of Alarm 2, and the duration of Alarm 2 (e.g., 30 seconds).

According to the above-described implementation, it can be identified whether there is an alarm regarding the cause that influenced the occurrence of an abnormality in the KPI (or a decrease in the KPI). Additionally, alarms regarding causes that may have contributed to the decline and/or occurrence of abnormalities in the KPI may be identified. Accordingly, procedures for trouble shooting can be reduced, and overall network performance can be improved.

Figure 4 shows an example of a system for analysis of alarms causing KPI degradation and/or abnormalities. The electronic device 400 of FIG. 4 may be related to the electronic device 210 of FIGS. 2 and 3 . For example, the electronic device 400 of FIG. 4 may correspond to the electronic device 210 of FIGS. 2 and 3 .

Referring to FIG. 4 , the electronic device 400 may include one or more functional blocks. For example, the electronic device 400 includes a KPI data collector 401, a target data collector 402, an FM data collector 403, a KPI preprocessing unit 404, an alarm preprocessing unit 405, and an impacting unit 405. It may include at least one of the alarm detection units 406.

The KPI data collector 401 collects data about changes in KPI over time related to the NE (or cell) set as an analysis target from the device 411 for storing data about KPI (or performance management (PM)). Can be used to obtain.

The KPI preprocessing unit 404 uses data on changes in KPI over time related to the NE (or cell) set as the analysis target to generate KPI time series data for the NE (or cell) set as the analysis target. can be used for Additionally, the KPI preprocessing unit 404 may be used to perform additional preprocessing (for example, a missing value identification operation) on the KPI time series data.

The target data collector 402 may be used to obtain data on the anomaly of the KPI related to the NE (or cell) set as an analysis target from the device 412 for storing data on the anomaly of the KPI. . For example, the data about the KPI abnormality may include at least one of data about the NE (or cell) in which the KPI abnormality occurred and data about the time section in which the KPI abnormality occurred.

The fault management (FM) data collector 403 can be used to obtain data about FM related to a NE (or cell) set as an analysis target from the device 413 for storing data about FM. For example, the FM data collector 403 may be used to obtain data regarding at least one alarm related to a NE (or cell) set as an analysis target.

The alarm preprocessing unit 405 may be used to create an itemset by preprocessing (or converting) FM data set based on the occurrence and clearing (or termination) of an event. For example, the itemset may be obtained within a designated interval for time series correlation analysis. The item set includes alarm occurrence characteristics (e.g., whether an alarm has occurred, the duration of the alarm, and the number of occurrences of the alarm) for detecting conditions related to time series alarm data and association rules with the time series alarm data within the designated section. ) may include information about.

The impacting alarm detection unit 406 determines the time series correlation for the KPI set as the analysis target and the association rule for the KPI among the alarms that occur for the NE (or cell, KPI, or designated section) set as the analysis target. Based on this, it can be used to determine at least one alarm that affected the KPI set for analysis. For example, data on association rules regarding a KPI set as an analysis target may be obtained from the device 414 for storing association rules regarding the KPI. For example, information about at least one alarm that affected a KPI set as an analysis target may be transmitted to the device 415 for displaying the alarm and KPI through a graphical user interface (GUI).

At least some of the devices 411 to 415 described above may be included in the electronic device 400. Depending on the embodiment, at least some of the functions of the devices 411 to 415 may be performed in the electronic device 400.

Figure 5 shows an example of a system for learning association rules between alarms and KPIs. The electronic device 500 of FIG. 5 may be related to the electronic device 210 of FIGS. 2 and 3 or the electronic device 400 of FIG. 4 . For example, the electronic device 500 of FIG. 5 may correspond to the electronic device 210 of FIGS. 2 and 3 or the electronic device 400 of FIG. 4 . Depending on the embodiment, the electronic device 500 of FIG. 5 may be distinguished from the electronic device 400 of FIG. 4 .

Referring to FIG. 5 , the electronic device 500 may include one or more functional blocks. For example, the electronic device 500 may include at least one of a KPI data collector 501, a target data collector 502, an FM data collector 503, and an association rule learning unit 504.

The KPI data collector 501 receives data about changes in KPI over time related to a NE (or cell) set as an analysis target from a device 411 for storing data about KPI (or performance management (PM)). Can be used to obtain. For example, KPI data collector 501 may correspond to KPI data collector 401 in FIG. 4 .

The target data collector 502 may be used to obtain data on anomalies of the KPI related to a NE (or cell) set as an analysis target from the device 412 for storing data on anomalies of the KPI. there is. For example, the data about the KPI abnormality may include at least one of data about the NE (or cell) in which the KPI abnormality occurred and data about the time section in which the KPI abnormality occurred. For example, target data collector 502 may correspond to target data collector 402 of FIG. 4 .

The fault management (FM) data collector 503 can be used to obtain data about FM related to a NE (or cell) set as an analysis target from the device 413 for storing data about FM. For example, the FM data collector 503 may be used to obtain data regarding at least one alarm related to a NE (or cell) set as an analysis target. For example, FM data collector 503 may correspond to FM data collector 403 in FIG. 4 .

The association rule learning unit 504 learns an association rule (or statistical relationship) between the alarm and the KPI based on data about at least one alarm and KPI related to the NE (or cell) set as the analysis target ( or excavation). For example, data on association rules (or association rules regarding KPI) between an alarm and KPI acquired through the association rule learning unit 504 may be stored in the device 414 for storing association rules regarding KPI. You can.

Below, the operation of the electronic device 500 to identify an impacting alarm that influenced the occurrence of an anomaly in the KPI will be described. Embodiments described below are described as being performed in the electronic device 500, but are not limited thereto. The following embodiments may be performed in the electronic device 400.

Figure 6 shows the operation of an electronic device to identify an impacting alarm.

Referring to FIG. 6 , in operation 601, the electronic device 500 (or a processor of the electronic device 500) may identify candidate alarms. For example, the electronic device 500 may identify candidate alarms related to the occurrence of a KPI abnormality based on the occurrence of a KPI abnormality (or a decrease in the KPI). The electronic device 500 may identify candidate alarms generated along with an abnormality in the KPI. The electronic device 500 may identify candidate alarms generated within a time interval before and/or after a designated time interval based on the point in time when an abnormality in the KPI occurs.

In operation 602, the electronic device 500 may analyze association rules between alarms and KPIs. For example, the electronic device 500 may analyze (or learn) association rules between alarms and KPIs based on time series data of alarms and KPIs generated in at least one NE related to the electronic device 500. there is. For example, the electronic device 500 may use an association rule between an alarm and a KPI to identify an impacting alarm related to an abnormality in the KPI. For example, an impacting alarm may mean an alarm that causes an abnormality in the KPI. A specific example for operation 602 will be described later in Figure 7.

In operation 603, the electronic device 500 may analyze the time series correlation between the alarm and the KPI. For example, the electronic device 500 may analyze (or learn) the time series correlation between the alarm and the KPI based on the time series data of the alarms and KPI generated in at least one NE related to the electronic device 500. You can. For example, the electronic device 500 may use the time series correlation between an alarm and a KPI to identify an impacting alarm related to an abnormality in the KPI. A specific example for operation 603 will be described later in FIG. 8.

In operation 604, the electronic device 500 may detect an impacting alarm. For example, the electronic device 500 may detect an impacting alarm that affected the KPI abnormality among candidate alarms related to the KPI abnormality. For example, the electronic device 500 may identify (or detect) an impacting alarm based on the association rule between the alarm and the KPI and the time series correlation between the alarm and the KPI.

Figure 7 shows an example of the operation of an electronic device for learning association rules between alarms and KPIs.

Referring to FIG. 7 , in operation 710, the electronic device 500 (or the processor of the electronic device 500) may perform preprocessing based on input data. For example, the electronic device 500 may perform preprocessing to generate an item set indicating a KPI abnormality and/or an alarm state for each NE (or cell, or section).

For example, the input data may include information about anomalies in the KPI, information about the state of alarm 1, and/or information about the state of alarm 2. Information about the state of Alarm 1 may include information about when Alarm 1 was generated and/or information about the time that Alarm 1 was maintained. Information about the state of Alarm 2 may include information about when Alarm 2 was generated and/or information about the time that Alarm 2 was maintained.

For example, an item set representing a KPI abnormality and/or alarm status for each NE (or cell, or time section) may be configured as shown in the table below.

Referring to Table 1, 'CELL_TOTAL_ERAB_DROP_RATE' may be an example of a KPI. 'ump memory-threshold-exceeded_Critical' may be an example of an alarm. 'ump memory-threshold-exceeded_Critical::PERSISTENCY>30s' may be an example of a state of 'ump memory-threshold-exceeded_Critical'. In Table 1, the drop rate of the total evolved universal mobile telecommunications system terrestrial radio access network radio access bearer (ERAB) of the cell may be set as the KPI. As an example, candidate alarms according to the cell's total ERAB drop rate may include 'ump memory-threshold-exceeded_Major' and 'ump memory-threshold-exceeded_Critical'. 'ump memory-threshold-exceeded_Critical::PERSISTENCY>30s' may indicate that 'ump memory-threshold-exceeded_Critical' lasted for more than 30 seconds.

In operation 720, the electronic device 500 may perform association rule mining. For example, the electronic device 500 may generate a frequent itemset and perform association rule mining based on generating an association rule. For example, the electronic device 500 may extract an association rule based on a set of all itemsets generated for a plurality of sets of NEs (or cells, or time sections).

In operation 730, the electronic device 500 may perform postprocessing based on performing association rule mining. The electronic device 500 may perform postprocessing by filtering the association rule set. For example, within a set of association rules, the condition (antecedent) may be set as an alarm-related item, and the result (consequent) may be set as a KPI abnormality item.

The electronic device 500 may obtain a ruleset between alarms and KPIs based on postprocessing. For example, the electronic device 500 may perform postprocessing so that the obtained rule set includes only items related to the alarm as a result.

For example, a ruleset obtained based on postprocessing can be set as shown in the table below.

Referring to Table 2, Rule ID refers to the ID for the association rule. Antecedents refer to alarms set as conditions. consequents refers to the ideal of the KPI set as a result. Support refers to the occurrence ratio of association rules set as antecedents and consequents among all association rules. Confidence means the probability that consequents will occur according to antecedents. Lift refers to the degree to which the probability of occurrence of consequents increases with the occurrence of antecedents. The greater the lift, the greater the correlation between antecedents and consequents.

Figure 8 shows an example of the operation of an electronic device to identify an alarm that causes a KPI abnormality.

Figures 9a and 9b show examples of preprocessing data for generated alarms.

Referring to FIG. 8, the electronic device 500 may identify an alarm (or impacting alarm) that is the cause of an abnormality in the KPI (or a decrease in the KPI) based on performing operations 810 to 850. .

In operation 810, the electronic device 500 may detect an abnormality in the KPI. For example, the electronic device 500 may learn association rules between alarms and KPIs according to operations 710 to 730 of FIG. 7 and then detect (or identify) abnormalities in the KPIs.

In operation 820, the electronic device 500 may identify candidate alarms. The electronic device 500 may acquire (or collect) data about the KPI and data about the alarm, and identify candidate alarms based on the data about the KPI and the data about the alarm.

For example, the electronic device 500 may identify an NE (or cell, KPI, or time section) set as an analysis target. As an example, the electronic device 500 may identify at least one alarm generated within a specified time interval including the time when a KPI abnormality occurred as candidate alarms. As an example, the electronic device 500 may identify the NE (or cell) related to the KPI in which an error occurred. The electronic device 500 may identify candidate alarms by identifying alarms related to the identified NE (or cell).

For example, the electronic device 500 may preprocess data about KPI and data about alarms. As an example, data regarding alarms may be obtained from device 413 shown in FIG. 5 .

Referring to FIG. 9A, data related to an alarm may be configured as data 910. Data 910 may be constructed based on the alarm's occur/clear event sequence. The 'PROBABLE CAUSE' field in data 910 means the name of the alarm. In data 910, the 'occur time' field indicates the time when the alarm started. In data 910, the 'clear time' field indicates the time when the alarm ended. In data 910, the 'location' field means the location (or point) where the alarm occurred. The electronic device 500 may obtain (or generate) data 920 by preprocessing the data 910.

Data 920 obtained (or generated) by preprocessing data 910 may be configured based on time series. Data 920 may be configured to indicate the alarm occurrence rate according to time interval. The alarm occurrence ratio (alarm_active_ratio) can be identified as shown in the following equation.

In Equation 2, i represents the time slot index. n represents the index of an alarm (alive alarm) that occurred during time slot i. means the occurrence time of the nth alarm. means the end time (clear time) of the nth alarm. means the start time of time slot i. means the end time of time slot i. T means time interval (e.g. 1 hour).

According to Equation 2, in data 920, the 'nbr-enb-communication-fail' alarm is maintained for 3.18 (=60x0.053) minutes out of 1 hour from 19:00 to 20:00 on September 13, 22. .

According to one embodiment, the alarm occurrence rate according to time interval and KPI according to time may be configured as graphs 931 and 932 in FIG. 9B.

Referring to FIG. 9B, graph 931 shows the change in KPI over time. In the graph 931, the horizontal axis represents time, and the vertical axis represents values related to KPI. Graph 932 represents the alarm occurrence rate over time. In the graph 932, the horizontal axis represents time, and the vertical axis represents the alarm occurrence rate within a time section corresponding to time. For example, at time 941, the alarm occurrence rate may be set to 1. The fact that the alarm occurrence rate is set to 1 at the time point 941 may mean that the alarm is maintained (or generated) throughout the time interval including the time point 941.

As described above, the electronic device 500 can identify the alarm occurrence rate over time by preprocessing data related to the alarm. The electronic device 500 may identify the alarm occurrence rate over time in order to perform time series correlation analysis with KPI.

Referring again to FIG. 8 , in operation 830, the electronic device 500 may identify a first candidate alarm group based on an association rule. For example, the electronic device 500 may identify the first candidate alarm group based on the association rule between the alarm and the KPI learned in operations 710 to 730 of FIG. 7 . For example, the electronic device 500 may identify a first candidate alarm group by identifying candidate alarms that have a statistical relationship with an abnormality in the KPI.

For example, the electronic device 500 may identify a first candidate alarm group associated with an abnormality in the KPI, based on data about the association rule between the learned alarm and the KPI. The electronic device 500 may identify a first candidate alarm group among the candidate alarms identified in operation 820. Candidate alarms included in the first candidate alarm group may be associated with anomalies in the KPI.

For example, the electronic device 500 may identify whether there are association rules related to anomalies and candidate alarms of the KPI among a set of association rules between learned alarms and KPIs. The electronic device 500 may exclude alarms without association rules from the first candidate alarm group. As an example, the electronic device 500 determines the priority of each of the candidate alarms included in the first candidate alarm group based on at least one of confidence and/or lift, which are indicators of the association rule. You can.

For example, the first candidate alarm group may be configured as shown in the table below.

Referring to Table 3, the 'NE_ID' field indicates the ID of the NE. The 'CNUM' field represents the cell number. The 'DATE' field indicates the time when the KPI error occurred. The 'KPI' field indicates the KPI in which an error occurred. The 'matched_rules' field indicates the number (or index) of the associated rule associated with the KPI in which an error occurred. The 'top_rule' field indicates the most relevant association rule based on specified conditions (e.g. confidence). The 'top_rule_lift' field indicates the lift of the association rule of the 'top_rule' field. The 'IMPACTING_ALARMS' field represents alarms (or impacting alarms) that cause a decrease in the KPI identified in operation 830.

In operation 840, the electronic device 500 may identify a second candidate alarm group based on time series correlation. The electronic device 500 may identify (or calculate) the time series correlation between the KPI and each candidate alarm. The electronic device 500 may identify the second candidate alarm group based on the time series correlation. For example, the electronic device 500 may identify a second candidate alarm group by identifying candidate alarms whose time series correlation satisfies specified conditions.

For example, the electronic device 500 may identify the time series correlation between each of the candidate alarms and the KPI in which an abnormality occurred. The electronic device 500 can identify the cross-correlation between the time series vector x for the alarm and the time series vector h for the KPI delayed by n samples. The cross-correlation between vector x and vector h can be identified based on the equation below.

Referring to Equation 3, means cross-correlation between vector x and vector h . K refers to the number of time series samples determined according to the target interval (e.g. 1 day or 7 days).

For example, the electronic device 500 may set n values as candidates within a specified range. The electronic device 500 may identify the n value at which cross-correlation is maximum among n values set as candidates (e.g., -1, 0, 1). The electronic device 500 may identify the cross-correlation value of the alarm and KPI identified based on the n value at which cross-correlation is maximum as the time series correlation value of the alarm and KPI. As an example, the absolute value of the cross-correlation value of the time series vector x for the alarm and the time series vector h for the KPI delayed by n samples is obtained as the maximum value at n = 0, and the obtained maximum value is greater than the reference value. , the electronic device 500 can identify that a change (or abnormality) in the KPI according to the alarm appears without delay. As an example, the absolute value of the cross-correlation value of the time series vector x for the alarm and the time series vector h for the KPI delayed by n samples is obtained as the maximum value at n = M (or n = -M), and the obtained If the maximum value is greater than or equal to the reference value, the electronic device 500 may identify that a change (or abnormality) in the KPI according to the alarm appears after (or before) M samples.

A specific operation of the electronic device 500 to identify the time series correlation between the alarm and the KPI according to operation 840 will be described later with reference to FIGS. 10A and 10B.

In operation 850, the electronic device 500 may identify an impacting alarm. For example, the electronic device 500 may identify an impacting alarm that causes a KPI abnormality. For example, the electronic device 500 may identify at least one impacting alarm that causes an abnormality in the KPI.

For example, in operation 830, the electronic device 500 may identify a first candidate alarm set based on an association rule. According to operation 840, the electronic device 500 may identify a second candidate alarm set based on time series correlation. The electronic device 500 may identify an alarm (or at least one alarm) included in both the first candidate alarm set and the second candidate alarm set as an impacting alarm (or at least one impacting alarm). Depending on the embodiment, the electronic device 500 may identify an impacting alarm by excluding a generally occurring alarm among at least one alarm included in both the first candidate alarm set and the second candidate alarm set.

Depending on the embodiment, some of the above-described operations 810 to 850 may be omitted. Depending on the embodiment, other operations may be added between operations 810 to 850 described above. Depending on the embodiment, at least some of operations 810 to 850 may be performed simultaneously. Depending on the embodiment, the order of operations 810 to 850 may be changed. For example, based on operation 830, the electronic device 500 may identify a first candidate alarm set among candidate alarms. Based on operation 840, the electronic device 500 may identify an impacting alarm among alarms included in the first candidate alarms.

Figures 10A and 10B show an example of an operation for identifying a second candidate alarm group based on time series correlation.

Referring to FIG. 10A , the electronic device 500 may identify changes in KPI over time based on data related to KPI obtained from the device 411 shown in FIG. 5 . The electronic device 500 may identify the alarm occurrence rate over time based on alarm-related data obtained from the device 413 shown in FIG. 5 .

For example, graph 1010 shows the change in KPI ('ERAB Drop Rate') over time. The horizontal axis of the graph 1010 represents time (or date). The vertical axis (left) of the graph 1010 represents the value (unit: % (percent)) related to 'ERAB Drop Rate'.

The graph 1020 represents the occurrence rate of an alarm ('ald ald-communication-fail_Major') over time. The horizontal axis of the graph 1020 represents time (or date). The vertical axis (right side) of the graph 1020 represents the alarm active ratio.

The electronic device 500 may set a time interval for identifying the time series correlation between the alarm and the KPI. For example, the electronic device 500 may set a time interval 1031 to identify long-term correlation. As an example, the time interval 1031 may be set to 7 days. For example, the electronic device 500 may set a time interval 1032 to identify short-term correlation. As an example, the time interval 1032 may be set to 1 day.

The electronic device 500 may identify the time series correlation between the alarm and the KPI within a designated time interval. The electronic device 500 may identify the cross-correlation value of the time series vector x for the alarm and the time series vector h for the KPI delayed by n samples. The electronic device 500 may identify the maximum cross-correlation value as the time series correlation (hereinafter, correlation value) between the alarm and the KPI.

Referring to Figure 10b, Figure 10b shows the distribution of time series correlation between KPI and alarm. The electronic device 500 displays the time series of the KPI and the alarm in a section where the correlation between the KPI and the alarm is greater than the first value (e.g., 0.5) or the correlation is less than the second value (e.g., -0.5). It can be identified that the degree of correlation is high.

Depending on the type of KPI, the criteria for determining that temporal patterns are similar may change. For example, if the KPI value becomes smaller than the reference value, an abnormality in the KPI may be detected. In this case, alarms and KPIs may have a negative correlation. The electronic device 500 may determine that the temporal pattern between the alarm and the KPI is similar as the correlation value becomes smaller. For example, when the value of the KPI becomes greater than the reference value, an abnormality in the KPI may be detected. In this case, alarms and KPIs may have a positive correlation. The electronic device 500 may determine that the temporal pattern between the alarm and the KPI is similar as the correlation value increases. For example, the electronic device 500 may determine that as the correlation value between 'RRC_CONNECTION_DROP_RATE', an example of a KPI, and the alarm increases, the temporal pattern of 'RRC_CONNECTION_DROP_RATE' and the alarm are similar. For example, the electronic device 500 may determine that as the correlation value between 'DL-AVERAGE_ASSIGNED_MCS', which is an example of a KPI, and the alarm becomes smaller, the temporal pattern of 'DL-AVERAGE_ASSIGNED_MCS' and the alarm is similar.

According to one embodiment, whether the temporal pattern between the alarm and the KPI is similar may be determined (or determined) according to the following criteria.

For example, if the alarm and the KPI are negatively correlated, the electronic device 500 may determine whether the correlation value between the alarm and the KPI is less than a threshold, and determine whether the temporal pattern between the alarm and the KPI is similar. It is possible to identify whether If the alarm and the KPI are positively correlated, the electronic device 500 identifies whether the temporal pattern between the alarm and the KPI is similar based on identifying whether the correlation value between the alarm and the KPI is less than a threshold value. can do.

For example, the electronic device 500 is based on whether the correlation value between the alarm and the KPI falls within a reference range (e.g., upper X% within range or lower X% within range) based on correlation statistics obtained from past data. Thus, it is possible to identify that the temporal pattern between the alarm and the KPI is similar.

For example, the electronic device 500 obtains a Z score based on the correlation value between the alarm and the KPI and correlation statistics (e.g., mean or standard deviation, std) obtained from past data. can do. For example, if the alarm and the KPI are positively correlated, the electronic device 500 may identify that the temporal pattern between the alarm and the KPI is similar based on the Z score exceeding the threshold. For example, when an alarm and a KPI have a negative correlation, the electronic device 500 may identify that the temporal pattern between the alarm and the KPI is similar based on the Z score being less than a threshold value.

For example, the electronic device 500 may identify that the temporal pattern between the alarm and the KPI is similar based on the correlation between the KPI and the alarm corresponding to the target correlation direction identified according to the type of KPI. there is.

According to one embodiment, the electronic device 500 may visualize and display candidate alarms for abnormalities in the KPI. For example, the electronic device 500 may visualize and display candidate alarms for abnormalities in the KPI using a display included in the electronic device 500 or a display connected to the electronic device 500. Hereinafter, the operation of the electronic device 500 to display a graph indicating a change in KPI over time and a graph indicating the occurrence of an alarm over time using a display may be described.

Figure 11 shows a graph showing changes in KPI according to alarms.

Referring to FIG. 11, the electronic device 500 can obtain data about alarms and data about KPI. For example, the electronic device 500 may obtain data indicating changes in KPI over time. The electronic device 500 may obtain data on alarm occurrence over time. An example of data on alarm occurrence over time can be structured as shown in the table below.

In Table 4, the 'PROBABLE CAUSE' field indicates the name of the alarm. The 'severity' field indicates the severity of the alarm. The 'occur time' field indicates the time the alarm started. The 'clear time' field indicates the time the alarm ended. The 'location' field refers to the location (or point) where the alarm occurred. Data organized as in Table 4 may be related to data 910 in FIG. 9A.

The electronic device 500 may identify a graph showing changes in KPI over time. For example, the KPI may be set to 'RRC Reestablishment Rate'. The graph 1110 shows the change in 'RRC Reestablishment Rate' over time. The horizontal axis of the graph 1110 represents time (or date). The vertical axis of the graph 1110 represents the value (unit: % (percent)) for 'RRC Reestablishment Rate'.

The electronic device 500 may identify a graph indicating the occurrence of at least one alarm over time based on data on alarm occurrence over time. For example, the graph 1120 may indicate whether alarm 1 to alarm n occur over time. The horizontal axis of the graph 1120 represents time (or date). The vertical axis of the graph 1120 represents alarm 1 to alarm n. Within the graph 1120, at least one block may be displayed based on the timing at which the alarm is generated and the timing at which the alarm is ended. As an example, object 1140 of the graph 1120 may indicate that alarm 2 was maintained from time point 1141 to time 1142.

The electronic device 500 is based on an association rule between a plurality of alarms (e.g., alarm 1 to alarm n) generated within the time interval 1131 and the KPI and a time series correlation between the plurality of alarms and the KPI, Impacting alarms can be identified. For example, the electronic device 500 may identify that a change in KPI occurs according to alarm 3 generated within the time interval 1131. The electronic device 500 may identify alarm 3 as an impacting alarm.

The electronic device 500 may display the above-described graph 1110 and graph 1120 through a display of the electronic device 500 and/or a display connected to the electronic device 500. The electronic device 500 may highlight a time section (eg, time section 1131) in which a KPI abnormality occurred. In FIG. 11 , the graph 1110 and the graph 1120 are shown separately, but the graph 1110 and the graph 1120 may also be displayed together.

Figure 12 shows an interface for displaying a graph showing changes in KPI according to an alarm.

Referring to FIG. 12 , the electronic device 500 may display the interface 1200 through a display. The interface 1200 may include an area 1210 for displaying data on KPI abnormalities and generated alarms over time and an area 1220 for displaying changes in KPI over time and alarm occurrence rates. . For example, the electronic device 500 may display a table in the area 1210 showing information about anomalies in the KPI and alarms regarding the anomaly in the KPI for cells related to the NE on a date (e.g., November 8, 2022). It can be displayed. The electronic device 500 generates a graph 1221 showing changes in KPI (e.g., 'radio x2 ho fail rate') over time and an alarm (e.g., 'nbr-enb-communication-fail major') over time. A graph 1222 representing the ratio can be displayed within the area 1220.

The electronic device 500 may visualize an alarm about an abnormality in the KPI (or a decrease in the KPI) in a time series along with the KPI, and display the visualized alarm and KPI through a graphical user interface (GUI). The operation of an electronic device for displaying candidate alarms related to a decline in KPI will be described in FIGS. 13A to 13D.

13A-13D show an example of an interface for displaying some of the candidate alarms related to a decline in a KPI.

Referring to FIGS. 13A to 13D , the electronic device 500 may display the interface 1300 through a display. The interface 1300 includes an area 1310 for displaying candidate alarms and information about an impacting alarm identified among the candidate alarms, and an area 1320 for displaying some of the candidate alarms according to specified conditions. ) may include.

The electronic device 500 may display candidate alarms and information about an impacting alarm identified among the candidate alarms in area 1310. The electronic device 500 may display a table in the area 1310 showing information about KPI abnormalities occurring in the NE, information about candidate alarms, and information about impacting alarms. The 'Anomaly KPI' field indicates the KPI in which an error occurred. The 'ASSOCIATED_ALARMS' field represents at least one alarm (or first candidate alarm group) identified according to an association condition among candidate alarms. The 'CORRELATED_ALARMS' field represents at least one alarm (or a second candidate alarm group) identified according to time series correlation among candidate alarms. The 'IMPACTING_ALARMS' field indicates impacting alarms identified as the cause of KPI abnormalities among candidate alarms. The 'top_rule' field indicates the matched association condition. Although not shown, the electronic device 500 may display information about matching association conditions on the interface 1300. For example, the electronic device 500 may display information about matching association conditions using a table structured as shown in Table 2.

The electronic device 500 may display an object 1329 in area 1320. Object 1329 may be used to select some of the candidate alarms displayed in area 1320. For example, the object 1329 may include visual objects 1329-1 to 1329-4. Some of the candidate alarms for each visual object may be displayed in area 1320. For example, visual object 1329-1 may be referred to as the 'Occurred' tab. Visual object 1329-2 can be referenced by the 'Associated' tab. Visual object 1329-3 can be referenced by the 'Correlated' tab. Visual object 13294 can be referenced in the 'Impacting' tab. Figures 12A to 12D show an example in which a graph regarding candidate alarms is displayed according to input for each visual object.

Referring to FIG. 12A , the electronic device 500 may identify an input to the visual object 1329-1 within the object 1329. Based on the input to the visual object 1329-1 (or the 'Occurred' tab), the electronic device 500 may display the alarm occurrence rate of all candidate alarms generated along with the decrease in KPI over time. For example, the electronic device 500 may identify the first to fourth alarms as all candidate alarms generated along with a decrease in the KPI (eg, 'PREPOST_CONTEXT_DROP_RATE') over time.

Graph 1321 represents changes in KPI (e.g., 'PREPOST_CONTEXT_DROP_RATE') over time. The horizontal axis of the graph 1321 represents time. The vertical axis (left) of the graph 1321 represents the value (unit: %) for the KPI.

The graph 1322 represents the alarm occurrence rate of the first alarm (eg, 'ald ald-communication-fail_Major') over time. The graph 1323 represents the alarm occurrence rate of the second alarm (e.g., 'ecp optic-transceiver-rx-los_Major') over time. The graph 1324 represents the alarm occurrence rate of the third alarm (eg, 'nbr-enb-communication-fail_Major') over time. The graph 1325 represents the alarm occurrence rate of the fourth alarm (e.g., 'rrh rssi-imbalance_Minor') over time. The horizontal axis of graphs 1322 to 1325 represents time. The vertical axis (right side) of graphs 1322 to 1325 represents the alarm occurrence rate.

Referring to FIG. 12B, the electronic device 500 may identify an input to the visual object 1329-2 within the object 1329. Based on the input to the visual object 1329-2 (or the 'Associated' tab), the electronic device 500 may display the alarm occurrence rate of some of the candidate alarms that occurred along with the decrease in KPI over time. . The electronic device 500 may identify identified alarms (or first candidate alarm group) based on the learned association rule. The electronic device 500 may identify the first alarm and the second alarm based on the learned association rule. The electronic device 500 may display a graph 1322 and a graph 1323 along with a graph 1321 related to the KPI within the area 1320.

Referring to FIG. 12C, the electronic device 500 may identify an input for the visual object 1329-2 within the object 1329. Based on the input to the visual object 1329-2 (or the 'Correlated' tab), the electronic device 500 may display the alarm occurrence rate of some of the candidate alarms that occurred along with the decrease in KPI over time. . The electronic device 500 may identify identified alarms (or a second candidate alarm group) based on time series correlation. The electronic device 500 may identify the second alarm based on the time series correlation. The electronic device 500 may display a graph 1323 for the second alarm along with a graph 1321 for the KPI in the area 1320.

Referring to FIG. 12D , the electronic device 500 may identify an input for the visual object 1329-4 within the object 1329. Based on the input to the visual object 1329-4 (or the 'Impacting' tab), the electronic device 500 generates an alarm of an impacting alarm (or at least one impacting alarm) along with a decrease in the KPI over time. Ratios can be displayed. The electronic device 500 may identify the identified impacting alarm (or at least one impacting alarm) based on the learned association rule and time series association. The electronic device 500 may identify the second alarm based on the learned association rule and time series association. The electronic device 500 may display a graph 1323 for the second alarm along with a graph 1321 for the KPI in the area 1320.

According to the above-described embodiment, the electronic device 500 includes all alarms (or candidate alarms) generated during the time period in which the KPI deterioration (or KPI abnormality) occurred, at least one alarm matching the association rule, At least one alarm with a high degree of time series correlation and the finally determined cause alarm (or impacting alarm) can be selectively visualized and displayed. The electronic device 500 may visualize and display alarms identified according to various conditions so that the user can selectively refer to the analysis results.

Figure 14 shows a flow chart regarding the operation of the electronic device. Operations 1410 to 1450 of FIG. 14 may be performed by the processor of the electronic device 500.

In the following embodiments, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

In operation 1410, the electronic device 500 may identify an abnormality in the KPI. For example, the electronic device 500 may identify an abnormality in a KPI related to network quality based on a value for the KPI being outside a specified range.

For example, the electronic device 500 may monitor values for KPI. While monitoring the KPI value, the electronic device 500 may identify that the KPI value is outside a specified range. The electronic device 500 may identify an abnormality in the KPI based on the KPI value being outside a specified range.

In operation 1420, the electronic device 500 may identify a time period related to when a KPI abnormality occurred. For example, the electronic device 500 may identify a first time point before the first time period from the point in time when an abnormality in the KPI was discovered. The electronic device 500 may identify a second time point after a second time period from the time point at which an abnormality in the KPI was discovered. The electronic device 500 may identify the time section from the first time point to the second time point as the time section related to the time when the KPI abnormality occurred. The first time interval and the second time interval may be set to be the same.

In operation 1430, the electronic device 500 may identify a plurality of alarms obtained through at least one NE for the network. For example, the electronic device 500 may identify a plurality of alarms acquired through at least one network element (NE) for the network within the identified time interval.

The electronic device 500 may receive an alarm from at least one NE for a network related to the electronic device 500. The electronic device 500 may identify a plurality of alarms obtained from at least one NE within an identified time interval. The electronic device 500 may identify the plurality of identified alarms as candidate alarms that cause abnormalities in the KPI.

In operation 1440, the electronic device 500 may identify first relevance information and second relevance information. For example, the electronic device 500 provides first correlation information between the KPI and a plurality of alarms, identified using learned data about the KPI, and a time when an abnormality in the KPI is discovered and a plurality of alarms. Second correlation information between the KPI and the plurality of alarms, identified according to their occurrence points, may be identified.

The electronic device 500 may identify a first candidate alarm set using a plurality of alarms based on the first relevance information. The electronic device 500 may configure alarms identified based on first relevance information among a plurality of alarms into a first candidate alarm set. The electronic device 500 may identify a second candidate alarm set using a plurality of alarms based on the second relevance information. The electronic device 500 may configure alarms identified based on first relevance information among a plurality of alarms into a second candidate alarm set.

For example, the electronic device 500 may identify first correlation information between the KPI and a plurality of alarms using learned data about the KPI. The electronic device 500 may identify at least one association rule between the KPI and a plurality of alarms using an association rule mining process. As an example, the electronic device 500 may set information about abnormalities in the KPI, information about the occurrence of a plurality of alarms, and information about the duration of the plurality of alarms as input values of the association rule mining process. The electronic device 500 may identify at least one association rule as an output value of the association rule mining process. The electronic device 500 may set an antecedent field related to at least one association rule to an item related to an abnormality of the KPI. The electronic device 500 may set a consequence field related to at least one association rule to an item related to a plurality of alarms. The electronic device 500 may obtain learned data about the KPI based on identifying at least one association rule.

For example, the electronic device 500 may acquire learned data about the KPI before a KPI abnormality occurs. The electronic device 500 can identify alarms related to KPI. The electronic device 500 may learn alarms related to KPIs and association rules between KPIs. The electronic device 500 may obtain learned data about the KPI based on learning the association rules between the KPI and an alarm related to the KPI. The electronic device 500 may identify first association information between the KPI and a plurality of alarms based on a pre-obtained association rule.

For example, the electronic device 500 may identify second correlation information between the KPI and a plurality of alarms based on the time when an abnormality in the KPI occurs and the time when the plurality of alarms occur. The electronic device 500 may identify second correlation information between the KPI and the plurality of alarms according to the point in time when an abnormality in the KPI occurs and the time points in which the plurality of alarms occur.

For example, the electronic device 500 may identify KPI values over time and a time-series correlation regarding the value of the alarm occurrence rate of the first alarm among a plurality of alarms over time. . The electronic device 500 may configure the first alarm into a second candidate alarm set based on identifying that the value for the time series correlation is within a threshold range. The electronic device 500 may configure some of the plurality of alarms into a second candidate alarm set through a method similar to the first alarm.

As an example, the electronic device 500 may identify values for the alarm occurrence rate of the first alarm over time. The electronic device 500 may perform time movement of values for the alarm occurrence rate of the first alarm over time. Depending on the time shift value of the values for the alarm occurrence rate of the first alarm, the correlation value of the KPI values and the value for the alarm occurrence rate of the first alarm may change. The electronic device 500 may identify the value at which the correlation value is the maximum as a time series correlation diagram related to KPI values over time and a value for the alarm occurrence rate of the first alarm among a plurality of alarms over time. The electronic device 500 may configure the first alarm into a second candidate alarm set based on identifying that the value for the time series correlation is within a threshold range. The threshold range may change based on the type of KPI. When the type of KPI is the first type, the alarm and the KPI may have a positive correlation. When the type of KPI is the second type, the alarm and the KPI may have a negative correlation. Based on the type of KPI being the first type, the threshold range may be set to be greater than or equal to the first threshold value. Based on the type of KPI being the second type, the threshold range may be set to less than the second threshold value.

In operation 1450, the electronic device 500 may identify the alarm that caused the KPI abnormality among the plurality of alarms. For example, the electronic device 500 may identify the alarm that caused the KPI abnormality among a plurality of alarms based on the first relevance information and the second relevance information.

For example, the electronic device 500 may identify an alarm that causes an abnormality in the KPI among a plurality of alarms based on the first candidate alarm set and the second candidate alarm set. A first candidate alarm set may be identified based on the first correlation. A second candidate alarm set may be identified based on the second correlation. The electronic device 500 may identify the first alarm included in both the first candidate alarm set and the second candidate alarm set as the alarm that caused the KPI abnormality.

Depending on the embodiment, the electronic device 500 uses the display of the electronic device 500 (or a display connected to the electronic device 500) to display a graph about changes in KPI over time and a plurality of alarms over time. At least one graph of the alarm occurrence rate of at least some of the alarms may be displayed.

15 shows an example of the functional configuration of an electronic device.

Referring to FIG. 15 , the electronic device 1500 may correspond to the electronic device 500 of FIGS. 5 to 14 .

According to one embodiment, the electronic device 1500 may include a transceiver 1501, a processor 1503, and a memory 1505.

The transceiver 1501 can perform functions for transmitting and receiving signals in a wired communication environment. The transceiver 1501 may include a wired interface for controlling direct connection between devices through a transmission medium (e.g., copper wire, optical fiber). For example, the transceiver 1501 may transmit an electrical signal to another device through a copper wire or perform conversion between an electrical signal and an optical signal.

The transceiver 1501 may perform functions for transmitting and receiving signals in a wireless communication environment. For example, the transceiver 1501 may perform a conversion function between a baseband signal and a bit stream according to the physical layer standard of the system. For example, when transmitting data, the transceiver 1501 generates complex-valued symbols by encoding and modulating the transmission bit string. Additionally, when receiving data, the transceiver 1501 restores the received bit stream by demodulating and decoding the baseband signal. Additionally, the transceiver 1501 may include multiple transmission and reception paths.

The transceiver 1501 transmits and receives signals as described above. Accordingly, all or part of the transceiver 1501 may be referred to as a 'communication unit', a 'transmission unit', a 'reception unit', or a 'transmission/reception unit'. Additionally, in the following description, transmission and reception performed through a wireless channel are used to mean that processing as described above is performed by the transceiver 1501.

The processor 1503 controls overall operations of the electronic device 1500. The processor 1503 may be referred to as a control unit. For example, processor 1503 transmits and receives signals through transceiver 1501. Additionally, the processor 1503 writes and reads data into the memory 1505. Additionally, the processor 1503 can perform protocol stack functions required by communication standards. Although only the processor 1503 is shown in FIG. 15 , according to another implementation example, the electronic device 1500 may include two or more processors.

In the present disclosure, operations of the processor 1503 may be executed by software or may refer to controlling hardware components such as a field programmable gate array (FPGA) or an application-specific integrated circuit (ASIC). Additionally, the processor 1503 may include components such as software components, object-oriented software components, class components, and task components, as well as processes, functions, properties, procedures, and subroutines. , segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. Processor 1503 may include at least one module, and the term “module” includes a unit comprised of hardware, software, or firmware. For example, module may be used interchangeably with terms such as logic, logic block, component, or circuit. A module may be an integrated part, a minimum unit that performs one or more functions, or a part thereof. For example, a module may consist of an ASIC.

For example, the processor 1503 may include at least some or all of the blocks shown in FIG. 4 or FIG. 5 . The processor 1503 may perform the functions of at least some or all of the blocks shown in FIG. 4 or FIG. 5 .

The memory 1505 stores data such as basic programs, application programs, and setting information for operation of the electronic device 1500. Memory 1505 may be referred to as storage. The memory 1505 may be comprised of volatile memory, non-volatile memory, or a combination of volatile memory and non-volatile memory. And, the memory 1505 provides stored data according to the request of the processor 1503.

According to the above-described embodiments, an alarm (or impacting alarm) causing an abnormality in the network KPI (or a decrease in the KPI) may be identified (or detected). In addition, the electronic device (e.g., the electronic device 500 or the electronic device 1500) according to the above-described embodiment uses association rule mining to determine association rules and identified time series associations between KPIs and alarms learned through past data. By considering all of the above, you can identify the alarm (or impacting alarm) that is causing an abnormality in the KPI.

According to the above-described embodiment, network quality can be improved through reduction of human effort required to analyze KPI deterioration/abnormal site/cell and quick/accurate cause alarm detection.

According to the above-described embodiments, time/cost can be reduced by automating the analysis workflow for troubleshooting network performance problems.

According to the above-described embodiments, more accurate cause analysis may be possible by determining the cause alarm by considering both the actual phenomenon (relevance during the relevant period) and the empirical probability for the NE/Cell subject to analysis.

According to one embodiment, an application for analyzing the impact of an alarm on a KPI abnormality and identifying an alarm that is the cause of a KPI abnormality may be displayed through an electronic device.

According to one embodiment, the electronic device may determine a set of candidate alarms that may cause an abnormality in at least one KPI.

For example, the electronic device may obtain time series data about candidate alarms by preprocessing data about candidate alarms.

For example, the electronic device may obtain a time series correlation between at least one KPI and candidate alarms.

For example, the electronic device may detect (or determine) an alarm that is the cause of an abnormality in a KPI among candidate alarms, based on the time series correlation between at least one KPI and candidate alarms.

For example, the electronic device may filter candidate alarms using a previously learned relationship between alarms and KPIs.

For example, an electronic device may identify (or detect) alarms with a high degree of time series correlation (e.g., positive correlation) or low time series correlation (e.g., negative correlation) based on a specified threshold. .

For example, based on learned time series correlation statistics, the electronic device may generate an alarm when the time series correlation is relatively high (e.g. positive correlation) or when the time series correlation is relatively low (e.g. negative correlation). Can be identified (or detected).

For example, the electronic device may identify (or analyze) the time series correlation between KPIs and alarms within a plurality of time intervals (e.g., short-term time interval, long-term time interval). You can.

For example, when identifying an alarm (or impacting alarm) that is the cause of a KPI abnormality, an electronic device identifies (or detects) only alarms with a correlation of a preset sign (e.g., positive or negative) for each KPI. can do. The electronic device 500 can identify an alarm that is the cause of an abnormality in the KPI by identifying the correlation direction.

For example, an electronic device can display an alarm, which is the cause of a KPI abnormality, along with the KPI through a GUI according to time series.

For example, the electronic device can display the time series correlation between the KPI and an alarm that is the cause of a KPI abnormality through a GUI.

For example, the electronic device may display an alarm that is the cause of an abnormality in the KPI and an association rule between the KPI through a GUI.

For example, the electronic device may display records (i.e., raw data) of alarms related to alarms that are the cause of abnormalities in the KPI through a GUI.

According to one embodiment, an electronic device can learn the relationship between an arbitrary alarm and KPI from past data.

For example, the electronic device learns rules for associating whether an abnormality in the KPI occurs, whether an alarm occurs, the number of occurrences of the alarm, and the duration of the alarm during a specified time window for each of at least one NE (or cell). It can be set as an input value (or item) to do this.

For example, the electronic device may learn an association rule using input values (or a set of items) generated from at least one NE (or cell).

For example, an electronic device uses an identified (or extracted) set of association rules such that the condition (Antecedent) of the association rule includes only items related to abnormalities in the KPI, and the result (Consequent) of the association rule includes only items related to alarms. You can filter to do so.

For example, the electronic device may display the finally identified association rules in the form of a table through a GUI.

According to one embodiment, an electronic device may learn (or analyze) a time series correlation between an arbitrary alarm and KPI from past data.

For example, the electronic device identifies the time series correlation between the alarm and the KPI for a certain set of KPIs during a specified time interval for an alarm generated for each NE (or cell) for a plurality of NEs (or cells). (or calculate) and statistics.

For example, the electronic device determines the correlation between alarms and KPIs based on a statistical value (e.g. mean or median) of the time series correlation between alarms and KPIs and a specified threshold. Can be identified (or defined).

For example, the electronic device sets the identified (or extracted) association rule so that the condition (Antecedent) of the association rule includes only items related to the abnormality of the KPI, and the result (Consequent) of the association rule includes only items related to the alarm. You can filter.

For example, the electronic device may display the finally identified association rules in the form of a table through a GUI.

According to the above-described embodiments, the cause alarm can be specified for the NE/Cell/section in which the KPI abnormality/deterioration occurred. According to the above-described embodiments, a method for analyzing statistical relationships (or association rules) between alarms and KPIs may be proposed. According to the above-described embodiments, an Alarm-KPI time series correlation analysis method for NE/Cell/section where KPI abnormality/deterioration occurred can be proposed.

According to the above-described embodiments, the accuracy of the cause alarm can be improved by detecting (specifying) the cause alarm for the KPI in which an abnormality/deterioration occurred based on not only statistical correlation but also actual time series correlation. . Since the electronic device provides the cause alarm detection results along with the similarity of the KPI and the alarm's temporal pattern, higher reliability can be provided for the results.

According to the above-described embodiments, the conditions for the characteristics of alarm occurrence for KPI abnormality/deterioration (e.g. occurrence, number of occurrences, duration) are configured in more detail, so the accuracy of detecting the cause alarm for KPI abnormality/deterioration will increase. You can.

According to the above-described embodiments, In addition to the statistical correlation between alarms and KPIs, the cause of the alarm can be specified through the alarm-KPI time series correlation for NEs/cells/sections where KPI abnormalities/deteriorations occur.

The effects that can be obtained from the present disclosure are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the description below. will be.

According to one embodiment, a method for an electronic device may include identifying an abnormality in a key performance indicator (KPI) related to network quality based on the value of the KPI being outside a specified range. The method may include an operation of identifying a time period related to when an abnormality in the KPI occurred. The method may include identifying a plurality of alarms acquired through at least one network element (NE) for the network within the time interval. The method includes first correlation information between the KPI and the plurality of alarms, identified using learned data about the KPI, and identified according to the time point and occurrence times of the plurality of alarms. The method may include identifying second correlation information between the KPI and the plurality of alarms. The method may include an operation of identifying an alarm that causes an abnormality in the KPI among the plurality of alarms, based on the first relevance information and the second relevance information.

According to one embodiment, the method may include monitoring a value for the KPI. The method may include, while monitoring the value for the KPI, identifying that the value for the KPI is outside the specified range.

According to one embodiment, the method may include identifying a first candidate alarm set using the plurality of alarms, based on the first relevance information. The method may include identifying a second candidate alarm set using the plurality of alarms, based on the second relevance information. The method may include an operation of identifying the alarm that caused an abnormality in the KPI among the plurality of alarms, based on the first candidate alarm set and the second candidate alarm set.

According to one embodiment, the method may include identifying a first alarm included in both the first candidate alarm set and the second candidate alarm set as the alarm that caused an abnormality in the KPI.

According to one embodiment, the method identifies a time-series correlation regarding the KPI values over time and values for the alarm occurrence rate of the first alarm among the plurality of alarms over time. It may include actions such as: The method may include configuring the first alarm into the second candidate alarm set based on identifying that the value for the time series correlation is within a threshold range.

According to one embodiment, the threshold range may be set to be greater than or equal to the first threshold value based on the type of the KPI being the first type. The threshold range may be set below the second threshold based on the type of the KPI being a second type that is distinct from the first type.

According to one embodiment, the method may include identifying at least one association rule between the KPI and the plurality of alarms using an association rule mining process. The method may include obtaining the learned data regarding the KPI based on identifying the at least one association rule.

According to one embodiment, the method uses information about abnormalities in the KPI, information about the occurrence of the plurality of alarms, and information about the duration of the plurality of alarms as input values of the association rule mining process. It may include a setting operation.

According to one embodiment, the method may include setting an antecedent field related to the at least one association rule to an item related to an abnormality of the KPI. The method may include setting a consequence field related to the at least one association rule to an item related to the plurality of alarms.

According to one embodiment, the method uses a display of the electronic device to display a graph about changes in KPI over time and at least one graph about an alarm occurrence rate of at least some of the plurality of alarms over time. It may include an action that displays .

According to one embodiment, the method may include identifying at least one correlation between the KPI and the plurality of alarms using statistical hypothesis testing. The method may include obtaining the learned data regarding the KPI based on identifying the at least one correlation.

According to one embodiment, an electronic device may include a memory, a transceiver, and at least one processor. The at least one processor may be configured to identify an abnormality in a key performance indicator (KPI) related to network quality based on the value of the KPI being outside a specified range. The at least one processor may be set to identify a time period related to when an error in the KPI occurred. The at least one processor may be configured to identify a plurality of alarms acquired through at least one network element (NE) for the network within the time interval. The at least one processor identifies first correlation information between the KPI and the plurality of alarms identified using learned data about the KPI, and the time point and occurrence times of the plurality of alarms. A second correlation between the KPI and the plurality of alarms may be set to identify information. The at least one processor may be set to identify an alarm that causes an abnormality in the KPI among the plurality of alarms, based on the first relevance information and the second relevance information.

According to one embodiment, the at least one processor may be configured to monitor values for the KPI. The at least one processor may be configured to, while monitoring the value for the KPI, identify that the value for the KPI is outside the specified range.

According to one embodiment, the at least one processor may be configured to identify a first candidate alarm set using the plurality of alarms based on the first relevance information. The at least one processor may be configured to identify a second candidate alarm set using the plurality of alarms, based on the second relevance information. The at least one processor may be configured to identify the alarm that caused an abnormality in the KPI among the plurality of alarms, based on the first candidate alarm set and the second candidate alarm set.

According to one embodiment, the at least one processor may be configured to identify the first alarm included in both the first candidate alarm set and the second candidate alarm set as the alarm that caused an abnormality in the KPI.

According to one embodiment, the at least one processor, a time-series correlation diagram (time-series correlation) regarding the KPI values over time and values for the alarm occurrence rate of the first alarm among the plurality of alarms over time. ) can be set to identify. The at least one processor may be configured to configure the first alarm into the second candidate alarm set based on identifying that the value for the time series correlation is within a threshold range.

According to one embodiment, the threshold range may be set to be greater than or equal to the first threshold value based on the type of the KPI being the first type. The threshold range may be set below the second threshold based on the type of the KPI being a second type that is distinct from the first type.

According to one embodiment, the at least one processor may be configured to identify at least one association rule between the KPI and the plurality of alarms using an association rule mining process. The at least one processor may be configured to obtain the learned data regarding the KPI based on identifying the at least one association rule.

According to one embodiment, the at least one processor, information about the abnormality of the KPI, information about the occurrence of the plurality of alarms, and information about the duration of the plurality of alarms, in the association rule mining process. It can be set to set as an input value.

According to one embodiment, the at least one processor may be configured to set an antecedent field related to the at least one association rule to an item related to an abnormality of the KPI. The at least one processor may be configured to set a consequent field related to the at least one association rule to an item related to the plurality of alarms.

According to one embodiment, the electronic device may include a display. The at least one processor may be set to display, using the display, a graph about changes in KPI over time and at least one graph about an alarm occurrence rate of at least some of the plurality of alarms over time. there is.

According to one embodiment, the at least one processor may be configured to identify at least one correlation between the KPI and the plurality of alarms using statistical hypothesis testing. The at least one processor may be configured to obtain the learned data regarding the KPI based on identifying the at least one correlation.

Methods according to embodiments described in the claims or specification of the present disclosure may be implemented in the form of hardware, software, or a combination of hardware and software.

When implemented as software, a computer-readable storage medium storing one or more programs (software modules) may be provided. One or more programs stored in a computer-readable storage medium are configured for execution by one or more processors in an electronic device. One or more programs include instructions that cause the electronic device to execute methods according to embodiments described in the claims or specification of the present disclosure. The one or more programs may be included and provided in a computer program product. Computer program products are commodities and can be traded between sellers and buyers. The computer program product may be distributed in the form of a machine-readable storage medium (e.g. compact disc read only memory (CD-ROM)) or through an application store (e.g. Play Store ^™ ) or on two user devices (e.g. It can be distributed (e.g. downloaded or uploaded) directly between smart phones) or online. In the case of online distribution, at least a portion of the computer program product may be at least temporarily stored or temporarily created in a machine-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server.

These programs (software modules, software) may include random access memory, non-volatile memory, including flash memory, read only memory (ROM), and electrically erasable programmable ROM. (electrically erasable programmable read only memory, EEPROM), magnetic disc storage device, compact disc-ROM (CD-ROM), digital versatile discs (DVDs), or other types of disk storage. It can be stored in an optical storage device or magnetic cassette. Alternatively, it may be stored in a memory consisting of a combination of some or all of these. Additionally, multiple configuration memories may be included.

In addition, the program may be distributed through a communication network such as the Internet, an intranet, a local area network (LAN), a wide area network (WAN), or a storage area network (SAN), or a combination thereof. It may be stored on an attachable storage device that is accessible. This storage device can be connected to a device performing an embodiment of the present disclosure through an external port. Additionally, a separate storage device on a communication network may be connected to the device performing an embodiment of the present disclosure.

In the specific embodiments of the present disclosure described above, elements included in the disclosure are expressed in singular or plural numbers depending on the specific embodiment presented. However, the singular or plural expressions are selected to suit the presented situation for convenience of explanation, and the present disclosure is not limited to singular or plural components, and even components expressed in plural may be composed of singular or singular. Even expressed components may be composed of plural elements.

According to embodiments, one or more of the components or operations described above may be omitted, or one or more other components or operations may be added. Alternatively or additionally, multiple components (eg, modules or programs) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each component of the plurality of components identically or similarly to those performed by the corresponding component of the plurality of components prior to the integration. . According to embodiments, operations performed by a module, program, or other component may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or Alternatively, one or more other operations may be added.

Meanwhile, in the detailed description of the present disclosure, specific embodiments have been described, but of course, various modifications are possible without departing from the scope of the present disclosure.

Claims (22)

In a method for an electronic device,
An operation of identifying an abnormality in a key performance indicator (KPI) related to network quality based on the value of the KPI being outside a specified range;
An operation of identifying a time interval related to a point in time when an abnormality in the KPI occurs;
Identifying, within the time interval, a plurality of alarms acquired through at least one network element (NE) for the network;
First correlation information between the KPI and the plurality of alarms, identified using learned data about the KPI, and the KPI and the plurality of alarms, identified according to the time point and occurrence times of the plurality of alarms identifying second association information between alarms; and
Based on the first relevance information and the second relevance information, identifying an alarm that caused an abnormality in the KPI among the plurality of alarms.
method.
According to claim 1,
Monitoring values for the KPI; and
While monitoring the value for the KPI, further comprising identifying that the value for the KPI is outside the specified range.
method.
According to claim 1,
Identifying a first candidate alarm set using the plurality of alarms, based on the first relevance information;
Identifying a second candidate alarm set using the plurality of alarms, based on the second relevance information; and
Based on the first candidate alarm set and the second candidate alarm set, further comprising identifying the alarm that caused an abnormality in the KPI among the plurality of alarms.
method.
According to clause 3,
Further comprising the operation of identifying the first alarm included in both the first candidate alarm set and the second candidate alarm set as the alarm that caused an abnormality in the KPI.
method.
According to clause 3,
identifying a time-series correlation regarding the KPI values over time and values for an alarm occurrence rate of a first alarm among the plurality of alarms over time; and
Based on identifying that the value for the time series correlation is within a threshold range, further comprising configuring the first alarm into the second candidate alarm set.
method.
The method of claim 5, wherein the critical range is:
Based on the type of the KPI being the first type, it is set to above the first threshold value,
The critical range is,
Based on the type of the KPI being a second type distinct from the first type, it is set below the second threshold value.
method.
According to claim 1,
Identifying at least one association rule between the KPI and the plurality of alarms using an association rule mining process; and
Based on identifying the at least one association rule, further comprising obtaining the learned data regarding the KPI.
method.
According to clause 7,
Further comprising the operation of setting information about the abnormality of the KPI, information about the occurrence of the plurality of alarms, and information about the duration of the plurality of alarms as input values of the association rule mining process.
method.
According to clause 8,
Setting an antecedent field related to the at least one association rule to an item related to an abnormality of the KPI; and
Further comprising setting a result field related to the at least one association rule to an item related to the plurality of alarms.
method.
According to claim 1,
Using the display of the electronic device, the method further includes displaying a graph about changes in KPI over time and at least one graph about an alarm occurrence rate of at least some of the plurality of alarms over time.
method.
According to claim 1,
identifying at least one correlation between the KPI and the plurality of alarms using statistical hypothesis testing; and
Based on identifying the at least one correlation, further comprising obtaining the learned data regarding the KPI.
method.
In electronic devices,
Memory;
transceiver; and
Comprising at least one processor, wherein the at least one processor includes:
Based on the value of a key performance indicator (KPI) regarding the quality of the network being outside a specified range, identifying anomalies in the KPI,
Identify the time interval regarding when the KPI abnormality occurred,
Within the time interval, identify a plurality of alarms obtained through at least one network element (NE) for the network,
First correlation information between the KPI and the plurality of alarms identified using learned data about the KPI, and the KPI and the plurality of alarms identified according to the time point and occurrence times of the plurality of alarms Identifying second association information between
Based on the first relevance information and the second relevance information, set to identify the alarm that caused the abnormality of the KPI among the plurality of alarms.
Electronic devices.
13. The method of claim 12, wherein the at least one processor:
Monitor the values for the above KPIs,
While monitoring the value for the KPI, further set to identify if the value for the KPI is outside the specified range.
Electronic devices.
13. The method of claim 12, wherein the at least one processor:
Based on the first relevance information, identify a first candidate alarm set using the plurality of alarms,
Based on the second relevance information, identify a second candidate alarm set using the plurality of alarms,
Based on the first candidate alarm set and the second candidate alarm set, further configured to identify the alarm that caused an abnormality in the KPI among the plurality of alarms.
Electronic devices.
15. The method of claim 14, wherein the at least one processor:
Further set to identify the first alarm included in both the first candidate alarm set and the second candidate alarm set as the alarm that caused an abnormality in the KPI.
Electronic devices.
15. The method of claim 14, wherein the at least one processor:
Identifying a time-series correlation regarding the KPI values over time and values for an alarm occurrence rate of a first alarm among the plurality of alarms over time,
Based on identifying that the value for the time series correlation is within a threshold range, further configured to configure the first alarm as the second candidate alarm set
Electronic devices.
The method of claim 16, wherein the critical range is:
Based on the type of the KPI being the first type, it is set to above the first threshold value,
The critical range is,
Based on the type of the KPI being a second type distinct from the first type, it is set below the second threshold value.
Electronic devices.
13. The method of claim 12, wherein the at least one processor:
Using an association rule mining process, identify at least one association rule between the KPI and the plurality of alarms,
further configured to obtain the learned data regarding the KPI based on identifying the at least one association rule.
Electronic devices.
19. The method of claim 18, wherein the at least one processor:
Information on abnormalities in the KPI, information on occurrence of the plurality of alarms, and information on the duration of the plurality of alarms are further configured to set as input values of the association rule mining process.
Electronic devices.
20. The method of claim 19, wherein the at least one processor:
Setting an antecedent field related to the at least one association rule to an item related to an abnormality of the KPI,
Further set to set a consequent field related to the at least one association rule to an item related to the plurality of alarms.
Electronic devices.
The electronic device of claim 12, wherein:
further comprising a display,
The at least one processor,
Further configured to use the display to display a graph about changes in KPI over time and at least one graph about an alarm occurrence rate of at least some of the plurality of alarms over time.
Electronic devices.
13. The method of claim 12, wherein the at least one processor:
Using statistical hypothesis testing, identify at least one correlation between the KPI and the plurality of alarms,
further configured to obtain the learned data regarding the KPI based on identifying the at least one correlation.
Electronic devices.

Images