Christopher Connolly

Anomaly Detection and Diagnosis for Automatic Radio Network Verification

The concept known as Self-Organizing Networks (SON) has been developed for modern radio networks that deliver mobile broadband capabilities. In such highly complex and dynamic networks, changes to the configuration management (CM) parameters for network elements could have unintended effects on network performance and stability. To minimize unintended effects, the coordination of configuration changes before they are carried out and the verification of their effects in a timely manner are crucial. This paper focuses on the verification problem, proposing a novel framework that uses anomaly detection and diagnosis techniques that operate within a specified spatial scope. The aim is to detect any anomaly, which may indicate actual degradations due to any external or system-internal condition and also to characterize the state of the network and thereby determine whether the CM changes negatively impacted the network state. The results, generated using real cellular network data, suggest that the proposed verification framework automatically classifies the state of the network in the presence of CM changes, indicating the root cause for anomalous conditions.

Computing Information in Neuronal Spikes

This paper provides new insights regarding the transfer of information between input signal and the output of neurons. Simulations of the Hodgkin-Huxley (HH) model combined with computational techniques are used to estimate this transfer of information. Our analysis shows that comparatively, mutual information (MI) between input signal and sodium flux is about two times that between input signal and output spikes during each spike within a millisecond-level time domain. This higher transfer of information provided by ionic fluxes extends the working frequency domain of neural cells beyond those accessible to information transfer within spikes alone.

Managing scope changes for cellular network-level anomaly detection

The Self-Organizing Networks (SON) concept is increasingly being used as an approach for managing complex, dynamic mobile radio networks. In this paper we focus on the verification component of SON, which is the ability to automatically detect problems such as performance degradation or network instability stemming from configuration management changes. In previous work, we have shown how Key Performance Indicators (KPIs) that are continuously collected from network cells can be used in an anomaly detection framework to characterize the state of the network. In this study, we introduce new methods designed to handle scope changes. Such changes can include the addition of new KPIs or cells in the network, or even re-scoping the analysis from the level of a cell or group of cells to the network level. Our results, generated using real cellular network data, suggest that the proposed network-level anomaly detection can adapt to such changes in scope and accurately identify different network states based on all types of available KPIs.

Learning to recognize complex actions using conditional random fields

Surveillance systems that operate continuously generate large volumes of data. One such system is described here, continuously tracking and storing observations taken from multiple stereo systems. Automated event recognition is one way of annotating track databases for faster search and retrieval. Recognition of complex events in such data sets often requires context for successful disambiguation of apparently similar activities. Conditional random fields permit straightforward incorporation of temporal context into the event recognition task. This paper describes experiments in activity learning, using conditional random fields to learn and recognize composite events that are captured by the observation stream.

Sampling stable properties of massive track datasets

Analysis of massive track datasets is a challenging problem, especially when examining n-way relations inherent in social networks. In this paper, we explore ways in which stable properties of sensor observations can be extracted and visualized using a statistical sampling of features from a very large track dataset, using very little ground truth or outside knowledge. Special attention is given to methods that are likely to scale well beyond the size of the Mitsubishi dataset.

FREEDIUS: an open source Lisp-based image understanding environment

This paper describes FREEDIUS, an open-source image understanding system. FREEDIUS is a Lisp-C hybrid system that exploits CLOS for rapid prototyping, flexibility of presentation in the user interface, and flexibility in persistent object storage. Applications of FREEDIUS include site modeling, video track analysis and event recognition.

Spike timing – an incomplete description of neural code

Starting with Hebbs investigations the time domain was an important apparatus to study neuronal activity. Increases or decreases in firing rate, precise spike timing sequences or particular spike time patterns were perceived as the only reliable measures of neural code. Despite considerable efforts and some success, the time approach does not seem to offer responses to several questions. What is the meaning of the time code in terms of behavior? Is the time domain consistent enough to measure complex neuronal activity?

Demo: SONVer: SON verification for operational cellular networks

The Self-Organizing Networks (SON) concept includes the functional area known as self-healing, which aims to automate the detection and diagnosis of, and recovery from, network degradations and outages. Changes to the configuration management (CM) parameters for network elements could be a cause for degraded network performance and stability; hence, the verification of their effects becomes crucial. In this paper, we present SONVer, a tool that performs SON verification, using anomaly detection and diagnosis techniques that operate within a specified spatial scope larger than an individual cell. SONVer automatically classifies the state of the network in the presence of CM changes, indicating the root cause for anomalous conditions. SONVer uses Key Performance Indicators (KPIs) and CM history from real cellular networks to determine the state of the network; visualize anomalies at a large scale; and identify the causes of anomalies and the group of cells that were affected.

Diagnosis cloud: Sharing knowledge across cellular networks

Diagnosis functionality as a key component for automated Network Management (NM) systems allows rapid, machine-level interpretation of acquired data. In existing work, network diagnosis has focused on building “point solutions” using configuration and performance management, alarm, and topology information from one network. While the use of automated anomaly detection and diagnosis techniques within a single network improves operational efficiency, the knowledge learned by running these techniques across different networks that are managed by the same operator can be further maximized when that knowledge is shared. This paper presents a novel diagnosis cloud framework that enables the extraction and transfer of knowledge from one network to another. It also presents use cases and requirements. We present the implementation details of the diagnosis cloud framework for two specific types of models: topic models and Markov Logic Networks (MLNs). For each, we describe methods for assessing the quality of the local model, ranking models, adapting models to a new network, and performing detection and diagnosis. We performed experiments for the diagnosis cloud framework using real cellular network datasets. Our experiments demonstrate the feasibility of sharing topic models and MLNs.

Alarm Prioritization and Diagnosis for Cellular Networks

Alarm events occurring in telecommunication networks can be an invaluable tool for network operators. However, given the size and complexity of today’s networks, handling of alarm events represents a challenge in itself, due to two key aspects: high volume and lack of descriptiveness. The latter derives from the fact that not all alarm events report the actual source of failure. A failure in a higher-level managed object could result in alarm events observed on its controlled objects. In addition, alarm events may not be indicative of network distress, as many devices have automatic fallback solutions that may permit normal network operation to continue. Indeed, given the amount of equipment in a network, there can be a “normal” amount of failure that occurs on a regular basis; if each alarm is treated with equal attention, the volume can quickly become untenable. To address these shortcomings, we propose a novel framework that prioritizes and diagnoses alarm events. We rely on a priori information about the managed network structure, relationships, and fault management practices, and use a probabilistic logic engine that allows evidence and rules to be encoded as sentences in first order logic. Our work, tested using real cellular network data, achieves a significant reduction in the amount of analyzed objects in the network by combining alarms into sub-graphs and prioritizing them, and offers the most probable diagnosis outcome.