New ELEDIA@UniTN Website
The new ELEDIA@UniTN website is available at www.eledia.org/eledia-unitn   This website has been discontinued, please refer to the new website.

EVoKE (Eledia Vodafone Kpi Evaluator) is a full scale anomaly detection system for 2G, 3G, 4G cellular networks.

The goal of EVoKE is the study, implementation, development, and testing of supervised and non-supervised methodologies to detect 2G/3G/4G network anomalies through KPI (Key Performance Indexes) stream analysis. Moreover, the activity is aimed at the derivation of techniques able to react with best-practice actions and possibly deduce information about causes and solutions for the detected anomalies in wireless networks.
The analysis problem of interest has been mathematically described in terms of an outlier detection problem where a set of input-output relationship are provided by domain experts in a semi-supervised manner.

Input data is a collection of generic multivariate time series. In particular, referring to Vodafone context, typical input includes m KPIs of n cells (usually the whole network, which includes dozen of thousand of BTS). Thus, the size of such dataset is very huge (millions of samples daily).

EVoKE supports three operational modes: (offline) detection, (offline) filtering, real-time refining. These modes are partially reflected into two distinct layers:
  1. Detection
    The Detection layer is responsible of analyzing raw data (e.g. KPI stream) from Data Adapter and generate (detect) events: such as possible anomalies, trends, particular patterns. Decision (detection) might be based also on information available in the Knowledge Base; output events are usually processed by Filtering layer before being stored.
  1. Filtering
    The EVoKE Filtering layer is designed to evaluate events generated by Detection layer or loaded from a previous analysis (e.g. previous days). This process is performed by one or multiple Filters, usually executed sequentially and in a particular order. A particular set of Filters, classified as Refining filters, are explicitly developed to remove false-positive events (or emphasize correct events) by means of real-time analysis of the input stream (e.g. KPIs’ hourly-data) and advanced evaluations of previous results (based on best-practices).
The distinction of Detection and Filtering layers has a central role within EVoKE approach, the concept might be summarized as follows:

“apply multiple detectors to find any possible event, then (eventually) merge and filter”

It includes many statistical detectors (Multipass Modified three-sigma, MAD, Median Rule, BoxPlot) and a WAVELET based pattern matching detector for complex anomalies.

The proposed detection methodologies have been implemented and validated in terms of computational complexity, accuracy, reliability, and robustness. More in detail, some typical well known problems of wireless network evolutions and false alarms have been solved by means of custom filters and adaptive strategies based on dynamic reference profiles which describe and update user-defined patterns and the normal behavior of each KPI depending on observed network features.

EVoKE architecture has been implemented as a flexible and extendible framework which is actually installed and connected to VODAFONE OMNITEL N.V. data-warehouse in order to continuously monitor the network and receive feedback from operators on real-world problems and scenarios.

EVoKE has been tested during 2012 by Vodafone Omnitel N.V. and is able to evaluate more than 30.000 cells (daily analysis) in 16 seconds.

Additional Material

EVOKE Showcase