310 could be implemented by one or more nodes of the CN part 120, e.g., by the NWDAF 230.

In the illustrated concepts, the AN part 110, in particular the RAN, and CN part 120 may be used as sources for collecting the measured QoS data, e.g., in terms of QOS KPIs (Key Performance Indicators). The analytics system 310 may then correlate, store and process the measured QoS data. As mentioned above, the measured QoS data, such as measured packet error rates and measured packet delays, are analyzed to discover violations of the respective QoS targets associated with the different 5QIs. Further statistical analysis may then be performed to determine the root cause of the anomalies, e.g., misconfiguration by wrong settings of the AN packet forwarding parameters or insufficient resources that lead to congestions at a given location. As a result, anomalies may not only be detected, but also classified. The classified anomalies may then be reported to the OAM system 320, e.g., with the aim of notifying other systems and/or personnel about the problems. In case of misconfigurations, the analytics system 310 may automatically check if the issue can be resolved, e.g., by automatically remapping of data traffic to a different existing traffic forwarding policy or to a new traffic forwarding policy. This may provide a quick solution for the QoS violation problems. In the case of congestions, the collected statistics may in turn be used to generate a prioritized list of network locations where capacity increase is proposed, which may then be provided to the OAM system 320. Accordingly, the results obtained by the evaluations in the analytics system may be communicated to different entities, depending on the type of the result: In case of misconfiguration anomalies, the location in the AN part 110 that is responsible for the problem may be notified. Further, the responsible PCF 250 in the CN part 120 may be instructed to override the existing QoS policy settings in the problematic location. In the case of congestions, a priority list of locations for capacity increase may be sent to the OAM system 320.

FIG. 4 illustrates an example of processes for implementing the illustrated concepts. The processes of FIG. 4 may for example be implemented by the analytics system 310.

At step (1), measured QoS data in the form of QoS KPIs are collected from the AN part 110 and the CN part 120 of the wireless communication network. These QoS KPIs may for example be collected from user plane nodes, such as from the access nodes 100 or GWs 150 as illustrated in FIG. 1. The analytics system correlates the QoS KPIs by collecting them per associated 5QI, location of measurement, per application or service type, and per data collection time window. In the illustrated example, it is assumed that the measured QoS data include packet error rate and packet delay, separately reported for each QoS flow, each application or service type, each network location, each 5QI, and each data collection time window. The data collection time windows may for example have a length in the range of 1 s to 10 min. FIG. 5A shows a table for illustrating an example of such data records.

At step (2), the collected data records are analyzed and the data records violating the QoS targets defined for the respective 5QI are marked. In the illustrated example, it is assumed that for 5QI=5 the target delay is 100 ms, the target packet error rate is 10−6, and the priority is 10. These values correspond to the definitions of 3GPP TS 23.501 V16.4.0. FIG. 5A illustrates the marked data records by bold outlines.

At step (3), the marked QoS data from step (2) are aggregated over an anomaly detection time window. The anomaly detection time window may for example have a length in the range of 1 min to 10 h. For the aggregated data records, a violation is calculated for each 5QI and each network location. In the illustrated example, the violation ratio is calculated as a ratio of the violating data records, i.e., the data records marked at step (2), with respect to the overall number of the aggregated data records FIG. 5B shows a table for illustrating an example of such aggregated data records resulting from step (3).

At step (4), the aggregated data records with violation ratio higher than a first threshold, e.g., of about 1%, are marked as anomalies. FIG. 5B illustrates the marked aggregated data records by bold outlines.

At step (5), the anomalies detected at step (4) are classified into the following two categories:

Congestion anomalies: Anomalies corresponding to a congestion are characterized by high violation ratios for 5QIs with low priorities and low violation ratios for 5QIs with high priorities. In the case of a slight congestion, only a few 5QIs have high violation ratios and most of the 5QIs have violation ratios below the first threshold. In case of a severe congestion, most of the 5QIs have high violation ratios and only a few 5QIs with topmost priority, or none of them, have violation ratios below the first threshold. FIG. 6A shows an example of a data set indicating a congestion. As can be seen from the example of FIG. 6A, excessive violation ratios are observed for 5QI=8, 5QI=7, 5QI=6, and 5QI=2. Only for 5QI=1 and 5QI=5, which have higher priorities, the violation ratios are below the first threshold.

Misconfiguration anomalies: Anomalies corresponding to a misconfiguration are characterized by at least one 5QI with violation ratio higher than a second threshold, e.g., of 5%, and another, lower priority 5QI with violation ratio lower than a third threshold, e.g., of 95%. Such a constellation indicates that the AN part 110 fails to properly implement the traffic forwarding policies associated with the 5QIs and does not properly save resources for higher priority traffic if not all 5QI targets can be met. FIG. 6B shows an example of a data set indicating a misconfiguration. As can be seen from the example of FIG. 6B, a violation ratio above the second threshold is observed for 5QI=6. For all other 5QIs, i.e., 5QI=8, 5QI=7, 5QI=2, 5QI=1, and 5QI=5, the violation ratios are below the third threshold. Because 5QI=6 has a higher priority than 5QI=7 and 5QI=8, this constellation is indicative of a misconfiguration.

It should be noted that in some scenarios it is possible that an anomaly is classified both as a congestion anomaly and a misconfiguration anomaly. This may for example happen if several 5QIs have high violation ratio but the congestion is not handled according to the priority-related requirements. Further details concerning the classification of anomalies as congestion or misconfiguration anomaly are described below.

At steps (6a) and (6b), the anomalies classified at step (5) are aggregated for each network location over an evaluation time window. The length of the aggregation time window may be in the range of 1 day to 10 weeks. The anomalies classified as congestion anomaly are aggregated at step (6a) to obtain a number and average duration of congestions per network location, congestion severity, and evaluation time window. The anomalies classified as misconfiguration anomaly are aggregated at step (6b) to obtain a number of misconfigurations per 5QI, network location, and evaluation time window.

At step (7a), the aggregated congestion anomalies at the different network locations are analyzed to create a priority list of network locations proposed for capacity increase. Further details of step (7a) are described below.

At step (7b), the aggregated misconfiguration anomalies are analyzed to notify the relevant location in the AN part 110 about the underlying problem. Further details of this root cause analysis carried out at step (7b) are described below.

At step (7c) replacement options for the problematic 5QIs may be investigated so that the PCF or other CN nodes may be automatically instructed to apply these replacement 5QIs at the network locations where the misconfiguration anomalies have been detected. Further details of how the replacement 5QIs are determined are described below. Here, it is to be noted that determination of a replacement 5QI involves determination of a suitable traffic forwarding policy which is 35 identified by the replacement 5QI. Accordingly, the functionalities of step (7c) may also be regarded as determination of one or more replacement traffic forwarding policies.

In the following, examples of criteria for classifying an anomalies as a misconfiguration anomaly or as a congestion anomaly will be described in more detail. These criteria may for example be applied at step (5) of the processes of FIG. 4. These examples assume a pair of 5QIs, denoted by 5QI-1 and 5QI-2. This pair of 5QIs may be a subset of a larger set of configured 5QIs. The priority level of 5QI-1 is represented by a priority value P1, and the violation ratio observed for 5QI-1 is denoted by R1. Similarly, the priority level of 5QI-2 is represented by a priority value P2, and the violation ratio observed for 5QI-2 is denoted by R2. It is assumed that a lower value of P1, P2 indicates a higher priority level.

In a first example of classifying a misconfiguration anomaly, 5Q-1 and 5QI-2 have different priority levels and the priority level of 5QI-1 is higher than the priority level of 5QI-2, i.e., P1<P2. If in this case additionally the violation ratio R1 is above a lower bound threshold, e.g., corresponding to the above-mentioned second threshold, and the violation ratio R2 is below an upper bound threshold, e.g., corresponding to the above-mentioned third threshold, the anomaly may be classified as a misconfiguration anomaly. As mentioned above, the lower bound threshold may for example be 5% and the upper bound threshold may for example be 95%. The upper bound threshold is typically higher than the lower bound threshold. The criteria of the first example are for example met in the example shown in FIG. 6B, where 5QI=6 meets these criteria with respect to the lower priority 5QI=7 and 5QI=8.

In a second example of classifying a misconfiguration anomaly, the criteria may consider the case that 5QI-1 and 5QI-2 have the same priority level, i.e., P1=P2. If in this case additionally one of the violation ratios R1, R2 is significantly higher than the other, e.g., with R1>2*R2 or R2>2*R1, the anomaly may be classified as a misconfiguration anomaly. For example, this criterion could require that, classify the case as misconfiguration anomaly. The criteria of the second example are for example met in the example shown in FIG. 6C, where 5QI=72 and 5QI=71 have the same priority level (of 56) and the violation ratio of 5QI=71 is more than twice as high as the violation ratio of 5QI=72.

An example of criteria for classifying an anomaly as a congestion anomaly at may involve that the used 5QIs are be divided into two disjoint sets S1 and S2, such that S2 is non-empty and all 5QIs in S1 have higher priority than any 5QI in S2. If then at least a specified percentage, e.g. 80%, of the 5QIs in S2 have a violation ratio higher than a first congestion threshold, e.g., of 5%, and at least a specified percentage, e.g., 80%, of 5QIs in S1 have violation ratio lower than a second congestion threshold, e.g., of 5%, the anomaly may be classified as a congestion. The severity of the detected congestion may be identified on the basis of the priority value of the highest priority 5QI in S2. Here, it is noted that in some scenarios these criteria could also be modified by letting S1 be empty and only considering the first congestion threshold. The criteria of the second example are for example met in the example shown in FIG. 6A, where the 5QIs with priority value 40 or higher, corresponding to low priorities form S2, and the 5QIs with priority values 10 or 20 form S1.

In the following, an example of a process for generating a prioritized list of network locations proposed for capacity increase will be described in more detail. These criteria may for example be applied at step (7a) of the processes of FIG. 4. As a start, the list may be empty and then filled with network locations with at least one detected congestion anomalies. Alternatively, the list could include all network locations or a set of manually configured network locations. For each network location in the list, a priority score is calculated on the basis of the detected congestion anomalies. The higher the priority score, the more urgent is the capacity increase at this network location. The priority score may be calculated based on the aggregated congestion anomalies in the given evaluation time window, e.g., of a few days to a few weeks. In particular, the priority score may be calculated according to:

score
loc

=

∑

t
∈

time
⁢

windows

q
∈

5
⁢
QIs

weight
q

·

length
t

·

ratio

loc
,
t
,
q

where:

- time windows is the set of anomaly detection time windows within the considered evaluation time window,
- 5QIs is the set of 5QIs used in the network,
- weight_qis a weight associated to 5QI q and is defined by the operator and reflects how much business cost is associated to quality problems for applications assigned to a given 5QI,
- length_tis the length of anomaly detection time window t,
- ratio_loc,t,qis violation ratio of 5QI q in time window t and location loc.

Note that this is an example realization, other aspects such as load, number of impacted affected subscribers and their subscriber groups (e.g. gold, silver etc.) can be considered.

In some scenarios, also a more detailed analysis can be performed, e.g., with the aim of more exactly identifying a source of the detected misconfiguration anomalies. This can be achieved by separating the detection of anomalies according to different QoS parameters, e.g., packet error rate and packet delay. For example, it can occur that an anomaly is detected on the basis of a violation of the target packet error rate in certain data records, but the target packet delay is met in these data records. Similarly, it can occur that an anomaly is detected on the basis of a violation of the target packet delay in certain data records, but the target packet error rate is met in these data records. Still further, for some data records both the target packet delay and the target packet error rate may be violated. This may be utilized in the evaluations by calculation a violation ratio considering only the violations of the target packet delay, i.e., a delay violation ratio R_D, and a violation ratio considering only the violations of the target packet error rate, i.e., a loss violation ratio R_L. In the case of misconfiguration anomalies, this may help to identify the root cause of the misconfiguration and to derive a proposal for resolving the misconfiguration. FIGS. 6D and 6E show examples of such data observed in the case of a misconfiguration anomaly, with FIG. 6D showing the loss violation ratios observed for the different 5QIs and FIG. 6E showing the delay violation ratios observed for the different 5QIs. If for a given 5QI R_D>>R_L(e.g., R_D>2*R_L), the anomaly may be classified as a misconfiguration anomaly due to one or more delay parameters associated with this 5QI. If for a given 5QI R_L>>R_D(e.g., R_L>2*R_D), the anomaly may be classified as a misconfiguration anomaly due to one or more loss parameters associated with this 5QI.

In the above some of the above criteria, the 5QIs may also be aggregated to 5QI groups having the same priority level, and the violation ratios may be calculated per priority level. However, in some scenarios additional information may be obtained by calculating the violation ratios per individual 5QI. This may for example be useful when multiple 5QIs are associated with the same priority level. FIG. 6F illustrates a corresponding example. For example, in some scenarios, it could be identified that the detected misconfiguration anomaly is due to the 5QIs associated with a low target packet delay. This may for example indicate a problem of misconfiguration of lower radio layers or of the radio scheduler for these specific 5QIs. In another, it could be identified that the misconfiguration anomaly is due to 5QIs with packet loss ratio below a given threshold. This may also hint at lower radio layers being configured incorrectly.

In the following, examples of automated processes determination of replacement 5QIs in the case of misconfiguration anomalies will be described in more detail. These processes may for example be applied at step (7c) of the processes of FIG. 4. The determination of replacement 5QIs may provide a quick and at least temporary solution to resolve quality issues. These measures may in some cases be complemented by other manual or automated processes which allow for a more refined analysis and fixing of the quality issues in a more sustainable manner, e.g., by replacement of hardware or reconfiguration of settings beyond the traffic forwarding policies.

When a misconfiguration anomaly is detected for a 5QI of a given priority level, a first step is to check if there is a similar misconfiguration anomaly in one or more other 5QIs of the same or higher priority level. If no anomaly is seen in at least some of the 5QIs of higher priority levels, this is an indication that at least a part of the issues causing the misconfiguration anomaly can be resolved by reassigning at least a part of the data traffic to one or more replacement 5QIs. The replacement 5QIs may correspond to 5QIs which are already used in the wireless communication network. In addition or as an alternative, one or more replacement 5QIs could be newly configured. Here, it is to be noted that configuration of a replacement 5QI may involve defining a traffic forwarding policy, e.g., in terms of QoS rules, QoS parameters, QoS targets, and priority level. The reassignment of the data traffic may in some cases be limited to a certain areas, certain cells, or certain subscriber groups, for which the misconfiguration anomaly was detected. The reassignment may involve that the data traffic is mapped to a replacement 5QI with a higher priority level, but with the same or similar QoS targets, in particular the same target packet delay and the same target packet error rate as the original 5QI to be replaced. If no such replacement 5QI is available among the existing 5QIs, the data traffic is mapped to a replacement 5QI with the same or higher priority level, but which has more strict QoS targets, e.g., lower target packet delay and/or lower target packet error rate than the original 5QI to be replaced. In these processes 5QIs for which an anomaly was detected may be excluded from being used as a replacement 5QI.

According to 3GPP TS 23.501 V16.4.0, it is also possible to dynamically define new 5QIs and associated traffic forwarding policies. Accordingly, the replacement 5QI could also be newly defined, e.g., keeping the QoS targets of the original 5QI to be replaced, while increasing the priority level, preferably to the next higher priority level where no anomaly was detected.

FIG. 7 shows a flowchart for illustrating a method of controlling user data traffic in a wireless communication network. The method of FIG. 7 may be utilized for implementing the illustrated concepts in a node of the wireless communication network. The node may implement an analytics system or at least a part of functionalities of an analytics system, such as the above-mentioned analytics system 310. In some scenarios, the node may correspond to an NWDAF of the wireless communication system.

If a processor-based implementation of the node is used, at least some of the steps of the method of FIG. 7 may be performed and/or controlled by one or more processors of the node. Such node may also include a memory storing program code for implementing at least some of the below described functionalities or steps of the method of FIG. 7.

At step 710, the node receives data indicative of a measured QoS level of data traffic assigned to different configured traffic forwarding policies. The traffic forwarding policies each define one or more target parameters. When utilizing the 5G NR technology, the traffic forwarding policies may be identified by 5QIs. When utilizing the 4G LTE technology, the traffic forwarding policies may be identified by QCIs. The target parameters may correspond to the above-mentioned QoS targets and may in particular include at least one of a target packet delay and a target packet error rate.

The node may receive the data from one or more further nodes of the wireless communication network. The one or more further nodes may include one or more nodes of an AN part of the wireless communication network, such as the above-mentioned access node 100. Further, the one or more further nodes may include one or more nodes of a CN part of the wireless communication network, such as the above-mentioned gateway 150 or controller 160. In some scenarios, the one or more further nodes may include a UPF and/or a PCF. In some scenarios, the one or more further nodes may include a PGW and/or a PCRF.

At step 720, the node detects violations of the traffic forwarding policies. This is accomplished based on the data received at step 710 and the target parameters defined by the traffic forwarding policies.

At step 730, the node detects at least one anomaly in the wireless communication network. This is accomplished based on the violations detected at step 720. Here, in particular the violations detected for each the traffic forwarding policies are considered. Accordingly, the detection of the anomaly is based on violations as detected for multiple traffic forwarding policies.

In some scenarios, if the target parameters include a target delay defined for each of the traffic forwarding policies, detecting the at least one anomaly may involve detecting a first type of anomalies based on violations of only the target delays. In some scenarios, if the target parameters include a target packet error rate defined for each of the traffic forwarding policies, detecting the at least one anomaly may involve detecting a second type of anomalies based on violations of only the target packet error rates. Corresponding examples of separating the detection of anomalies according to different QoS parameters were explained in connection with