This application is the U.S. national phase of International Application No. PCT/EP2016/068119 filed 28 Jul. 2016, which designated the U.S. and claims priority to EP Patent Application No. 15179437.7 filed 31 Jul. 2015, the entire contents of each of which are hereby incorporated by reference.

BACKGROUND AND SUMMARY

The present invention relates to the operation of a communications network.

The number and variety of individual communications handled by a modern communications network is vast. In addition to carrying user communications, modern communication networks store and transmit a great deal of management traffic which relates to the operation of the network. Because there are a myriad of management functions which need to be performed in a modern communications network, and since those functions are in practice performed by equipment provided by various equipment manufacturers at various times over the past several decades, it is difficult in practice to present a network administrator with a useful overview of the state of the network on the basis of the management traffic in the network.

Extracting knowledge from large amounts of data is the goal of data mining. Clustering is a data mining technique, but whilst clusters tend to form based on some pattern in the data, clustering algorithms commonly produce sets of points as clusters, rather than representing knowledge as a readily understandable pattern. There have been some attempts to alleviate this problem. The paper ‘Turning Clusters into Patterns: Rectangle-based Discriminative Data Description’, presented by Byron J. Gao and Martin Ester in the proceedings of the Sixth International Conference on Data Mining, 2006 discusses the use of rectangle-based expressions (essentially a set of ranges of quantitative values of each of a plurality of dimensions, each data item having values for each dimension) to describe the set of points within a cluster. Because such descriptions are interpretable they can also be used as search expressions to retrieve the contents of the cluster from the dataset from which the cluster was derived.

US Patent application 2008/0162533 discusses the use of clustering to organise search results, followed by partitioning of some or all of the produced clusters around a boundary value of one of the attributes found in each result to produce groups. The patent application proposes that clusters should be provided with both a name and a description. That patent application states that the cluster description is essentially a query which reproduces the cluster from the original data, but makes no suggestion as to how such a description might be derived. The name of a group might be a term which is found in at least a majority of the data units in a group, or a name which is associated with a shared property of the data units. The name is chosen such that, for each group, most of the represented items have an attribute value that maps to the assigned name and most items not in the given group do not have an attribute value that maps to the assigned name.

A paper entitled ‘Internet Traffic Behaviour Profiling for Network Security Monitoring’, presented in the IEEE/ACM Transactions on Networking, vol. 14, no. 6, pp1241-1252, and a broadly similar U.S. Pat. No. 8,028,337 from the same authors (Kuai Xu, Zhi-Li Zhang, and Supratik Bhattacharyya), teaches a method of building behaviour profiles of Internet backbone traffic. The method uses data mining and entropy-based techniques to generate behaviour classes, each of which includes a set of specific structural models which provides a compact representation of the behaviour class.

According to the present invention, there is provided a method of operating a communications network comprising:

accessing a plurality of network operational data items arranged into groups, each of said groups comprising a plurality of network operational data items, each of said network operational data items having a value for each of a plurality of attributes, and

for each group:

i) for each of said attributes:a) calculating a measure of central tendency of the values of said attribute; andb) calculating a measure of the variability of the values of said attribute;

ii) identifying one or more attributes having values with a variability lower than a predetermined threshold; and

iii) generating a description of the group based on the measure of central tendency found for the one or more identified attributes.

By operating a communications network to:

access a plurality of network operational data items arranged into groups, each of said groups comprising a plurality of network operational data items, each of said network operational data items having a value for each of a plurality of attributes, and

for each group:

i) for each of said attributes:a) calculating a measure of central tendency of the values of said attribute; andb) calculating a measure of the variability of the values of said attribute;

ii) identifying one or more attributes having values with a variability lower than a predetermined threshold; and

iii) generating a description of the group based on the measure of central tendency found for the one or more identified attributes.

a method of operating a communications network is provided which automatically generates a succinct description of the state of the communications network based on network operational data items generated within the network. Such a description can be used to control subsequent automatic management of entities in the communications network, for example.

In some embodiments, the method further comprises automatically generating a query from said description, and executing the query on a database of network operational data items. This has the advantage that the grouping process (which can place great demands on computational resource) can be carried out on a manageable amount of network operational data to provide a description of subsets of that manageable amount of network operational data. The query generated from a subset of interest can then be applied to a much greater amount of network operational data (such data is often produced and stored in vast quantities) to reveal network operational data items of interest using a process which uses far less computational resource than would be required were the grouping process to be run on the vast amount of network operational data directly.

In some embodiments, the method further comprises obtaining, in relation to one or more of said attributes, a data type indication indicating the type of data values provided for that attribute, said measure of central tendency and attribute variability calculations depending upon said data type indication.

By calculating said attribute average and attribute variability measures in a manner which depends upon the type of data values provided in association with a given attribute, attribute variability measures which can be usefully compared across attributes of different types are calculated, leading to a labelling of the groups of network data items which more accurately reflects the operation of the network.

