User Manual
> White Paper | Best Practices in Digital Transformation
28
uoutcomes to determine the most suitable reaction - for example,
speed, proximity of other vehicles, road and weather conditions,
local road rules, physical condition of the vehicle, IT and network
health to determine safety outcomes. Where the situation is outside
the boundaries of the car’s learning it will need to collect more data
about the situation and/or transmit it to the core processing unit for
analysis and instruction.
In current network systems, by monitoring certain thresholds,
warnings and alarms are triggered to indicate an incident in the
network. These can then be investigated manually starting with
the most critical ones. This requires comprehensive knowledge
about the network architecture, its elements, and their capabilities.
It is more eective to use an approach based on measuring
distances between any individual entity (such as a cell, or a KPI)
and behaviors either previously identified and labeled as abnormal,
or automatically learnt as a deviation from the normal expected
behavior. This method avoids long post-mortem investigation times.
Root Cause Isolation Root Cause Isolation (RCI) is the process of
identifying the source of anomalies and therefore of possible threats
in a system on the basis only of data observation. Many OSS systems
and NOCs suer from a common problem: when the network fails
to function correctly, it is often dicult to determine which part is
the source of the problem.
The fundamental challenge is that the symptoms of a failure
often manifest as end-to-end failures in the operation of the
system, without causing obvious initial failures in the system/
cell components, thus compromising its predictive value. In
general, cell outage takes place due to multiple reasons, such as
hardware or software failures including misconfigurations or bugs
or even changes to the environment. Usually, the detection of a
malfunctioning cell is performed through the analysis of alarms,
KPIs, or in many cases, multiple customer complaints.
Cell malfunction can be classified in a number of ways – from
reduced functionality, through degraded performance, to complete
inoperability. The initial, least serious form of cell malfunction has
traditionally been invisible for network operators through traditional
alarms. This peculiarity makes its detection a very challenging task.
Root-Cause analysis involves an automatic investigation of problem
KPIs and diagnosis regarding failure reasons through an automated
analytic and diagnosis process. Not every indicator of compromise
turns out to be an attack, and the challenge for threat intelligence is
to reduce the number of false positives to a manageable level and
to those that really warrant investigation.