Frota rewbenio ieee 2005 condition monitoring of 3g cellular

1064

IEEE TRANSACTIONS ON NEURAL NETWORKS, VOL. 16, NO. 5, SEPTEMBER 2005

Condition Monitoring of 3G Cellular Networks Through Competitive Neural Models Guilherme A. Barreto, Member, IEEE, João C. M. Mota, Member, IEEE, Luis G. M. Souza, Student Member, IEEE, Rewbenio A. Frota, and Leonardo Aguayo

Abstract—We develop an unsupervised approach to condition monitoring of cellular networks using competitive neural algorithms. Training is carried out with state vectors representing the normal functioning of a simulated CDMA2000 network. Once training is completed, global and local normality profiles (NPs) are built from the distribution of quantization errors of the training state vectors and their components, respectively. The global NP is used to evaluate the overall condition of the cellular system.

If abnormal behavior is detected, local NPs are used in a component-wise fashion to find abnormal state variables. Anomaly detection tests are performed via percentile-based confidence intervals computed over the global and local NPs. We compared the performance of four competitive algorithms [winner-take-all (WTA), frequency-sensitive competitive learning (FSCL), self-organizing map (SOM), and neural-gas algorithm (NGA)] and the results suggest that the joint use of global and local NPs is more efficient and more robust than current single-threshold methods.

Index Terms—Anomaly detection, cellular networks, competitive learning, condition monitoring, confidence intervals, normality profiles (NPs).

I. INTRODUCTION HE third generation (3G) of wireless systems promises to provide mobile users with ubiquitous access to multimedia information services, providing higher data rates by means of new radio access technologies, such as UMTS, WCDMA1 and CDMA20002 [1], [2]. This multiservice aspect brings totally new requirements into network optimization process and radio resource management algorithms, differing significantly from traditional speech-dominated second generation (2G) systems.

One of the new aspects is related to the quality of service (QoS) requirements. For each provided service and service profile, the QoS targets have to be set and met.

Because of all these requirements, operation and maintenance of 3G cellular networks will be challenging. The mobile cells interact and interfere more, they have hundreds of adjustable pa-

T

Manuscript received October 31, 2003; revised April 7, 2005. This work was supported in part by CPqD/Instituto Atlântico Telecom&IT Solutions, in part

by CNPq under Grant 305275/2002-0, and in part by FUNCAP under Grants 1068/04 and 3403/05.

The authors are with the Department of Teleinformatics Engineering, Federal University of Ceará (UFC), Fortaleza-CE, Brazil (e-mail: guilherme@deti.ufc.br; e-mail: mota@deti.ufc.br; luisgustavo@deti.ufc.br; rewbenio@deti.ufc.br; aguayo@deti.ufc.br).

Digital Object Identifier 10.1109/TNN.2005.853416 1Acronyms for Universal Mobile Telecommunications System and Wideband CDMA, respectively, which are 3G technologies capable of providing speeds of up to 2 Mb/s.

2CDMA2000, also called 1xRTT (single carrier radio transmission technology), is a 3G wireless technology based on the CDMA platform which has the capability of providing speeds of up to 144 Kbps.

rameters and they monitor and record several hundreds of different variables in each cell, thus, producing a huge amount of spatiotemporal data, consisting of parameters of base stations (BS) and quality information of calls.

Considering networks with thousands of cells, it is clear that for optimum handling of the radio access network (RAN), effective key performance indicator (KPI) analysis methods are required. KPIs are a set of essential measurements which summarize the behavior of the cellular network of interest, and can be used for system acceptance, benchmarking and system specification.

KPIs exist at different levels, for different users. For instance, one can observe service-oriented KPIs (S-KPIs) to measure service quality, network-oriented KPIs (N-KPIs) to measure system characteristics, and/or vendor-specific KPIs for troubleshooting and optimization purposes [3]. Anyway, a good choice of a set of KPIs to monitor and analyze collected data is crucial to understand the reasons for the various operational states of the cellular network, noticing abnormal behaviors, analyzing them and providing possible solutions.

In this data-driven scenario, performance evaluation of 3G cellular systems can be made more efficient through the use of powerful data mining techniques.

Data mining is an expanding area of research in artificial intelligence and information management whose objective is to extract relevant information from large databases [4]. Typical data mining and analysis tasks include classification, regression, and clustering of data, aiming at determining parameter/data dependencies and finding various anomalies from the data. In this paper, we are interested in the clustering capabilities of competitive learning techniques applied to the condition or state monitoring of 3G cellular systems in order to detect abnormal behavior.

Competitive neural models are able to extract statistical regularities from the input data vectors and encode them in the weights without supervision. Such learning machines will then be used to build a compact internal representation of the cellular network, in the sense that the data vectors representing its behavior are projected onto a reduced number of prototype vectors (each representing a given cluster of data), which can be further analyzed in search of hidden data structures [5]. This clustering-based (lossy) data compression ability of competitive learning is of particular interest to data mining tasks, and constitutes one of the main motivation for its use in this paper.

The self-organizing map (SOM) [6], [7] is an important competitive learning algorithm. In addition to data clustering tasks, the SOM is also widely used for visualization of data cluster structures [8]. This visualization ability is particularly suitable to network optimization purposes, as discussed in a number of

1045-9227/$20.00 © 2005 IEEE

BARRETO et al.: CONDITION MONITORING OF 3G CELLULAR NETWORKS THROUGH COMPETITIVE NEURAL MODELS

recent studies [9]–[14]. In addition, Laiho et al. [12] also applied the SOM to monitoring objects in the cellular network, such as BS and radio network controllers, looking for anomalous or abnormal behaviors. They argue that this approach makes it much easier to monitor a large amount of cells in a network, since only abnormal observations have to be examined.

With the same basic motivation as Laiho et al. [12], we propose techniques to detect not only abnormal behavior of the cellular network as a whole, but also to indicate the abnormal KPIs. The proposed methods can be used by different competitive learning algorithms, including the SOM, and can be easily applicable to different RAN technologies, as well as to other problem domains, such as IP networks, in which anomaly detection procedures are of interest [15]. For that purpose, we present all the stages regarding problem domain specification and application of competitive learning methods to condition monitoring of 3G cellular networks.

The remainder of the paper is organized as follows. In Section II, we describe the problem domain in detail. In Section III, we briefly present the competitive neural models whose performance we evaluate in this paper. In Section IV, we introduce an anomaly detection method to evaluate the current state of the cellular network globally. In Section V, we introduce a similar method to locally point out the abnormal KPIs. Computer simulations are presented in Section VI, while important issues regarding the proposed methods and the obtained results are discussed in Section VII. The paper is concluded in Section VIII. II. PROBLEM DESCRIPTION The first step toward the design of an automatic learning machine for network condition monitoring involves the careful choice of the target network object(s) to be monitored (e.g., BS, radio network and routers) within the geographical area of interest. A specific radio technology dictates the properties of the network objects which, in turn, has a strong impact on the selection of performance variables to be analyzed. This step is strongly dependent on the type of condition monitoring task we want to deal with. If the main goal is the (binary) classification of the overall state of a network object into normal/abnormal (also called anomaly detection task), the set of KPIs to be chosen may be distinct of those required for the detection and identification of a specific class of faults. Anyway, the chosen variables should offer a clear picture of end-user perceived QoS. In this paper, we are interested only in anomaly detection tasks built over a representation of the normal behavior of the system being monitored. That is, the data available for learning the expected behavior of the system is composed only of data samples labeled as normal, i.e., representing normal activity of the system. The goal is to decide, by means of a similarity test, if an observed data sample reflects normal or abnormal system’s behavior. Depending on the application domain, anomaly detection is also called outlier detection or novelty detection [16]–[18].

Anomaly detection based on models of normality is suitable to those situations for which it is difficult or costly to collect data representing anomalous/abnormal/faulty behavior of the system being monitored. Even if this is possible somehow, for an efficient performance of the algorithm the user would have

1065

to specify all the possible classes (or, at least, a representative set) of faults that he/she would expect to occur. If the number of cases per class is unbalanced, the training of powerful supervised neural classifiers (e.g., MLP) can be severely impaired [19].

Once the current values of the chosen KPIs are gathered, for example, from the cellular system’s operator, drive tests, customer complaints or protocol analyzers, we should organize , dethem together in a pattern vector noting the th observation of the state of the cellular network

.. .

KPI KPI .. .

(1)

KPI where is the number of KPIs chosen to monitor the cellular network.

Successive configurations of the cellular network are simulated through a number of independent Monte Carlo runs (also called drops) of a static simulation tool (see the Appendix), thus, uncorrelated generating a set of state vectors in time.3 Using this set one can classify a newly measured state as normal/abnormal, by means of one of the folvector lowing classic statistical methods.

• Univariate Anomaly Detection Test—A component-wise analysis is performed on to verify if the components are within their normal ranges of variation. In this case, assuming that the components are Gaussian distributed, the anomaly detection test is given by

IF THEN ELSE

•

is a is an

component component

(2)

0, called decision threshold, dewhere the constant fines the range of normality of as the interval . Usually, we choose 1.96 (or 2.57), relying on the fact that for a Gaussian distributed , we expect to have 95% (or 99%) of its values within the interval centered in the mean with a semilength equal to 1.96 (or 2.57) standard deviations.

Multivariate Anomaly Detection Test—The analysis is performed on as a whole, by taking into consideration the joint influence of all the components . The multivariate version of (2) is given by IF THEN ELSE

is a is an

vector vector

(3)

3In [11], it is argued that such a static approach is accurate enough for the type of analysis we are interested in, provided that the service bit rates are not very high. In this study, the bit rate ranges from 9600 to 153 600 bps.

1066

where is the sample mean vector is the sample and covariance matrix of the data. Values of are given by the critical value of the chi-square distribution with degrees of freedom and significance level (usually 0.05).

Simplicity is the main advantage of the aforementioned approaches. Their main drawbacks are listed in the following [20].

• Decision thresholds are computed based on the assumption that the data are sampled from univariante/multivariate Gaussian distributions.

• Even slight departures from Gaussianity result in a poor detection performance. It is particularly true if is asymmetrically distributed around its mean. is costly and • The computation of a reliable inverse of may not be always possible, especially if the dimensionis high. ality of • Univariate and multivariate anomaly detection tests usually give different results, specially if outliers4 are present in the data set. , • The presence of outliers distorts the estimates and increasing the number of misclassification errors.5 Robust methods for computing sample estimates of the mean vector and the covariance matrix do exist [21], but the issue of existence of the inverse covariance matrix and its high computational cost involved still remain.

In an attempt to alleviate some of these problems we propose the joint use of multivariate and univariate anomaly detection procedures similar to those discussed previously, robustified through the use of competitive learning algorithms. For that purpose, global and local normality profiles (NP) are built from the distribution of quantization errors of the training state vectors and their components, respectively. The global NP is used to evaluate the overall condition of the cellular system. If abnormal behavior is detected, local NPs are used in a component-wise fashion to find abnormal state variables. Anomaly detection tests are performed via percentile-based decision intervals computed over the global and local NPs. The main advantages of the proposed approach are the following.

• The whole methodology is nonparametric in nature, i.e., no a priori probabilistic assumptions for the distribution of the data and for the method of computing decision thresholds are needed.

• No explicit computation of a sample mean vector and of a sample covariance matrix (and its inverse) is required.

Local statistical regularities within the data set are automatically extracted by the competitive learning model and encoded in their weight (prototype) vectors.

• Classification accuracy is increased by means of a doublecheck procedure involving the sequential application of multivariate and univariate anomaly detection tests.

In the next section, we briefly review the competitive learning algorithms of interest for this paper.

4An outlier is an observation that deviates so much from other observations as to arouse suspicion that it was generated by a different mechanism.

5Outliers may arise due to a number of reasons, such as measurement error, mechanical/electrical faults, unexpected behavior of the system (e.g., fraudulent behavior), mislabeled data, or simply by natural statistical deviations within the data set.

IEEE TRANSACTIONS ON NEURAL NETWORKS, VOL. 16, NO. 5, SEPTEMBER 2005

III. COMPETITIVE NEURAL MODELS Competitive learning models, one of the main classes of unsupervised neural networks, are widely applied to pattern recognition and data mining tasks, such as clustering and vector quantization [5]. In these applications, the weight vectors are called prototypes of a given class or category, since through learning they become the most representative element of a given group of input vectors. Essential to competitive learning is the concept of winning neuron, defined as the neuron whose weight vector is the closest to the current input vector.

During training, the weight vectors of the winning neurons are modified incrementally in order to extract average features from the set of input patterns. Using Euclidean distance, the , is given by simplest strategy to find the winning neuron, (4) where denotes the current input vector, is the weight vector of neuron , and corresponds to the current iteration of the algorithm or, equivalently, to the presentation of an input vector randomly selected from the set of state vectors .

Accordingly, the weight vector of the winning neuron is modified as follows: (5) where 0 1 is the learning rate, which should decay with time to guarantee convergence of the weight vectors to stable states. In this paper, we adopt an exponential decay where and are the initial and final , respectively. values of The learning strategy summarized in (4) and (5) is known as winner-take-all (WTA). An undesirable characteristic of the WTA algorithm is a high sensitivity to weight initialization, leading eventually to the occurrence of dead neurons, i.e., neurons that never win. Next, we describe three algorithms that give equal opportunity, on average, to all neurons to become winner during training.

The first method, called frequency-sensitive competitive learning (FSCL) [22], changes (4) slightly by penalizing those neurons which are chosen as winners too frequently (6) where is the number of times neuron was the winner until 1 is a constant parameter. No the current iteration , and change in (5) is required.

The second method is the well-known SOM [6], [7]. This algorithm finds the winning neurons as in (4), but alters the learning (5) to allow adjustment of the weight vectors of the winning neuron and of those neurons belonging to its neighborhood (7)

BARRETO et al.: CONDITION MONITORING OF 3G CELLULAR NETWORKS THROUGH COMPETITIVE NEURAL MODELS

where is a Gaussian weighting function which limits the neighborhood of the winning neuron (8) where defines the radius of the neighborhood function, and are, respectively, the positions of neurons and in a predefined array. The variable should decay in time . just like the learning rate The third method, called the neural-gas algorithm (NGA) [23], modifies both (4) and (5) as follows. A single winning neuron is not directly searched for, but rather, all the neurons are ranked according to the Euclidean distance of their weight vectors to the current input

(9) is the weight vector closest to is where and so on. The weight weight vector second-closest to vectors are then adjusted by the following rule: (10) plays a role similar where to the neighborhood function of the SOM algorithm, since is the position of neuron in the ranking in (9). The variable should also decay in time.

Once training is finished, a new state vector can be easily classified as normal/abnormal by means of the distance between the weight vector of the winning neuron and a new state vector. If this distance belongs to the range of normal distances computed during training, the new state is flagged as normal. Otherwise, it is identified as being abnormal. This procedure is detailed next.

IV. GLOBAL APPROACH FOR ANOMALY DETECTION Once we have trained one of the neural models presented in Section III, we need to compute the quantization error associ, used during training, ated to each state vector as follows: (11) where is the weight vector of the winning neuron, and is the associated quantization error vector. We refer to the set of quantization errors computed for the whole set of training vectors as the global NP of the cellular system.

Unlike standard parametric approaches (see Section II), we are interested in computing nonparametric decision intervals (called within which we can find a certain percentage confidence level) of normal values of the variable. Since the NP is an empirical distribution of the quantization errors for a given set of training vectors, we can define an interval of normality by computing lower and upper limits via the percentile method.6 6The percentile of a distribution is a number e such that a percentage p of the population values are less than or equal to e . For example, the 75th percentile is a value (e ) such that 75% of the values of the variable fall below that value.

1067

•

Lower Limit, : This is the th percentile. : This is the th per• Upper Limit, centile.

The interval of normality can then be used to classifying a new state vector into normal/abnormal by means of a simple hypothesis test IF THEN ELSE

is is

(12)

This rule states that if the quantization error of the new state vector is within the limits of normality , then the state of the cellular system is considered normal with % of confidence. Otherwise, it is abnormal.

It is worth mentioning that the decision interval approach presented in (12) is much similar to the one introduced by [24], who used box-plots to compute decision intervals. However, there are two main differences between the approaches. First, the decision interval found by box-plot has a fixed length for a given data set, while in our approach it may vary with . This adds an extra degree of freedom to the design of an accurate detector. is computed from the original Second, the interval set of training quantization errors, while in [24] the interval is computed from the quantization errors generated by a “cleaned” training data set, from which mislabeled state vectors (i.e., outliers) were removed by a computationally expensive process. In our approach, we do not perform any outlier cleaning procedure on the training set, thus, speeding up considerably the design of the anomaly detector. Furthermore, any undesirable effect in the performance that could result from the presence of outliers in the training set is to be automatically filtered (to some extent) . Indeed, as we will show later, by the decision interval this is one of the greatest advantages of interval-based methods over single-threshold ones.

When formulating a conclusion regarding the condition of the cellular system one should define the hypothesis to be tested , also called null hypothesis, as follows. ( • : The input vector reflects the NORMAL activity of the cellular system.

Once is defined, two types of errors are possible.

• Type I error (False Alarm): This error occurs when the null hypothesis is rejected when it is, in fact, true.

The probability of making a type I error is denoted by and is called significance level. The value of is set by the investigator in relation to the consequences of such an error. That is, we want to make the significance level as small as possible in order to protect the null hypothesis and to prevent, as far as possible, the investigator from inadvertently making false claims.

• Type II error (Absence of Alarm): This error occurs is not rejected when it when the null hypothesis should be rejected. The probability of making a type II error is denoted by (generally unknown). A type II error is often frequently to sample sizes being too small.

1068

IEEE TRANSACTIONS ON NEURAL NETWORKS, VOL. 16, NO. 5, SEPTEMBER 2005

The probabilities and are responsible for the width of . This width should be decided through the the interval analysis of the costs that each type of error has on the cellular 0 and 0, but this system. The ideal would be to have is not really possible in practice, since type I and type II errors are inversely related. Some hints about how to decrease both and to some extent are given in Section VII.

We require instead a kind of decision rule that points out the KPIs (if any) that contribute most to the supposed abnormal state vector. For this purpose, we evaluate the absolute values of each component of the error vector

.. .

.. .

(13)

V. LOCAL APPROACH TO ANOMALY DETECTION Once abnormal behavior has been detected by the procedure described in the previous section, it is necessary to investigate which of the attributes (KPIs) of the problematic state vector are the most relevant ones. It is desirable for this search to be done automatically (i.e., without or with minimal human intervention). Next, we report previous attempts to do so, and then introduce our approach.

Some methods have proposed recently to find relevant attributes based on the internal representation encoded in the weights of a competitive neural model [25]–[28]. Ultsch [28] used his U-matrix clustering method to evaluate, within each cluster, the most significant components of the input vectors.

The important components are determined so that their corresponding class can be faithfully described by a number of conditions about these attributes (e.g., range of variation within that cluster), thus, defining a descriptive rule for that class.

Siponen et al. [26] and Vesanto and Hollmén [27] used Ultsch’s method together with a measure of the significance of the rule. This value takes into account the confidence of that a given rule being true in a cluster (internal significance) and the confidence of a data sample being in the cluster if the rule is true (external significance). The product of these two partial significance measures the overall significance of the rule in cluster . If the rule and the cluster correspond to each other perfectly, then the significance of the rule reaches its maximum value.

Hammer et al. [25] proposed the generalized relevance learning vector quantization (GRLVQ) to automatically detect the relevance of the attributes of input vectors. This approach provides two important features: 1) properly located prototypes, and 2) a ranking of the relevances of the input. The locations of the prototypes are used as centers for axes parallel bounding boxes enclosing the data points, in order to turning the GRLVQ model into a decision tree, so that classifying a data point requires taking a decision at each interior node of this tree which child-related path to follow.

A. Finding Anomalous Attributes All the aforementioned works find relevant attributes through the analysis of the clusters formed by a subset of the state vectors. This approach is not adequate to our purposes, since the state vectors we use reflect only the normal functioning of the cellular network. So, only a large normal cluster will be found, that may be composed itself by many subclusters. Thus, the use of descriptive-like approaches will only help in the distinction among normal subclusters found by the neural model.

sample distributions Thus, for each of the resulting we compute the interval of normality of the th KPI. is considered abWhenever an incoming state vector normal by the fault detection stage, we take the absolute values of the corresponding quantization of each component error vector and execute the following test: IF THEN ELSE

is a normal KPI. is an abnormal KPI.

In words, if the quantization error due to the KPI is within , then it does not the range defined by the interval contribute to the abnormal state previously detected; otherwise it will be indicated as an abnormal KPI. An important side effect of this local approach is that it can reduce the false alarm rate. If none of the analyzed KPIs are found to be abnormal, then a false alarm will be discovered and then corrected. The confidence levels of the global and local approaches do not need to be equal. Next we evaluate the proposed methods in monitoring the condition of cellular networks.

VI. COMPUTER SIMULATIONS Most of the hardware and software which support radio resource management (RRM) algorithms are physically located at the BS, so the robustness of this network element is a key issue to maintain the overall quality of the system. Thus, reliable detection of abnormal conditions at BS is therefore an aspect that should be taken into account in system planning and design. A challenge emerging from this scenario concerns the interrelation between network variables due to active network management, such as power control and interference cancelation. Bearing this in mind, we have chosen the following KPIs. • Number of Users: Number of initial mobile users attempting to use the services of the cellular network.

• Downlink Throughput: Total throughput in downlink direction, in Kb/s, summed over all the active links in the cell being analyzed.

• Noise Rise: Ratio between overall interference and thermal noise in the analyzed cell, in dB. • Other-Cells Interference: This variable measures the interference (in the uplink direction) from other cells to the cell being analyzed, in dBm.

BARRETO et al.: CONDITION MONITORING OF 3G CELLULAR NETWORKS THROUGH COMPETITIVE NEURAL MODELS

1069

TABLE I TYPICAL FALSE ALARM (FA) RATES AND INTERVALS OF NORMALITY FOR THE VARIOUS NEURAL MODELS

It is worth emphasizing that some of the simulated parameters,7 such as those related to traffic load, data throughput and QoS measures, are important not only to 3G systems, but to any communication network. Power control is mandatory in 3G systems, due to the high spectral efficiency required to accommodate high data rates, so the variables related to power control is an interesting parameter to focus on. Noise rise is a basic system parameter that appears in CDMA networks, and it is, thus, monitored. and maximum Noise Quality parameters, such as Rise level, were set to 5 dB and 6 dB, respectively. Mobile users can be removed from the system by a power control algorithm.

Due to the high number of input parameters that can be handled, some specific scenarios were selected, focusing on the analysis of traffic and CDMA interference behavior. A total of 500 state vectors was collected for each specific network scenario, from which 400 vectors were randomly selected for training and the remaining 100 vectors were used for testing the neural model.

All the KPIs have been normalized to zero mean and unity variance.

The first set of simulations evaluates the performance of the ANN models described in Section III, by quantifying the occurrence of false alarms after training them. The number of neurons and the number of training epochs were set to 20 and 50, respectively. The network scenario corresponds to 100 MS initially trying to connect to seven BS. No shadow fading is considered, and only voice services are allowed. The results (in percentage) are presented in Table I, together with the intervals of normality for 95% and 99% confidence levels. We also show the results of the single-threshold approach proposed in [12].

For all the simulations, we adopt the following methodology.

Error rates are averaged for 100 independent training/testing runs. For each training run, state vectors are selected randomly for the training and testing data sets. Also, the ordering of presentation of the state vectors for each training epoch is changed randomly. The initial and final values for the learning rates were 0.9 and . For the FSCL only, the paramset to 40 and eter in (6) was set to 5. For the NGA only, we set 0.01.

The standard univariate/multivariate anomaly detection methods presented in Section II performed poorly on the sim7Some of the parameters available: Eb/No (per link - measured at mobile station (MS) and at the BS), noise rise (per cell and for the entire network), throughput (per link, per cell, and for the entire network), number of mobiles in service, BS transmitting power, amount of total BS power dedicated to traffic or control channels, noise figure at receiver (MS and BS), losses at cables and connectors (at BS), diversity gain at receiver (BS), shadow and fast fading mean and variance, decorrelation factor (geographic parameter), propagation model, carrier frequency, antenna heights, antenna radiation patterns (H and V), Eb/No targets (uplink and downlink), six counters related to power control and admission control, voice activity factor for speech calls and cdma2000 supported rates.

ulated data and, hence, their results are not reported here. The poor results of the multivariate method were due an ill-conditioned covariance matrix. The violation of the assumption of Gaussianity by some KPIs can explain the poor performance of the standard univariate method.

It is worth noting that the NGA/SOM models performed much better than the WTA/FSCL models. This may occur because the NGA/SOM algorithms, in addition to their inherent clustering abilities, also are able to encode in their weight vectors the proximity relationships of the original state vectors.

This topology-preserving property is incorporated into their learning rules through weighting factors which depend on the distance of the winning neuron to its neighbors. Acting as lateral connections, these weighting factors transform the simple competitive learning rule in (5) into the Hebbian-like learning rules (7) and (10). It is well known that Hebbian learning rules can learn second-order statistics of the input distribution, while plain competitive learning rules learn only first-order statistics [6].

To give an idea of the distribution of the quantization errors produced by the neural algorithms for the last scenario, typical global NPs for the WTA and the SOM are shown in Fig. 1(a) and (b). The vertical thick lines correspond to the interval of 0.95 . normality The second set of simulations evaluates the sensitivity of the neural models to changes in their training parameters. The goal is to understand how the number of neurons, the number of training epochs and the size of the training set affect the occurrence of false alarms after training the neural models. The results are shown in Figs. 2–4, respectively. For each case, we compare the interval-based approach proposed in this paper with the single threshold presented in [12]. The chosen network scenario corresponds to 120 MS initially trying to connect to seven BS, for which fast and shadow fading are considered this time.

Voice and data services are allowed. For the sake of simplicity, results are shown for one neural model only, since similar patterns are observed for the others.

In Fig. 2, the number of neurons of the FSCL algorithm varies from 1 to 200, and each training run lasts 50 epochs. In Fig. 3, the number of epochs is varied from 1 to 100, while the number of neurons is fixed at 30. Finally, in Fig. 4, the number of neurons and the number of training epochs are fixed at 30 and 50, respectively, while the size of the training set (i.e., number of state vectors used for training) is varied from 10 to 490. The size of testing set varies accordingly from 490 to 10. As a general conclusion, we can infer that in average the proposed approach produces better results than the single threshold method.

So far we evaluated the anomaly detection methods with respect to the false alarm rate. For the last set of simulations we

1070

IEEE TRANSACTIONS ON NEURAL NETWORKS, VOL. 16, NO. 5, SEPTEMBER 2005

Fig. 1. Typical NPs for (a) the WTA model and for (b) the SOM model. Vertical lines represent the interval of normality.

Fig. 2. Evolution of (a) the error rate of false alarms with the number of neurons for the FSCL model and (b) the corresponding lower and upper values of the interval of normality (p = 0.95).

assess their performance in terms of the absence of alarm rate, defined as the ratio of the number of anomalous state vectors correctly classified as abnormal to the total numbers of anomalous state vectors. The lower the absence of alarm rate of an algorithm, the more discriminative it is in distinguishing abnormal patterns from normal ones.

To evaluate the absence of alarm rates we need a number of state vectors that we know for sure they are not normal (e.g., outliers). We generate such abnormal vectors by adding noise to the components of normal state vectors. A number of outliers is also introduced in the training set in order to evaluate how they influence the performance of the anomaly detection algorithms.

The less sensitive an algorithm is to the presence of outliers in the training set, the more robust it is.

Only the SOM algorithm is used this time. For each training/testing run, a total of 5% of the training vectors and 10% of the testing vectors are randomly selected from their respective original sets. Each selected vector has its components contaminated with zero-mean white Gaussian noise. The noisy state vectors are then reintroduced back into their original sets, and the training/testing procedures are carried out in the usual way.

For a given trained SOM, we evaluate the global anomaly local detection approach alone, the double-check global anomaly detection approach, and the single-threshold method of Laiho et al. [12] over the same NP. The false alarm rates of the three approaches as a function of the standard-deviation of the noise used to generate outliers are shown in Fig. 5. For each

BARRETO et al.: CONDITION MONITORING OF 3G CELLULAR NETWORKS THROUGH COMPETITIVE NEURAL MODELS

1071

Fig. 3. Evolution of (a) the error rate of false alarms with the number of training epochs for the SOM model and (b) the corresponding lower and upper values of the interval of normality (p = 0.95).

Fig. 4. Evolution of (a) the rate of false alarms with the size of training set for the NGA model and (b) the corresponding lower and upper values of the interval of normality (p = 0.95).

value of the standard-deviation, we repeat the training/testing procedures for 100 independent runs.

The double-check detection test, consisting in the application of both the global and local anomaly detection approaches, reported the lowest absence of alarm rates. This means simultaneously that the double-check approach is more accurate and more robust than the other methods. Note that only when the magnitude of the noise is large enough (i.e., the abnormal patterns are easily distinguishable) the single-threshold method reports absence of alarm rates similar to the those reported by double-check test.

VII. DISCUSSION In this section, we elaborate a bit further on some important issues concerning the application of the methods proposed in this paper.

Single Threshold versus Decision Intervals: In this paper, we compute lower and upper decision limits to define acceptable ranges of variation of univariate/multivariate quantization errors. Such intervals of normality were then used for anomaly detection purposes in a new, double-check procedure, which has proved to be more efficient and robust than the standard single-threshold method presented in [12].

1072

Fig. 5. Absence of alarm rates as a function of the magnitude of Gaussian noise added to input state vectors.

One can argue that it makes no sense to discard a portion of the smaller quantization errors through the computation of the , since the smaller the quantization error, lower threshold the closer a new state vector is to the set of normal state vectors. This would be totally true if no outliers were present in the training data. In more realistic scenarios, however, there is no guarantee of that, and a given number of neurons could be allocated to the region the outliers belong to. For this region, the quantization errors would be very small.

Muñoz and Muruzábal [24] elaborated on this issue and proposed a costly data-cleaning strategy based on box-plot (see Section IV) to eliminate neurons representing outliers. In our viewpoint, a computationally simpler and more efficient approach consists in filtering the influence of outliers automatically through the lower threshold . Furthermore, in [29] and [30], we have demonstrated that the presence of a small number of outliers in the training data can be beneficial to anomaly detection tasks, producing more robust algorithms.

Competitive Learning in Anomaly Detection: Successful applications of anomaly detection strategies based on competitive learning algorithms to other communication network domains have been introduced in an expressive number of recent papers [16]–[18]. This is particularly true for the domain of network intrusion detection [31]–[35]. In general, these papers propose changes to the competitive neural algorithm, while using single-threshold methods to detect abnormal behavior. For example, Höglund et al. [31] changed the distance metric used by the SOM to select winning neurons in order to improve the detection of abnormal behavior in computers networks. Other authors [32], [35] introduced hierarchical SOM-based architectures that refine the unsupervised data modeling through several layers of neurons.

The aforementioned approaches attempt to discover intruders by analyzing departures from the patterns of normality of network usage. Abnormal behavior is detected by means of singlethreshold methods, i.e., if the quantization error of a new state

IEEE TRANSACTIONS ON NEURAL NETWORKS, VOL. 16, NO. 5, SEPTEMBER 2005

vector is bigger than a certain percentage of the (normal) quantization errors computed during training.

In our approach, we use classic competitive learning algorithms to model the data together with a “double-check” interval-based anomaly detection test inspired by classic univariate/multivariate methods. The novelty of our approach is to show that this association of classic methods performs better than brand new competitive architectures which use single-threshold-based detection strategies.

Temporally Correlated State Vectors: In this paper we handled temporally uncorrelated state vectors. If the period between successive observations is long enough, this assumption is rather reasonable. However, if the condition monitoring is to be performed in real-time the observations may indeed become correlated in time. This could be a major source of problems if the temporal dependencies among state vectors are not taken into account in the anomaly detection system design.

Many of the short-term memory (STM) mechanisms described in [36] and [37] can be easily added to competitive neural networks to allow the retention of information about temporally correlated data vectors. A very simple approach keeps using static (i.e., memoryless) competitive learning as algorithms, but defines a new (dynamic) input vector follows: (14) where the vector is the current observation of the state vector, and 0 1 is a memory parameter, which determines the influence of past state vectors. At the beginning of training, we usually set .

1, no past information is available and, thus, the system If remains static. If 1, the actual input vector mixes information about the current state vector, represented by , with information from past state vectors, summarized in . By means of (14), the approach introduced in this paper can be used without modifications to handle temporally correlated state vectors.

Sensitivity versus Stability: As pointed out in Section IV, we should evaluate the performance of the neural models with respect to the rates of false alarms (Type I error) and absence of alarms (Type II error). For cellular systems, an incipient problem can initially cause no harm, but as time goes by, the problem becomes more serious to the point that the neural model can detect it. However, it can be too late. So, a neural model highly sensitive to differences in the variation of the chosen KPIs would perform better in these situations, reporting few type II errors.

However, small differences on the behavior of the cellular system are not always indicative of actual problems. They could be caused, for example, by random measurement noise.

A highly sensitive model would be unstable, reporting false alarms too frequently that the operators would gradually put no faith on its decisions, to the point that they would refuse to believe that an actual problem is occurring.

Any anomaly detection system will always report a certain number of false alarms and will not respond to certain abnormal situations. The ultimate goal of the designer is to maintain the probabilities of occurrence of these errors at acceptable levels.

For this purpose, correct specifications of and are essential.

BARRETO et al.: CONDITION MONITORING OF 3G CELLULAR NETWORKS THROUGH COMPETITIVE NEURAL MODELS

There are no specific rules, but the following general observations can help us in that direction.

• For any fixed sample size , a decrease in will cause an increase in . Conversely, an increase in will cause a decrease in . will • For any fixed , an increase in the sample size cause a reduction in , i.e., a greater number of samples reduce the probability of absence of alarms.

Thus, to decrease both and , we may increase the sample size , or equivalently, the number of neurons. So, it seems a reasonable strategy to specify a fixed number of neurons (e.g., 50) and a low initially, and try to increase the number of samples of the quantization errors using one of the following techniques.

• For a fixed number of neurons, one can use the Bootstrap resampling technique [38] to generate a sample of bootstrap instances drawn with replacement from the original sample , where each original value of has equal probability to be sampled. The computation of the deciis now performed on the set of bootsion interval strap instances [39]. The same approach is valid for the computation of univariate intervals of normality.

• Several techniques to add neurons incrementally to an already trained competitive neural model can be used [40]–[42]. The insertion of neurons can be done periodically or according to some performance criteria, such as misclassification rates. With more neurons available, new samples of the quantization error are automatically generated.

VIII. CONCLUSION AND FURTHER WORK In this paper we proposed methods for anomaly-detection-like condition monitoring of 3G cellular networks using competitive neural models. Once training is completed, global and local NPs are built from the distribution of quantization errors of the training state vectors and their components, respectively. The global NP is used to evaluate the overall condition of the cellular system. If abnormal behavior is detected, local NPs are used in a component-wise fashion to find abnormal state variables. Double-check anomaly detection tests were performed via percentile-based confidence intervals computed over the global and local NPs. We compared the performance of four competitive algorithms (WTA, FSCL, SOM, and NGA) and the results suggest that the joint use of global and local NPs is more efficient and more robust than current available methods. The proposed methods are also general enough to allow performance comparisons among several competitive learning algorithms and can be easily applicable to different RAN technologies, as well as to other application domains.

APPENDIX We have developed a MATLAB-based static simulation tool based on the cdma2000 1xRTT radio transmission technology [43]. The system-level simulation procedure adopts a static approach and the Monte Carlo technique is used [44]. At different time instants the simulator takes snapshots of the system, chosen

1073

in such a way that no correlation exist between the system parameters for different snapshots.

Assuming a multitude of data and voice services, the simulator can perform capacity analysis, indicating how many subscribers can be supported in different scenarios. For this purpose, it takes into account the available radio resources, such as interference, Walsh codes, transmission power and the propagation environment. Each snapshot outcomes information about system status like traffic conditions, loading, interference and handoff. The input parameters were divided into five classes, according to their influence on the system behavior, and a graphic user interface was built in order to make the simulator more user-friendly.

The 3G cellular environment used for system simulations is macrocellular, with two rings of interfering cells around the central one, resulting in a total of 19 cells. All BS use omnidirectional antennas at 30 m above ground level, and the RF propagation model is the classic Okumura–Hata for 900 MHz carrier frequency. Subscribers are uniformly distributed over the area of a rectangular frame. We may choose the number of interfering tiers from zero to three, which leads us to a region containing 1, 7, 19 or, 37 cells respectively. There is no correlation between subscriber locations from a snapshot to another.

The simulator provides up to five different types of services to the cdma2000 users, with rates 9600, 19200, 38400, 76800, and 153 600 bps, and the admission control is constrained both by carrier received power and overall cell load. Each service is characterized by a specific traffic demand and application. It is also possible to set up the amount of MS using each service. The propagation model takes into account contributions from three different phenomena: path loss, fast fading and shadow fading.

The path loss model is the classic Okumura–Hata, slightly modified. The fast fading contribution is Rayleigh distributed. The shadow fading is composed of a combination of the MS the BS contributions, which are both modeled by log-normal distributions.

Simulation scenarios can be derived by choosing some input parameters to be kept fixed throughout a set of simulations, while other parameters have their values changed. Each scenario corresponds to a variation in one single parameter, in order to make easier a posterior analysis. It is possible to specify traffic scenarios where all subscribers’ services are voice-based or where voice- and data-service users are present. Fig. 6 depicts results concerning downlink signal-to-interference-plusnoise ratio (SINR) for three load conditions. Each CDF was obtained after running a set of simulation scenarios and results collected over 500 Monte Carlo drops. Throughput, traffic load and other information about system performance can be derived from these results.

Besides load analysis, other results can provide a better understanding about the cdma2000 network performance, such as average throughput in direct or reverse link, overall system Noise Rise, same cell/other cell interference analysis and coverage maps. Moreover, these results can be used to derive, in a straightforward manner, information about bit error rate (BER) and frame error rate (FER). The results are statistically compatible with real cellular network data. The simulation tool can be extended to incorporate complex features of a real network,

1074

Fig. 6.

IEEE TRANSACTIONS ON NEURAL NETWORKS, VOL. 16, NO. 5, SEPTEMBER 2005

Example of results obtained by changing load conditions.

such as specific RRM procedures, and easily modified to serve as a planning tool.

ACKNOWLEDGMENT The authors would like to thank the reviewers for their valuable suggestions.

REFERENCES [1] R. Prasad, W. Mohr, and W. Konäuser, Third Generation Mobile Communication Systems—Universal Personal Communications. Norwood, MA: Artech House, 2000.

[2] T. Ojanperä and R. Prasad, Wideband CDMA for Third Generation Mobile Communications. Norwood, MA: Artech House, 1998.

[3] S. Soulhi, “Proactive management through key performance indicators for 3G systems,” in Proc. Int. Conf. Telecommunications, Fortaleza, Ceara, Brazil, 2004.

[4] D. J. Hand, H. Mannila, and P. Smyth, Principles of Data Mining. Cambridge, MA: MIT Press, 2001.

[5] J. C. Principe, N. R. Euliano, and W. C. Lefebvre, Neural and Adaptive Systems: Fundamentals Through Simulations. New York: Wiley, 2000.

[6] T. Kohonen, Self-Organizing Maps, 2nd ed. Berlin, Germany: Springer-Verlag, 1997.

[7] , “The self-organizing map,” Proc. IEEE, vol. 78, no. 9, pp.

1464–1480, Sep. 1990.

[8] A. Flexer, “On the use of self-organizing maps for clustering and visualization,” Intell. Data Anal., vol. 5, no. 5, pp. 373–384, 2001.

[9] T. Binzer and F. M. Landstorfer, “Radio network planning with neural networks,” in Proc. IEEE Vehicular Technology Conf. (VTS/Fall), Boston, MA, 2000, pp. 811–817.

[10] K. Raivio, O. Simula, and J. Laiho, “Neural analysis of mobile radio access network,” in Proc. IEEE Int. Conf. Data Mining (ICDM), San Jose, CA, 2001, pp. 457–464.

[11] J. Laiho, A. Wacker, T. Novosad, and A. Hämäläinen, “Verifi cation of WCDMA radio nework planning prediction methods with fully dynamic network simulator,” in Proc. IEEE Vehicular Technology Conf.

(VTS/Fall), vol. 1, 2001, pp. 526–530.

[12] J. Laiho, M. Kylväjä, and A. Höglund, “Utilization of advanced analysis methods in UMTS networks,” in Proc. IEEE Vehicular Technology Conf.

(VTS/Spring), Birmingham, AL, 2002, pp. 726–730.

[13] J. Laiho, K. Raivio, P. Lehtimäki, K. Hätönen, and O. Simula, “Advanced analysis methods for 3G cellular networks,” IEEE Trans. Wireless Commun., vol. 4, no. 3, pp. 930–942, 2005.

[14] K. Raivio, O. Simula, J. Laiho, and P. Lehtimäki, “Analysis of mobile radio access network using the self-organizing map,” in Proc.

IPIP/IEEE Int. Symp. Integrated Network Management, Colorado Springs, CO, 2003, pp. 439–451.

[15] M. Thottan and C. Ji, “Anomaly detection in IP networks,” IEEE Trans.

Signal Process., vol. 51, no. 8, pp. 2191–2204, Aug. 2003.

[16] S. Marsland, “Novelty detection in learning systems,” Neural Comput.

Surv., vol. 3, pp. 157–195, 2003.

[17] M. Markou and S. Singh, “Novelty detection: A review—Part 2: Neural network based approaches,” Signal Process., vol. 83, no. 12, pp.

2499–2521, 2003.

[18] V. J. Hodge and J. Austin, “A survey of outlier detection methodologies,” Artif. Intell. Rev., vol. 22, pp. 85–126, 2004.

[19] G. P. Zhang, “Neural networks for classification: A survey,” IEEE Trans.

Syst., Man, Cybern. C, Appl. Rev., vol. 30, no. 4, pp. 451–546, Nov. 2000.

[20] A. Webb, Statistical Pattern Recognition, 2nd ed. New York: Wiley, 2002.

[21] D. M. Rocke and D. L. Woodruff, “Robust estimation of multivariate location and shape,” J. Statist. Plann. Inf., vol. 57, pp. 245–255, 1997.

[22] S. Ahalt, A. Krishnamurthy, P. Cheen, and D. Melton, “Competitive learning algorthms for vector quantization,” Neural Netw., vol. 3, pp.

277–290, 1990.

[23] T. M. Martinetz and K. J. Schulten, “A ‘neural-gas’ network learns topologies,” in Artificial Neural Networks, T. Kohonen, K. Makisara, O. Simula, and J. Kangas, Eds. Amsterdam, The Netherlands: North-Holland, 1991, pp. 397–402.

[24] A. Muñoz and J. Muruzábal, “Self-organizing maps for outlier detection,” Neurocomput., vol. 18, pp. 33–60, 1998.

[25] B. Hammer, A. Rechtien, M. Strickert, and T. Villmann, “Rule extraction from self-organizing networks,” Lecture Notes in Computer Science, vol.

2415, pp. 877–882, 2002.

[26] M. Siponen, J. Vesanto, O. Simula, and P. Vasara, “An approach to automated interpretation of SOM,” in Proc. 3rd Workshop on the Self-Organizing Map (WSOM’01), 2001, pp. 89–94.

[27] J. Vesanto and J. Hollmén, “An automated report generation tool for the data understanding phase,” in Hybrid Information Systems, A. Abraham and M. Koppen, Eds. Heidelberg, Germany, 2002, pp. 611–626.

[28] A. Ultsch, “Knowledge extraction from self-organizing neural networks,” in Information and Classification, O. Opitz, B. Lausen, and R. Klar, Eds. New York: Springer-Verlag, 1993, pp. 301–306.

[29] G. C. Vasconcelos, M. C. Fairhurst, and D. L. Bisset, “Investigating feedforward neural networks with respect to the rejection of spurious patterns,” Pattern Recognit. Lett., vol. 16, pp. 207–212, 1995.

[30] S. Singh and M. Markou, “An approach to novelty detection applied to the classification of image regions,” IEEE Trans. Knowl. Data Eng., vol.

16, no. 4, pp. 396–407, Apr. 2004.

[31] A. J. Höglund, K. Hätönen, and A. Sorvari, “A computer host-based user anomaly detection system using the self-organizing map,” in Proc.

IEEE-INNS-ENNS Int. Joint Conf. Neural Networks (IJCNN), vol. 5, Como, Italy, 2000, pp. 411–416.

[32] H. G. Kayacýk, A. N. Zincir-Heywood, and M. I. Heywood, “On the capability of an SOM based intrusion detection system,” in Proc. IEEE Int. Joint Conf. Neural Networks (IJCNN’03), vol. 3, 2003, pp. 1808–1813.

[33] S. Zanero and S. M. Savaresi, “Unsupervised learning techniques for an intrusion detection system,” in Proc. ACM Symp. Applied Computing, 2004, pp. 412–419.

[34] J. Z. Lei and A. Ghorbani, “Network intrusion detection using an improved competitive learning neural network,” in Proc. 2nd Annu. Conf.

Communication Networks and Services Research (CNSR’04), 2004, pp.

190–197.

[35] S. T. Sarasamma, Q. A. Zhu, and J. Huff, “Hierarchical Kohonen net for anomaly detection in network security,” IEEE Trans. Syst., Man, Cybern.

B, Cybern., vol. 35, no. 2, pp. 302–312, Apr. 2005.

[36] G. A. Barreto and A. F. R. Araújo, “Time in self-organizing maps: An overview of models,” Int. J. Comput. Res., vol. 10, no. 2, pp. 139–179, 2001.

[37] G. A. Barreto, A. F. R. Araújo, and S. C. Kremer, “A taxonomy for spatiotemporal connectionist networks revisited: The unsupervised case,” Neural Computat., vol. 15, no. 6, pp. 1255–1320, 2003.

[38] B. Efron and R. J. Tibshirani, An Introduction to the Bootstrap. London, U.K.: Chapman & Hall, 1993.

[39] T. J. DiCiccio and B. Efron, “Bootstrap confidence intervals,” Statist.

Sci., vol. 11, no. 3, pp. 189–228, 1996.

[40] B. Fritzke, “Growing cell structures—A self-organizing network for unsupervised and supervised learning,” Neural Netw., vol. 7, no. 9, pp.

1441–1460, 1994.

BARRETO et al.: CONDITION MONITORING OF 3G CELLULAR NETWORKS THROUGH COMPETITIVE NEURAL MODELS

[41] H. L. Xiong, M. Swamy, M. Ahmad, and I. King, “Branching competitive learning network: A novel self-creating model,” IEEE Trans. Neural Netw., vol. 15, no. 2, pp. 1417–1429, Mar. 2004.

[42] A. K. Qin and P. N. Suganthan, “Robust growing neural gas algorithm with application in cluster analysis,” Neural Netw., vol. 17, no. 8-9, pp.

1135–1148, 2004.

[43] Physical Layer Standard for cdma2000 Spread Spectrum Systems, May 2002. C.-C. 3GPP2, release C. [44] A. M. Law and W. D. Kelton, Simulation Modeling and Analysis, 3rd ed. New York: McGraw-Hill, 2000.

Guilherme A. Barreto (S’99–M’04) was born in Fortaleza, Brazil, in 1973. He received the B.S. degree in electrical engineering from the Federal University of Ceará, Brazil, in 1995 and the M.Sc. and Ph.D. degrees in electrical engineering from the University of São Paulo, Brazil, in 1998 and 2003, respectively.

In 2000, he developed part of his Ph.D. studies at the Neuroinformatics Group, University of Bielefeld, Germany. He is currently with the Department of Teleinformatics Engineering, Federal University of Ceará. His main research interests are self-organizing neural networks for signal and image processing, time series prediction, pattern recognition, and robotics. He has served as a reviewer for the International Journal of Computational Intelligence and Applications and several conferences.

Dr. Barreto served as the Finance Chair of the IEEE Workshop on Machine Learning for Signal Processing (MLSP) in 2004. He has also been serving as Reviewer for the IEEE TRANSACTIONS ON NEURAL NETWORKS, the IEEE TRANSACTIONS ON SYSTEMS MAN AND CYBERNETICS, and the IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING.

João C. M. Mota (M’04) was born in Rio de Janeiro, Brazil, on November 17, 1954. He received the B.Sc degree in physics from the Federal University of Ceará (UFC), Brazil, in 1978, the M.Sc. degree from the Pontifícia Universidade Católica (PUC-RJ), Brazil, in 1984, and the Ph.D. degree from the State University of Campinas (UNICAMP), Brazil, in 1992, all in telecommunications engineering.

Since 1979, he has been with UFC and is currently a Professor in the Department of Teleinformatics Engineering. He worked in the Institut National des Télécommunications (INT), Evry, France, as an Invited Professor from 1996 to 1998. His research interests include digital communications, adaptive filter theory, and signal processing.

Dr. Mota is a Member and Counselor of the Brazilian Society of Telecommunications, and a Member of the IEEE Communications Society and IEEE Signal Processing Society. He is Counselor of the IEEE Student Branch at UFC. He was General Chairman of the 19th Brazilian Telecommunications Symposium.

1075

Luís G. M. Souza (S’02) was born in Fortaleza, Brazil, in 1978. He received the B.S. degree in electrical engineering from the Federal University of Ceará, Brazil, in 2002. He is currently working toward the M.Sc. degree in teleinformatics engineering at the same university, working on unsupervised neural-based methods for adaptive filtering.

His main research interests are in the areas of neural networks and signal processing.

Rewbenio A. Frota was born in Fortaleza, Brazil, in 1979. He received the B.S. degree in electrical engineering from the Federal University of Ceará, Brazil, in 2003. He is currently working toward the M.Sc. degree in teleinformatics engineering at the same university, working on unsupervised neural-based methods for novelty detection.

His main research interests are in the areas of neural networks and pattern recognition.

Leonardo Aguayo received the B.S. and M.Sc. degrees in electrical engineering from the Polytechnic School of the University of São Paulo, Brazil, in 1994 and 1999, respectively, and the M.BA. degree from the Brazilian Institute of Capital Markets (IBMEC).

He worked in Brazil as an RF Engineer and Consultant, as an Undergraduate Professor at the University of Fortaleza, Brazil, and as a Researcher for the Department of Teleinformatics of Federal University of Ceará, Brazil. Currently, he works as a Researcher for Nokia Institute of Technology (INdT), Brasília, Brazil. His research interests are time series processing, wireless communication systems, and neural networks.