NWDAF — Data Analytics in the 5GC (Network Data Analytics)¶

Learning objectives¶

After reading this chapter, you will be able to:

• Explain that the NWDAF (Network Data Analytics Function) is "the NF that analyzes network data and provides the results (Analytics) to other NFs."
• Diagram the flow of the NWDAF's practice of collecting data from other NFs/OAM → analyzing it → providing the results to other NFs.
• Cite the concept of the Analytics ID that identifies the kind of analytics, and representative examples (slice load, QoS Sustainability, etc.).
• Explain the relationship in which other NFs Subscribe/Request analytics results through Nnwdaf (TS 23.288).
• Get an overview of the idea of MTLF/AnLF (the logical split between ML training and analytics) introduced in Rel-17/18.

Prerequisites¶

• 5GC Overview — the overall picture of the 5GC and the division of roles among NFs
• An understanding of SBA (Service Based Architecture) — the framework in which NFs expose services (Nxxx) and other NFs Subscribe/Request them
• Supplementary: NWDAF (NF details) / Representative NFs that use analytics results: PCF, AMF, SMF

Why — why the network needs data analytics¶

The 5GC has many NFs working together, handling slices, diverse services, and a huge number of UEs. To operate the network intelligently, you need to know "what is happening now" and "what is likely to happen next."

• Grasping the current state — which slice is congested, which NF's load is high.
• Prediction — whether this QoS can be maintained going forward, where the UE is likely to move.
• Anomaly detection — whether there is behavior different from normal (signs of an attack or fault).

With such "trend, prediction, anomaly" information, each NF can make better decisions. For example, if the PCF learns that "this slice will not be able to maintain QoS going forward," it can adjust policy in advance. The NF that specializes in this analytics (Analytics) is the NWDAF.

Analogy: The NWDAF is "the network's analyst." It gathers data from each department (other NFs) and the field (OAM), summarizes trends, predicts the future, and hands decision-makers (other NFs) a report saying "this is what is likely to happen." The analyst itself does not carry out operations, but its advice shapes the quality of operations.

What — Analytics and Nnwdaf¶

What the NWDAF provides is Analytics (analytics results). Other NFs request "I want this analysis," and the NWDAF returns the result. The service-based IF that governs this exchange of information is Nnwdaf, and the specification is consolidated in TS 23.288 (Architecture enhancements for 5G System to support network data analytics services).

Analytics ID — the name that indicates the kind of analysis¶

"Which analysis you want" is identified by the Analytics ID. Here are just a few representative examples (not exhaustive).

Subscribe and Request¶

There are broadly two ways for another NF to ask the NWDAF for analytics.

• Subscribe — "please notify me of this analysis continuously." Each time the conditions change, the NWDAF delivers the result (Notify).
• Request — "I want this analysis just once, now." The NWDAF returns the result only once.

For things whose situation keeps changing, such as load and QoS, use Subscribe; when you want a one-off basis for a decision, use Request.

How — the flow from data collection to analytics provision (Architecture)¶

The NWDAF collects data from other NFs and OAM, performs analysis, and provides the results to other NFs. The overall picture, with the NWDAF at the center, is as follows.

graph LR
    subgraph SOURCES["Data collection sources"]
        AMF_S[AMF]
        SMF_S[SMF]
        OTHER[Other NFs]
        OAM[OAM
Operations monitoring]
    end
    subgraph CONSUMERS["Consumers of analytics results"]
        PCF_D[PCF]
        AMF_D[AMF]
        SMF_D[SMF]
        NSSF_D[NSSF, etc.]
    end
    SOURCES -->|Data collection| NWDAF[NWDAF
Data analytics]
    NWDAF -->|Nnwdaf
Provide Analytics| CONSUMERS

Put into words, the flow is as follows.

1. Collection — the NWDAF gathers data (load, events, statistics) from other NFs such as AMF/SMF and from OAM.
2. Analysis — it processes the gathered data according to the Analytics ID, deriving trends, predictions, and anomalies.
3. Provision — it returns the results via Nnwdaf to the other NFs (PCF, etc.) that Subscribed/Requested them.

Example use case: Suppose the PCF has Subscribed to the QoS Sustainability analysis from the NWDAF. When the NWDAF notifies that "the QoS in a certain area is expected to be unsustainable going forward," the PCF can use that as a basis for adjusting policy in advance (e.g., bit-rate throttling or a slice-side response). The decision-maker (PCF) acts on seeing the analyst's (NWDAF's) report.

MTLF and AnLF — the division of roles between analytics and ML training¶

The NWDAF was introduced in Rel-16. Initially the central function was "analyze data and produce results," but in Rel-17/18 it was expanded into a framework that handles machine learning (ML) models.

Within that, an idea of logically dividing the NWDAF's internal functions into two was introduced.

As an image, the MTLF is "the workshop that makes models," and the AnLF is "the analytics counter that uses those models to produce predictions." This split makes it possible to scale and deploy model training and analytics provision separately.

3GPP Specification¶

FAQ¶

Summary¶

• The NWDAF is the NF in the 5GC that specializes in data analytics (Analytics).
• It collects data from other NFs/OAM → analyzes it → provides the results to other NFs (PCF, etc.).
• The provisioning IF is Nnwdaf (TS 23.288). Other NFs ask for analytics via Subscribe/Request.
• The kind of analysis is identified by the Analytics ID (slice load, QoS Sustainability, abnormal behavior detection, and many more).
• Introduced in Rel-16. Expanded to ML in Rel-17/18, with roles divided into training (MTLF) and analytics provision (AnLF).
• In the analogy, it is "the network's analyst." It produces trends, predictions, and anomalies, and helps other NFs make decisions.

Comprehension check¶

Next Step¶

• For the details of the NWDAF NF itself, go to NWDAF (NF details).
• As a representative example that uses analytics results, go to Policy (policy control / PCF).
• For the general explanation of slices, which are subjects of analysis, review Network Slicing.
• As a related operational practice, also see Charging.