NWDAF — Network Data Analytics Function¶

Learning objectives¶

After finishing this page, you will be able to:

• Explain in one phrase the role the NWDAF plays in the 5GC (collecting data and providing analysis/prediction (Analytics)).
• Explain the idea of the Analytics ID (the key that identifies the type of analysis = load prediction, anomaly detection, slice load, UE behavior, QoS sustainability prediction, etc.).
• Explain how consumer NFs (AMF/SMF/PCF, etc.) use the NWDAF's Analytics and connect it to automatic optimization and closed-loop control.
• Explain that the NWDAF is a 5G-new function that came into full swing in Rel-16, and that 4G (EPC) has no standard equivalent function.

Prerequisites¶

It will go more smoothly if you first understand the following.

• Basics of SBA (Service Based Architecture) and SBI → Curriculum
• The idea of the SBI (service-based interfaces such as Nnwdaf) → Interface dictionary
• The roles of related NFs (AMF/SMF/PCF/NSSF, etc., which are both data sources and consumers) → NF dictionary

What you'll learn in this chapter¶

We first enter from the Why (what is troublesome without the NWDAF), then organize the What (the flow of data collection → analysis → Analytics provision, the Analytics ID, roles, and APIs) with tables and a Mermaid diagram, and finally proceed to the How (appearance in procedures, EPC comparison, and reference specs).

Why — why it's needed¶

The 5GC is a large-scale, complex system in which many NFs collaborate. There are limits to monitoring by hand and optimizing case by case things like traffic increases and decreases, per-slice load, UE movement, and signs of congestion or anomalies. In particular, control based on prediction, such as "it's likely to get crowded soon, so allocate resources ahead of time," cannot be realized by intuition or after-the-fact response.

Therefore, a standard function is needed that collects data from various parts of the network, generates analysis/prediction (Analytics) through statistics and prediction (using machine learning as needed), and provides it to the NFs responsible for control. This is the NWDAF (Network Data Analytics Function). With the NWDAF, NFs can receive insights such as load prediction, anomaly detection, slice load, UE behavior, and QoS sustainability prediction, and can run automatic optimization and closed-loop control (the loop of data → analysis → control → remeasurement).

Analogy: The NWDAF is the network's data analyst / weather forecaster. It gathers daily data from each department (NF/OAM) and issues forecasts such as "this area will be crowded tomorrow" and "there are signs of an anomaly in this facility." Without the NWDAF, each NF can only react to what is happening right now and cannot perform proactive control based on prediction.

Overview¶

The NWDAF (Network Data Analytics Function) is the hub of data analysis and prediction in the 5GC. Its operation is broadly in three stages.

• Data collection … Collects event notifications and metrics from each NF (AMF/SMF/PCF/NSSF, etc.) and from OAM (operations and management).
• Analysis (Analytics) … Statistically processes and predicts the collected data, using machine learning (ML models) as needed to generate insights.
• Analytics provision … Provides the generated analysis/prediction results to consumer NFs (AMF/SMF/PCF, etc.).

Which type of analysis it is is identified by the Analytics ID (e.g., network load, slice load, UE behavior/movement, anomaly detection, QoS sustainability, etc.; the individual ID system is to be confirmed). The forms of provision are a Request type, which requests each time, and a Subscribe/Notify type, in which conditions are registered in advance and a notification is received each time there is an update.

The NWDAF has no standard equivalent function in 4G (EPC); it is positioned as an analysis function standardized on the SBA = new to 5G (coming into full swing in Rel-16).

Basic Concept — explanation for beginners¶

Think of the NWDAF as a data analyst in a company. It gathers "data" such as sales and the number of visitors from each department (NF/OAM), predicts the future from past trends, and advises the relevant departments with things like "this store is likely to be crowded next week" and "this machine is likely to break down."

• Gather: receive data from each department (data collection).
• Analyze: read trends from past data and predict the future (Analytics, using an ML model if needed).
• Advise: hand the prediction results to the departments that actually act (consumer NFs) (Analytics provision).

The label that expresses the "type" of advice is the Analytics ID. It specifies which analysis it is—"load prediction," "anomaly detection," "how crowded a slice is," etc.—by this ID. As for how to receive it, you can either ask each time (Request) or register in advance and be notified if there is an update (Subscribe/Notify).

Network Function details¶

Architecture¶

The NWDAF collects data from each NF/OAM and provides analysis/prediction results to consumer NFs (PCF/AMF/SMF, etc.), functioning as a hub of data analysis.

flowchart LR
  AMF["AMF"]
  SMF["SMF"]
  PCF["PCF"]
  NSSF["NSSF"]
  OAM["OAM (operations & mgmt)"]
  NWDAF["NWDAF (analysis & prediction)"]

  AMF -- "data collection (Event Exposure)" --> NWDAF
  SMF -- "data collection (Event Exposure)" --> NWDAF
  NSSF -- "slice-related data" --> NWDAF
  OAM -- "metrics collection" --> NWDAF
  NWDAF -- "Analytics provision (Nnwdaf)" --> PCF
  NWDAF -- "Analytics provision (Nnwdaf)" --> AMF
  NWDAF -- "Analytics provision (Nnwdaf)" --> SMF

How to read the diagram: The NWDAF collects data as Event Exposure and metrics from NFs such as AMF/SMF/NSSF and from OAM (inflow to the left), and provides the analyzed/predicted results per Analytics ID to consumer NFs (PCF/AMF/SMF, etc.) over Nnwdaf (outflow to the right). A characteristic is that the same NF can be both a data source and a consumer, which allows the closed loop of "measurement → analysis → control → remeasurement" to be established.

Interface¶

The main interface the NWDAF has and its role.

For details of the SBI (HTTP/2 + JSON over TLS) and Nnwdaf, see the Interface dictionary.

Appearance in procedures¶

The NWDAF appears not inside the basic procedures themselves, such as registration or PDU Session establishment, but in the context of optimization and operation outside them. The basic procedures hold even without the NWDAF, and the NWDAF's Analytics is used to make control smarter.

• The PCF references the NWDAF's slice load analysis and adjusts policies (QoS/charging/route selection) according to the load situation.
• The AMF uses the UE's movement prediction (UE behavior Analytics) to proactively optimize mobility management and paging strategy.
• The SMF references load prediction and adjusts session/resource allocation.

These are applied scenarios, and the specific collaboration timing, IEs, and details of the Analytics ID are to be confirmed. For the policy side, see PCF, and for the perspective of external (third-party) exposure of Analytics, see NEF.

Comparison with EPC¶

• In 4G: There is no standard equivalent function. Network analysis and optimization depended on OAM or operator/vendor proprietary analysis platforms (monitoring, KPI aggregation, manual tuning, etc.). An "analysis function" as a standard NF is not defined.
• In 5G: The NWDAF is defined as a standardized analysis function on the SBA, and each NF can use analysis/prediction over the SBI (Nnwdaf). Data-driven automatic optimization and closed-loop control can now be realized within a standard framework.

Release differences¶

• Rel-15: Introduction of the concept of the NWDAF (presentation of the framework of an analysis function).
• Rel-16: Full definition of the NWDAF. Specified multiple Analytics IDs (network load, slice load, UE behavior, anomaly detection, etc.) and the framework of data collection and provision.
• Rel-17: Extensions such as ML model provision (MLModelProvision, etc.), improvement of analysis accuracy, and distributed NWDAF (separation of data collection and analysis, separation of aggregation and inference). Specific items and section numbers are to be confirmed.

3GPP Specification¶

• 3GPP TS 23.501 §6.2.18 — Functional definition of the NWDAF (its role as a Network Function)
• 3GPP TS 23.288 — Details of Analytics (Analytics ID, procedures of data collection and analysis). Individual section numbers to be confirmed
• 3GPP TS 29.520 — Nnwdaf services (AnalyticsInfo, EventsSubscription, etc.). Individual section numbers to be confirmed

Note (to be confirmed): The above correspondences are a general organization, but the specific system of Analytics IDs and the details/section numbers of each service differ by Release, so they are individually to be confirmed. The SBI is implemented over HTTP/2 + JSON over TLS.

Summary¶

• The NWDAF is the hub of data analysis and prediction (Analytics) of the 5GC; it collects data from each NF/OAM and provides analysis/prediction results to consumer NFs.
• Which analysis it is is identified by the Analytics ID (load prediction, anomaly detection, slice load, UE behavior, QoS sustainability prediction, etc.). Provision comes in a Request type and a Subscribe/Notify type.
• Consumer NFs (AMF/SMF/PCF, etc.) use Analytics and can run automatic optimization and closed-loop control (measurement → analysis → control → remeasurement).
• The provided APIs are Nnwdaf_AnalyticsInfo / Nnwdaf_EventsSubscription, and in Rel-17 MLModelProvision, etc. (TS 29.520).
• The NWDAF is a 5G-new function that came into full swing in Rel-16, and 4G (EPC) has no standard equivalent function (depends on OAM/proprietary analysis platforms).

Next Step¶

• PCF — a consumer NF that references the NWDAF's slice load analysis, etc., to adjust policy
• NEF — the window for exposing Analytics to the outside (third parties)
• NF dictionary — a check of NFs that become data sources and consumers, such as AMF/SMF/NSSF
• Interface dictionary — a check of the SBI (Nnwdaf)