Network Data Analytics Function (NWDAF)

NWDAF analyzes historical Key Performance Indicators (KPIs) from a Network Slice Instance to forecast future load levels. It ingests data from the Network Slice Selection Assistance Information (NSSAI) and Access and Mobility Management Function (AMF) to predict congestion events before they occur.

• Input Data: Observed slice instance load, number of registered subscribers, and Protocol Data Unit (PDU) session statistics.
• Output Analytics: Predicted resource usage for a specific time window, enabling proactive Slice Elasticity scaling.
• Use Case: A Slice Orchestrator uses this prediction to pre-emptively scale up virtualized User Plane Function (UPF) instances, avoiding SLA violations during peak hours.

This capability provides insights into the movement patterns and communication behaviors of User Equipment (UE) groups. NWDAF correlates location data with time to predict trajectory and anomalous movement.

• Input Data: Location reports from the AMF, handover success rates, and cell-level timestamps.
• Output Analytics: Predicted UE trajectories and identification of stationary vs. high-mobility clusters.
• Use Case: A Predictive Load Balancing algorithm uses these predictions to pre-allocate resources in a target cell before a high-speed train enters its coverage area, preventing radio link failure.

NWDAF builds statistical models of UE communication behaviors, including periodic transmissions and session durations, to optimize network resource scheduling and energy efficiency.

• Input Data: PDU session duration, inter-arrival time of packets, and traffic volume from the Session Management Function (SMF).
• Output Analytics: Classification of periodic vs. bursty communication patterns and predicted data volume.
• Use Case: A Slice-Aware Scheduler uses this to group UEs with predictable, low-volume IoT traffic onto a narrow Adaptive Bandwidth Part (BWP) , allowing the base station to enter Cell Discontinuous Transmission (Cell DTX) mode between their scheduled transmissions.

NWDAF provides granular insights into the performance of a network area or specific slice, calculating congestion likelihood and Quality of Service (QoS) sustainability. It is foundational for Closed-Loop Slice Optimization.

• Input Data: QoS flow metrics (packet delay, error rate), Radio Resource Control (RRC) connection states, and throughput measurements from the gNB.
• Output Analytics: Real-time congestion level classification and prediction of QoS parameter degradation.
• Use Case: An O-RAN Intelligent Controller subscribes to this analytic to detect a degrading Guaranteed Bit Rate (GBR) Slice and triggers a Slice Remapping procedure to move the UE to a more stable instance.

Extending its scope beyond the 3GPP RAN, NWDAF can ingest and analyze performance data from trusted non-3GPP access networks like Wi-Fi, providing a unified view of the user experience across heterogeneous access technologies.

• Input Data: WLAN connection status, backhaul bandwidth, and channel utilization from the Trusted WLAN Interworking Function (TWIF).
• Output Analytics: Predicted WLAN link quality and seamless traffic steering recommendations.
• Use Case: An Intent-Based Networking policy engine uses this analytic to automatically offload a user's best-effort video stream from a congested 5G cell to a high-quality, trusted Wi-Fi access point to preserve macro-cell capacity for URLLC slices.

NWDAF applies unsupervised machine learning to establish a baseline of normal network operation and detect statistical anomalies that may indicate faults, misconfigurations, or security threats without predefined signatures.

• Input Data: Multi-dimensional telemetry streams from all subscribed Network Functions (NFs), including CPU load, memory usage, and signaling storm indicators.
• Output Analytics: Anomaly scores and alerts for specific NFs or network slices, with identified root cause candidates.
• Use Case: A Zero-Touch Network Provisioning system uses an anomaly alert on a newly deployed Cloud-Native Network Function (CNF) to automatically trigger a rollback to the previous stable software version before a widespread outage occurs.