NWDAF stands for NetWork Data Analytic Function. Simply put, this functionality establishes interface and protocols to almost every important components of corenetwork and retrieve the data from them and perform analysis.

It is a component introduced in 5G networks to provide data analytics services, enabling more intelligent and automated network management. It collects, analyzes, and utilizes data from various network functions and external sources to generate insights that help optimize network performance, predict traffic patterns, enhance security, and support service assurance. By providing these insights, NWDAF enables network operators to make data-driven decisions, leading to improved efficiency, resource utilization, and a better overall user experience.

• Where does it get data from ?
• What kind of Analytic information you can get from NWDAF ?
• Signaling Protocol between NWDAF and Other components
• Use Cases and Key Issues
• Pathways to AI/ML
• Reference
• YouTubes

Where does it get data from ?

NWDAF obtains data from various sources within the 5G network, including other network functions like the Access and Mobility Management Function (AMF), Session Management Function (SMF), Policy Control Function (PCF), and Unified Data Management (UDM). It also collects data from network exposure functions, application functions, and other service functions that provide information on user mobility, session management, service quality, and network performance. This diverse range of data inputs allows NWDAF to perform comprehensive analytics and generate insights across multiple dimensions of the network.

The connection/interface between NWDAF and various core network components can be illustrated as follows. This illustraction was reconstructed from diagrams in 23.501-4.2.3 and tables from 23.288 - 6.2.2.1. You would notice there are some components that are not directly connected by NWDAF, but the component with the connection are connected to other components which are not directly connected to NWDAF. Therefore, we can say NWDAF is connected almost every component of core network directly and indirectly.

Figure 1. The dotted arrows all point away from NWDAF, and that direction is correct. NWDAF is the consumer here, so it queries each producer rather than receiving anything unasked.

• NWDAF sits alone at the top, drawn in red, and it touches none of the numbered reference points.
• The dotted arrows leave NWDAF and land on NEF, NRF, PCF, AF, AMF and SMF.
• NSSF is drawn but no dotted arrow reaches it, which is the point the paragraph above makes about indirect connection.
• The solid lines with numbered grey ellipses are the ordinary reference points of the 5G core, numbered 1 to 15 and 20 to 22.
• That numbering is the reference point representation from 23.501, so the picture is the familiar architecture with NWDAF laid over it.
• UDM is the one box drawn in teal rather than yellow, and UE, (R)AN and DN carry their own colours at the bottom.

As shown in the diagram above, NWDAF is getting services from various core network components. The components providing the service (providing data) is called Service Producer. The list of service producers and type of the services are summarized in a table as shown below. For the details of each of the services, refer to corresponding sections in 23.502.

< 23.288-Table 6.2.2.1-1: NF Services consumed by NWDAF for data collection >

Figure 2. Almost every row is an event exposure service. The NRF rows are the exception, because finding a producer is a different job from collecting from one.

• The columns are Service producer, Service, and Reference in TS 23.502.
• AMF, SMF, UDM, NEF and AF each expose one event exposure service, named Namf, Nsmf, Nudm, Nnef and Naf respectively.
• PCF is the only producer with two entries : Npcf_EventExposure for a group of UEs or any UE, and Npcf_PolicyAuthorization_Subscribe for a specific UE.
• NRF contributes Nnrf_NFDiscovery and Nnrf_NFManagement, which are discovery services rather than data sources.

This screenshot has drifted from the current text, and the differences are worth knowing before quoting it. In 23.288 v20.1.0 the NRF row lists Nnrf_NFDiscovery alone, so the Nnrf_NFManagement entry has gone. The AMF and SMF rows each carry a second reference of 5.2.3.5 alongside their own. The PCF group entry now reads for a group of UEs identified by an Internal-Group-Id. The last column is now headed Reference in TS 23.502 or other indicated specification.

< 23.288-Table 6.2.2.1-2: NF Services consumed by NWDAF to determine which NF instances are serving a UE >

Figure 3. Three different places answer the same question. Which one NWDAF asks depends entirely on which function it is looking for.

• The columns are the type of NF instance to determine, the NF that NWDAF contacts, the service, and the 23.502 reference.
• To find the UDM, the BSF or the NEF serving a UE, NWDAF asks the NRF through Nnrf_NFDiscovery.
• To find the AMF or the SMF serving a UE, NWDAF asks the UDM through Nudm_UECM.
• To find the PCF serving a UE, NWDAF asks the BSF through Nbsf_Management.
• This table is unchanged in 23.288 v20.1.0, so the screenshot is still current.

What kind of Analytic information you can get from NWDAF ?

NWDAF provides a variety of analytic information that can assist network operators in making informed decisions regarding network optimization, performance enhancement, and issue resolution. The analytics span multiple dimensions, including network performance, user behavior, and service quality, enabling predictive and prescriptive insights for more efficient network management.

Overall, NWDAF offers a comprehensive analytical view of the network, covering performance, user experience, security, and business aspects, enabling operators to make informed decisions for efficient network operation and service delivery.

• Performance Optimization:
• Network Performance: Throughput, latency, resource utilization, bottleneck identification, and QoS monitoring.
• Service Experience: Specific service performance (e.g., video streaming, voice calls) for targeted optimization.
• Load Analytics: Current and predicted load for efficient resource allocation and load balancing.
• Predictive Analytics: Network state forecasting (traffic trends, capacity bottlenecks) for proactive management.
• Failure Prediction: Likelihood of future failures and root cause analysis for faster troubleshooting.
• User-Centric Insights:
• User Experience: Behavior analysis, QoE assessment (session drops, mobility), and service usage trends.
• Mobility Patterns: Analysis for handover optimization and overall network efficiency improvements.
• QoE Predictions: Forecasting using machine learning to enable proactive resource management.
• Security and Anomaly Detection:
• Security Analytics: Detection of unusual network patterns or behaviors indicating security threats or network faults.
• Network Management and Planning:
• Network Slicing: Performance insights into network slices for resource allocation and optimization.
• Infrastructure Forecasting: Predicting future resource needs based on historical data, aiding network expansion planning.
• Business Intelligence:
• Market and Customer Insights: Data-driven insights to identify trends and customer preferences.
• Service and Monetization: Developing new services and revenue streams based on these insights.

Followings are the list/categories of the information formally specified by 3GPP.

< 23.288-Table 7.1-2: Analytics information provided by NWDAF >

The ten rows above are the set that existed when this page was written. 23.288 has kept adding to the list since, and v20.1.0 of that table now defines 25 Analytics IDs. The fifteen below are the ones that arrived afterwards, and they are what the list has grown into rather than a separate mechanism.

< 23.288 v20.1.0 - Table 7.1-2 : the Analytics IDs added after the ten above >

Two patterns are visible in that list. Several entries move NWDAF outside the core network itself, because WLAN performance, DN Performance and Location Accuracy all describe something the 5GC does not own. Several others are security work rather than optimisation work, because Signalling storm and Abnormal User Plane Traffic exist to detect attacks rather than to tune throughput.

• The list is open ended : it went from 10 Analytics IDs to 25, and each release has added to it rather than replacing what came before.
• An Analytics ID is the unit of discovery : an NWDAF registers the IDs it supports in the NRF, so a consumer finds an instance by naming the ID it wants.
• Statistics and predictions come from one request : nearly every response description offers both, and the consumer chooses which by what it asks for.
• Later additions reach past the core : WLAN performance, DN Performance and Location Accuracy all describe behaviour that the 5GC does not itself control.

The table summarizes different types of analytics information that can be requested from NWDAF and the corresponding response descriptions. Each type of analytics information has a corresponding "Analytics ID" that is used in the request to specify the desired information. The response provides the requested analytics data in the form of statistics or predictions.

• Load-related analytics:
• Slice Load level: Load information for a specific Network Slice Instance.
• NF Load information: Load statistics or predictions for specific Network Functions (NFs).
• Network Performance information: Statistics or predictions on load and number of UEs in a specific area.
• User Data Congestion information: Statistics or predictions on user data congestion for transfer over the user plane, control plane, or both.
• User-related analytics:
• Observed Service experience information: Statistics or predictions on Service experience for a Network Slice or an Application.
• UE mobility information: Statistics or predictions on User Equipment (UE) mobility.
• UE Communication information: Statistics or predictions on UE communication.
• Expected UE behavioural parameters: Analytics on UE Mobility and/or UE Communication.
• UE Abnormal behaviour information: Observed or expected exceptions related to UE behavior.
• Quality of Service (QoS) analytics:
• QoS Sustainability: Information on the location and time of QoS changes or predictions of potential QoS changes and thresholds that may be crossed.

Signaling Protocol between NWDAF and Other components

The signaling protocol used between NWDAF and other components in the 5G network is primarily based on the 5G Service-Based Architecture (SBA), which relies on RESTful APIs and HTTP/2 communication. This allows NWDAF to communicate seamlessly with various network functions like the AMF, SMF, PCF, and others.

The signaling protocol between NWDAF and other components is thus designed to be flexible, efficient, and highly interoperable, ensuring that NWDAF can effectively collect, analyze, and disseminate analytics data within the 5G ecosystem.

The table below outlines the Network Functions (NF) services provided by NWDAF. It specifies the services NWDAF offers, the corresponding operations, the operation semantics, and the example consumers of these services.

< 29.520-Table 4.1-1: Services provided by NWDAF >

Two more services sit in that table in 29.520 v20.0.0, and both are about federated learning. They are listed here because the eight above do not cover them.

The consumer column of the first row has grown as well. 29.520 v20.0.0 lists ADRF, UDM, NRF, SCP and UPF as consumers of Nnwdaf_EventsSubscription in addition to the ones shown above. The direction of that growth is worth noticing, because the SCP and the UPF are not places where analytics consumption was originally expected.

Followings are brief descriptions on this table : The table details several services offered by the Network Data Analytics Function (NWDAF) within a 5G network. These services enable various Network Function (NF) service consumers to interact with NWDAF for different data analytics purposes.

• Key Services:
• Nnwdaf_EventsSubscription: Handles subscriptions to and notifications from NWDAF for different types of analytics information, including transferring subscriptions between NWDAFs.
• Nnwdaf_AnalyticsInfo:  Allows consumers to request and obtain specific analytics information or context related to their subscriptions.
• Nnwdaf_DataManagement:  Manages data subscriptions for consumers, including subscriptions, unsubscriptions, and notifications when subscribed events are detected. Also allows retrieval of subscribed data.
• Nnwdaf_MLModelProvision:  Manages subscriptions and notifications related to the availability of machine learning (ML) models matching specified parameters.
• Nnwdaf_MLModelTraining:  Handles subscriptions, unsubscriptions, and notifications for ML model training processes.
• Nnwdaf_MLModelMonitor:  Manages subscriptions and notifications for ML model accuracy, allows for providing analytics feedback, and enables registering ML model usage and monitoring with the model provider NWDAF.
• Nnwdaf_RoamingData & Nnwdaf_RoamingAnalytics:  Enable subscriptions and notifications for input data and analytics related to roaming User Equipment (UEs), respectively.
• Common Operations:
• Subscribe/Unsubscribe: Used to initiate or terminate subscriptions for notifications or data.
• Notify: NWDAF sends notifications to consumers when specific events or conditions occur.
• Request/Response: A pattern for requesting information or actions and receiving corresponding responses.
• Transfer & ContextTransfer: Used to manage the transfer of subscriptions or analytics context between NWDAFs.
• Fetch: Retrieves subscribed data from NWDAF.
• Register/Deregister: Used for registering or deregistering the use and monitoring of ML models.
• Consumers:
• A variety of Network Functions consume these services, including PCF, NSSF, AMF, SMF, NEF, AF, LMF, OAM, CEF, NWDAF itself, DCCF, MCAF, H-RE-NWDAF, and V-RE-NWDAF.

Use Cases and Key Issues

Now assume that you have NWDAF in place in your core network, what are you going to do with it ? would there any issues with achieving your goal in terms of NWDAF process or implementations ?

I think the final answer to these questions would be up to you and everybody would have a little bit of different answers, but as initial brainstorming TR 23.791 has pretty good list of answers to the questions. For me who would not be the one that implement this functionality, just reading the titles in the document was very helpful to get the big picture of what we can do with NWDAF. Following is the blind copy of those titles from TR 23.791. If you are interested in further detail, refer to TR 23.791.

• Use Cases
• Use Case 1: <how to get information from AF>
• Use Case 2: <NWDA-Assisted QoS Provisioning>
• Use Case 3: <NWDA-Assisted Traffic Handling>
• Use Case 4: Using NWDAF output to customize mobility management 
• Use Case 5: <NWDA-assisted Determination of Policy> 
• Use Case 6: <NWDAF-Assisted QoS Adjustment> 
• Use Case 7: NWDAF assisting 5G edge computing   
• Use Case 8: Performance improvement and supervision of mIoT terminals   
• Use Case 9: <NWDAF-assisted load balancing/re-balancing of network functions>   
• Use Case 10: NWDA-assisted determination of areas with oscillation of network conditions    
• Use Case 11: Prevention of various security attacks 
• Use Case 12: < NWDA-Assisted predictable network performance >  
• Use Case 13: <UE driven analytics sharing>  
• Use Case 14: How to ensure that slice SLA is guaranteed
• Key Issues
• Key Issue 1: Analytic Information Exposure to 5GS NF    
• Key Issue 2: Analytic Information Exposure to AF    
• Key Issue 3: Interactions with 5GS NFs/AFs for Data Collection  
• Key Issue 4: Interactions with OAM for Data Collection and Data Analytics Exposure  
• Key Issue 5: NWDAF-Assisted QoS Profile Provisioning
• Key Issue 6: NWDAF assisting traffic routing    
• Key Issue 7: NWDAF assisting Future Background Data Transfer    
• Key Issue 8: performance improvement and supervision of mIoT terminals  
• Key Issue 9: Customizing mobility management based on NWDAF output  
• Key Issue 10: NWDAF service support to select NF instances  
• Key Issue 11: NWDA-Assisted predictable network performance 
• Key Issue 12: Support of Northbound Network Status Exposure 
• Key Issue 13: UE driven analytics   
• Key Issue 14: How to ensure that slice SLA is guaranteed

Pathways to AI/ML

As many people would guess, I think the data collected by NWDAF can be a good target for AI/ML (Artificial Intelligence / Machine Learning).  I am pretty sure that AI/ML will get involved here.. but will AI/ML be incorporated into MWDAF or be additional application (services) sitting on top of NWDAF ?  will this AI/ML be specified by 3GPP ? or will it be driven by individual company ?

As far as I know, all of these are open questions for now.

There are some 3GPP activity as of now (Dec 2021), there is some AI/ML activity in 3GPP targetted for Rel 18, but as far as I know that activity is mostly for RAN side, not for Core Network (See this note for 3GPP AI/ML).

Those questions have since been answered, and the answer was not the one this section expected. 3GPP did not add AI/ML above NWDAF as a separate application. It split NWDAF internally instead. 23.288 clause 5.1 now describes two logical functions that an NWDAF may contain.

• Analytics logical function, AnLF : performs inference, derives the statistics and predictions a consumer asked for, and exposes Nnwdaf_AnalyticsSubscription and Nnwdaf_AnalyticsInfo.
• Model Training logical function, MTLF : trains the ML models and exposes training services, which is where the model provisioning described in clause 7.5 and clause 7.6 lives.

An NWDAF may contain an MTLF, an AnLF, or both, so the split is a logical one rather than a deployment rule. What it settles is the question this section asked. Training and inference are separate roles inside the same function, and an AnLF can obtain a trained model from an MTLF in a different NWDAF instance. Discovery works through the NRF, because each instance registers the Analytics IDs it supports along with the services it offers for them.

Two further pieces arrived with that split. The Analytics Data Repository Function, described in clause 5B.1, stores and retrieves data and analytics so a model does not have to be trained from live collection every time. Clause 6.2C adds federated learning among multiple NWDAFs, and 29.520 v20.0.0 carries Nnwdaf_VFLTraining and Nnwdaf_VFLInference as the services that drive the vertical case.

One boundary is drawn explicitly, and it answers the part of the question about what 3GPP would standardise. 23.288 states that pre-trained ML model storage and provisioning to NWDAF is out of the scope of 3GPP. The interfaces are specified and the models themselves are not, so the algorithm remains a vendor matter.

• AI/ML went inside NWDAF, not on top of it : the AnLF and MTLF split is internal to the function, and no new network function was created for training.
• Training and inference can be in different instances : an AnLF may use trained models provisioned by an MTLF elsewhere, found through the NRF.
• The model itself is out of scope : 23.288 says so directly, so 3GPP specifies how a model is requested and delivered rather than what is in it.
• Federated learning is specified, not just discussed : clause 6.2C covers it, and 29.520 carries two services for the vertical case.
• Positioning became a consumer : an NWDAF containing MTLF may provide trained models to the LMF for LMF-based AI/ML positioning, as defined in 23.273.

Reference

• 3GPP 23.288-Architecture enhancements for 5G System (5GS) to support network data analytics services
• 3GPP 23.502-Procedures for the 5G System (5GS)
• 3GPP TS 29.520 - Network Data Analytics Services
• 3GPP TR 23.791 - Technical Specification Group Services and System Aspects; Study of Enablers for Network Automation for 5G
• NWDAF – Introducing Machine Learning Capabilities in 5G - 5GZONE
• Reducing Risk through Network Analytics - MPIRICAL
• NWDAF: Automating the 5G network with machine learning and data analytics - Inform
• Network Data Analytics Function (NWDAF): 5G Network Function - LinkedIn

YouTubes

• Network Data Analytics Function and Non Real Time RIC Solution (Jul 2021)
• NWDAF with NF Load Use Case (Aug 2021)
• What is 5G NWDAF? (Oct 2021)
• How NWDAF Can Unlock the Value of 5G - TelecomTV (2022)