Description
The Network Data Analytics Function (NWDAF) is a standardized analytics and machine learning-enabled function within the 5G Core network architecture, introduced in 3GPP Release 15. It serves as a centralized or distributed analytics engine that collects, correlates, and analyzes data from various network functions, applications, and external sources to generate insights, predictions, and recommendations. The NWDAF's primary role is to provide data-driven intelligence to other 5G Core control plane and management plane functions, enabling automated network optimization, proactive service assurance, and enhanced user experience. Architecturally, it is defined as a service-based architecture (SBA) function that exposes northbound analytics services via standardized APIs, allowing consumers like the Policy Control Function (PCF), Network Slice Selection Function (NSSF), and Operations, Administration and Management (OAM) systems to request analytics.
NWDAF operates through a structured data pipeline involving data collection, analytics processing, and result dissemination. It collects data from multiple sources categorized as network data (e.g., from AMF, SMF, UPF regarding session metrics, mobility patterns, QoS), application data (e.g., from Application Functions (AF) about service requirements), and management data (e.g., from OAM about performance and faults). This data can be ingested via push or pull mechanisms using standardized interfaces like Nnwdaf_EventsSubscription. Internally, the NWDAF employs analytics models—which can be rule-based, statistical, or machine learning models—to process the data. These models perform tasks such as anomaly detection, trend analysis, prediction of network load or user mobility, and identification of slice performance issues. The analytics results, which include historical reports, real-time insights, or future predictions, are then provided to consumer functions to influence decisions, such as adjusting QoS policies, triggering network slice reconfiguration, or optimizing handover parameters.
Key components of the NWDAF include the Analytics Logical Function (which hosts the analytics models), the Data Collection Coordination Function (which manages data acquisition from sources), and the Analytics Exposure Function (which handles API exposure and subscription management). The NWDAF supports both on-demand analytics queries and subscription-based continuous analytics reporting. For example, a PCF may subscribe to NWDAF for analytics on expected network congestion in a certain area to pre-emptively adjust policy rules, or an OAM system may request predictions on slice resource utilization for capacity planning. The NWDAF also facilitates model training and lifecycle management, potentially leveraging federated learning across multiple NWDAF instances. Its integration with the 5G Core is pervasive, impacting nearly all aspects of network operation from mobility management and session management to network slicing and edge computing, making it a cornerstone of 5G's autonomous network vision.
Purpose & Motivation
The NWDAF was created to address the growing complexity and dynamic nature of 5G networks, which support diverse services with vastly different requirements—from enhanced mobile broadband to massive IoT and ultra-reliable low-latency communications. Traditional network management relied on reactive, manual interventions based on static thresholds, which were inadequate for 5G's scale, agility, and service diversity. The NWDAF introduces a native, standardized analytics capability within the 5G Core to enable data-driven, proactive, and automated network operations. It solves the problem of siloed data across network functions by providing a centralized analytics hub that correlates information to derive holistic insights, thereby improving network efficiency, resource utilization, and service quality.
Historically, network analytics were performed by external OAM systems or proprietary solutions that lacked tight integration with the core network control plane. This resulted in delayed responses, limited real-time capabilities, and inability to directly influence network behavior. With the advent of network slicing, edge computing, and service-based architecture in 5G, the need for intelligent, closed-loop automation became critical. Release 15 of 3GPP laid the foundation for NWDAF as part of the 5G system's native intelligence, motivated by operators' demands for reduced operational costs, improved customer experience, and support for new vertical services. The NWDAF enables predictive maintenance, dynamic resource allocation, and personalized service delivery by leveraging machine learning and big data techniques within the telecom domain.
Furthermore, NWDAF addresses limitations of previous approaches by providing a standardized framework for analytics that ensures interoperability across vendors and network functions. It allows network operators to deploy advanced analytics without relying on fragmented, vendor-specific solutions. By embedding analytics directly into the network architecture, NWDAF facilitates real-time decision-making, such as instantly adapting to traffic spikes or mitigating congestion before it impacts users. Its creation was also driven by the vision of self-organizing networks (SON) evolving towards fully autonomous networks, where NWDAF acts as the 'brain' that analyzes data and triggers actions through policy control and management systems. This transforms 5G from a connectivity platform into an intelligent, adaptive infrastructure capable of meeting the stringent and varied demands of future digital society.
Classification
Detected Changes Across Releases
from 3GPP Change RequestsSpecific changes extracted from the „Change history“ tables of 3GPP specifications (569 CRs across 6 releases). Complements the general historical overview above with the evidence-based evolution of this function.
In Release 15, the NWDAF (Network Data Analytics Function) was newly introduced as a defined architectural function within the 5G core network, as specified in TS 23.501. It was established to provide network data analytics services, such as network slice load predictions, which other network functions like an NSCE server can subscribe to via the NEF using procedures like Nnef_AnalyticsExposure_Subscribe. This enables capabilities like analytics exposure for monitoring and optimizing network slice performance based on collected data and predictions.
In Release 16, the NWDAF's role was significantly expanded to enable new, analytics-driven network automation. Key enhancements included using its analytics for specific functions like SMF and UPF selection, determining MICO mode parameters, and influencing UE mobility and background data transfer policies. Furthermore, the release formalized its exposure to external applications via the NEF and introduced new analytics services, such as network slice load predictions and performance monitoring, which other network functions could consume.
- Use of analytics for SMF selection TS 23.501CR0940
- Use of NWDAF analytics for decision of MICO mode parameters TS 23.501CR0837
- Use of analytics for user plane function selection TS 23.501CR0899
- Use of analytics for UE mobility procedures TS 23.501CR0900
- NEF service for NWDAF analytics TS 23.501CR0964
- CR for TS 23.501 Clarifications NWDAF Discovery and Selection TS 23.501CR0987
+ 41 more changes
In Release 17, NWDAF enhancements included new analytics applications such as using Redundant Transmission Experience analytics for URLLC services and extended UE Mobility analytics for LADN services. The release also expanded NWDAF's role in network slice management, enabling slice restriction and optimization based on its load predictions, and introduced procedures for NWDAF discovery and selection, including for model sharing and using provided ML models. Furthermore, it defined mechanisms for analytics exposure, allowing entities like the NSCE server to subscribe to NWDAF predictions via the NEF for network slice performance monitoring.
- Enchantments for supporting Supported Analytics Delay mechanism TS 23.501CR2530
- Network Slice restriction based on NWDAF analytics TS 23.501CR2567
- NWDAF discovery and selection TS 23.501CR2575
- NWDAF Discovery TS 23.501CR2577
- Adding the usage of Redundant Transmission Experience analytics for URLLC service TS 23.501CR2581
- Adding the usage of extended UE Mobility analytics for LADN service TS 23.501CR2582
+ 187 more changes
In Release 18, NWDAF enhancements focused on enabling analytics for roaming scenarios by introducing new NWDAF services and a reference point between NWDAFs, and on supporting federated learning through discovery and selection mechanisms for NWDAFs with that capability. The release also expanded NWDAF-assisted policy decisions, such as for URSPs (User Route Selection Policy), and extended its analytics exposure to functions like the PFDF (Policy and Charging Function Data Function) for application detection. Furthermore, NWDAF's registration information was extended to reflect new accuracy checking capabilities, and its data collection support was broadened for new analytics types like end-to-end data volume transfer time.
- Discovery and Selection of the NWDAF Supporting Federated Learning in 5GC TS 23.501CR3772
- NWDAF discovery principle enhancements for enhanced model sharing TS 23.501CR3783
- Discovery and selection of NWDAF with FL support - Resolve EN TS 23.501CR4070
- Using network analytics for roaming scenarios TS 23.501CR4080
- Update NEF to support NWDAF-assisted application detection TS 23.501CR4105
- Extension of NWDAF registration information to reflect new accuracy checking capability TS 23.501CR3764
+ 219 more changes
In Release 19, the NWDAF introduced new analytics capabilities including support for collision detection, location-related UE group analytics, and application layer AI/ML member capability analytics. It also expanded its scope with analytics for non-terrestrial access UE RAT connectivity, VAL performance for tethered UEs, and DN energy analytics. Furthermore, the release enhanced existing analytics for location accuracy, application performance, edge load, and slice usage patterns, while also defining new procedures for NWDAF model provision for AI positioning and updates to its discovery and selection parameters.
- Edge computing preparation analytics TS 23.436CR0030
- Support of Collision Detection Analytics TS 23.436CR0037
- Support of Location-related UE Group Analytics TS 23.436CR0038
- Support of Application Layer AI/ML Member capability Analytics TS 23.436CR0039
- UE RAT connectivity analytics for non terrestrial access TS 23.436CR0040
- Support for VAL performance analytics for tethered UEs TS 23.436CR0044
+ 89 more changes
In Release 20, key enhancements for NWDAF included new analytics for abnormal user plane traffic and traffic patterns, enabling policy control and mitigation actions based on these insights. The release also introduced support for monitoring the correctness of machine learning-enabled analytics. Furthermore, NWDAF's role was expanded to provide network slice load predictions to entities like the NSCE server, which can subscribe to these analytics via the Nnef_AnalyticsExposure_Subscribe service to trigger network slice optimization.
- Support monitoring ML-enabled analytics correctness TS 23.436CR0064
- Mitigation actions based on New Abnormal user plane traffic Analytics TS 23.501CR6507
- Policy control based on abnormal user plane traffic analytics and traffic pattern analytics TS 23.503CR1599
- Policy control based on new Abnormal User Plane Traffic Analytics TS 23.503CR1613
- Correction on QoS and policy assistance analytics TS 23.503CR1627
Explore further
Broader topics and technologies where NWDAF plays a role.
Defining Specifications
3GPP specifications that define or reference NWDAF, with the latest known release. Sourced from the 3GPP document catalog — see methodology.
| Specification | Title | Release |
|---|---|---|
| TS 23.435 vj30 | Network Slice Capability Exposure Procedures | Rel-19 |
| TS 23.436 vk00 | ADAEnabler Functional Architecture and Information Flows | Rel-20 |
| TS 23.482 vk00 | AIML Enablement Service Architecture | Rel-20 |
| TS 23.501 vk00 | 5G System Architecture Stage 2 | Rel-20 |
| TS 23.503 vk00 | 5G Policy and Charging Control Framework | Rel-20 |
| TS 23.700 vk00 | XR Services Application Enablement Layer | Rel-20 |
| TR 23.758 vh00 | Study on Edge Application Architecture | Rel-17 |
| TS 23.791 vg20 | NWDAF Data Collection & Analytics Framework | Rel-16 |
| TS 26.531 vj00 | Data Collection & Reporting Architecture for 5G | Rel-19 |
| TS 26.532 vj00 | 5G Data Collection and Reporting API Specification | Rel-19 |
| TS 26.804 vj10 | 5G Media Streaming Extensions Study | Rel-19 |
| TR 26.812 vi10 | Technical Report | Rel-18 |
| TR 26.941 vj01 | 5G Media Slicing Extensions | Rel-19 |
| TR 26.942 vj00 | Study on Media Energy Consumption Exposure & Evaluation | Rel-19 |
| TS 28.201 vj20 | 5G Network Slice Performance Analytics Charging | Rel-19 |
| TS 28.535 vj00 | Closed Control Loop Assurance Management | Rel-19 |
| TS 28.536 vj20 | Management services for communication service assurance | Rel-19 |
| TS 28.879 vj10 | OAM for Service Management Exposure Study | Rel-19 |
| TS 29.503 vj50 | UDM Service Based Interface Stage 3 | Rel-19 |
| TS 29.507 vj40 | 5G Access & Mobility Policy Control Service | Rel-19 |
| TS 29.508 vj40 | 5G Session Management Event Exposure Service | Rel-19 |
| TS 29.510 vj50 | NRF Service Based Interface Protocol | Rel-19 |
| TS 29.512 vj40 | 5G Session Management Policy Control Service | Rel-19 |
| TS 29.513 vj40 | 5G PCC Signalling Flows & QoS Mapping | Rel-19 |
| TS 29.514 vj40 | 5G System; Policy Authorization Service; Stage 3 | Rel-19 |
| TS 29.517 vj40 | 5G AF Event Exposure Service Stage 3 | Rel-19 |
| TS 29.518 vj50 | AMF Service Based Interface Protocol | Rel-19 |
| TS 29.520 vj40 | 5G Network Data Analytics Services Stage 3 | Rel-19 |
| TS 29.521 vj40 | 5G Binding Support Management Service Stage 3 | Rel-19 |
| TS 29.523 vj20 | 5G Policy Control Event Exposure Service | Rel-19 |
| TS 29.530 vj00 | AF AI/ML Services Stage 3 Protocol | Rel-19 |
| TS 29.536 vj30 | NSACF Service Based Interface Protocol | Rel-19 |
| TS 29.543 vj20 | 5G Data Transfer Policy Control Services Stage 3 | Rel-19 |
| TS 29.551 vj30 | 5G PFD Management Service Stage 3 | Rel-19 |
| TS 29.552 vj40 | 5G Network Data Analytics Signalling Flows | Rel-19 |
| TS 29.554 vj10 | 5G Background Data Transfer Policy Control Service | Rel-19 |
| TS 29.562 vj40 | HSS Services for IMS & GBA Interworking | Rel-19 |
| TS 29.564 vj50 | Nupf Service Based Interface Protocol | Rel-19 |
| TS 29.574 vj40 | 5G Data Collection Coordination Services Stage 3 | Rel-19 |
| TS 29.575 vj40 | 5G Analytics Data Repository Services Stage 3 | Rel-19 |
| TS 29.576 vj40 | 5G Messaging Framework Adaptor Services Stage 3 | Rel-19 |
| TS 29.591 vj40 | 5G NEF Southbound Services Stage 3 | Rel-19 |
| TS 29.889 vj10 | Study on UPF data collection for AI/ML | Rel-19 |
| TS 29.890 vg00 | CT3 5G System Technical Report | Rel-16 |
| TS 32.240 vj40 | Charging Management Architecture & Principles | Rel-19 |
| TR 32.847 vi00 | Technical Report | Rel-18 |
| TS 33.127 vj50 | Lawful Interception Architecture and Functions | Rel-19 |
| TS 33.794 vj10 | Study on Zero Trust Security Enablers for 5G | Rel-19 |
| TR 33.866 vh00 | Security aspects of Network Automation enablers for 5GS | Rel-17 |
| TR 33.867 vh10 | User Consent for 3GPP Services | Rel-17 |