Scalable Context-Aware Graph Attention for Unsupervised Anomaly Detection in Large-Scale Mobile Networks
arXiv:2605.00482v1 [cs.LG] 1 May 2026
Sara Malacarne1 , Eirik Hoel-Høiseth1 , Erlend Aune3,5 , David Zsolt Biró2 , Massimiliano Ruocco3,4 1- Telenor Research and Innovation, Norway 2- Telenor Denmark OSS & Tech Analytics, Denmark 3- Norwegian University of Science and Technology (NTNU), Norway 4- SINTEF Digital, Norway 5- Hance, Norway
Abstract—Mobile network operators must monitor thousands of heterogeneous network elements across the radio access network and the packet core, each exposing high-dimensional KPI time series. The scale and cost of incident labelling make supervised approaches impractical, motivating unsupervised anomaly detection robust to context shifts and nonstationarity. We propose C-MTAD-GAT (Context-aware Multivariate Timeseries Anomaly Detection with Graph Attention), an anomaly detection framework designed to operate as a single shared model across large populations of network elements. The model combines temporal and feature-wise graph attention with lightweight static and dynamic context conditioning and a dual-head decoder for reconstruction and multi-step forecasting. It produces perelement, per-feature anomaly scores, converted to alerts via fully unsupervised thresholds calibrated from validation residuals. On the TELCO dataset released with DC-VAE [1], C-MTADGAT improves event-level affiliation and pointwise F1 while generating fewer alarms than prior graph-attention and VAEbased baselines. We then apply the same system to nation-scale radio access and evolved packet core control-plane counter data from a mobile network operator, where it is deployed. Operator feedback indicates the alerts are actionable and support daily monitoring, showing scalability across domains without relying on labelled incidents.
I. I NTRODUCTION Modern mobile networks are monitored through thousands of Key Performance Indicators (KPIs) collected from heterogeneous network elements (NEs) across multiple layers, including the Radio Access Network (RAN) and the Evolved Packet Core (EPC). Detecting abnormal behaviour early is operationally critical, but remains challenging because deviations can be subtle, distributed, and context-dependent. Three constraints make this setting challenging. First, KPI streams are high-dimensional, temporally dependent, and interdependent: a single fault may manifest as correlated deviations across multiple KPIs and NEs. Second, groundtruth labels are expensive to obtain and intrinsically hard to standardise, so anomaly detection (AD) must be largely unsupervised. Third, national networks involve thousands This work was supported by the Norwegian Research Council projects ML4ITS (312062) and SFI NorwAI (309834).
of NEs and hundreds of KPIs, making one-detector-per-NE approaches operationally infeasible; operators instead need centralised models, i.e., single-model-per-domain, that scale across heterogeneous NEs while remaining compact and easy to retrain. At this scale, AD is fundamentally a systems problem: beyond detection accuracy, operators must address model centralisation, retraining cost, inference stability, and alertvolume control under heterogeneous network configurations. Most deep unsupervised AD methods detect anomalies via reconstruction or forecasting residuals, but operational deployments add further requirements: heterogeneity across NEs, metadata-driven context shifts (e.g., site configuration), and calibration without labels. Graph-attention-based models have proven effective at capturing inter-variable dependencies in multivariate time series. However, prior work largely focuses on modelling accuracy and rarely addresses how such models can be operated as unified, deployment-oriented systems that support centralised training at scale, systematic use of contextual metadata, and fully unsupervised calibration. Representative examples include MTAD-GAT [2]. In this work, we take a unified view across three settings: (i) the public TELCO benchmark with per-KPI labels; (ii) a large RAN dataset from a national 4G / LTE (Long-Term Evolution) network with thousands of sectors and rich context; and (iii) EPC control-plane counter data from virtualised core gateway units, where the system is currently deployed in the EPC. These settings share multivariate KPI time series but differ in labelling, dimensionality, and heterogeneity; we therefore target a single architecture and a fully unsupervised calibration protocol that transfer across them. We propose C-MTAD-GAT, a centralised context-aware graph-attention model that injects static and dynamic metadata via lightweight context conditioning. The model produces perNE, per-feature anomaly scores, with thresholds estimated from validation errors only. Contributions. • Centralised AD system: We introduce C-MTAD-GAT, a context-aware graph-attention-based system that enables a single shared anomaly detection model to operate across thousands of heterogeneous telecom network elements.
Calibration: We present a domain-agnostic calibration AD performance is sensitive to the end-to-end configuration protocol based solely on validation errors. (preprocessing, scoring, aggregation, thresholding), motivating • Multi-domain validation: We evaluate on TELCO, large- automated selection and calibration pipelines such as AutoTscale RAN, and EPC control-plane datasets and report SAD (PVLDB) [11]. These works highlight that calibration is deployment and human-in-the-loop considerations from a not an implementation detail but a first-class design choice for live EPC deployment. deployable AD systems. d) Telecom-oriented studies and remaining gaps: Telecom • Scalability: We analyse scaling with the training populamonitoring introduces operator-specific constraints, including tion size and characterise the stability of anomaly scores high dimensionality, heterogeneous NEs, frequent regime as the number of NEs increases toward operator scale. shifts, and scarce or inconsistent incident labels. Prior work spans lightweight fault-management pipelines based on alarm II. BACKGROUND AND S TATE OF THE A RT correlation and rule-based reasoning in network operations [12], This section summarises deep unsupervised AD for multi- classical machine-learning ensembles [13], transformer-based variate time series, with emphasis on (i) residual-based scoring, forecasting with adaptive thresholding [14], and multi-scale (ii) dependency modelling across variables and time, and (iii) deep generative models such as dilated-convolutional VAEs converting continuous scores into operational alerts without [1]. However, fewer studies address the combined requirements reliable labels. typical of operator deployments: (i) centralised training across a) Deep unsupervised multivariate time series AD: large, heterogeneous NE populations, (ii) systematic use of Most deep unsupervised time series AD approaches learn operational side-information (context/exogenous covariates) to a model of normal dynamics and score anomalies through stabilise a single shared model, and (iii) alert calibration that deviations, typically via reconstruction and/or forecasting is label-free yet produces actionable alarm volumes. These residuals. Classical deep baselines include sequence autoen- gaps motivate our context-aware, centralised design and the coders and encoder–decoder models [3], variational approaches evaluation across TELCO, RAN and EPC domains. such as OmniAnomaly [4], and GAN-based variants [5]. III. P ROBLEM SETUP AND NOTATION More recent work has increasingly relied on attention and We observe network elements (NEs) indexed by n ∈ transformer-style backbones to capture long-range temporal structure and complex cross-variable interactions, e.g., anomaly {1, . . . , N }. For each NE n we have a k-variate KPI time scoring via attention discrepancy in Anomaly Transformer series Xn = {xn1 , . . . , xnT } with xnt ∈ Rk . Optionally, each [6] and contrastive dual-attention designs such as DCdetector NE has static metadata sn (time-invariant) and time-aligned [7]. In addition, decomposition-guided designs have been context ztn (Sec. V). We use inclusive slices: xna:b := (xna , xna+1 , . . . , xnb ), so proposed for online AD and forecasting (e.g., OneShotSTL in n PVLDB) [8]. In practice, these backbones produce real-valued |xa:b | = b − a + 1. For window length L and forecast horizon anomaly scores; downstream alert quality depends heavily on H, define the KPI window and aligned context at time t by aggregation and thresholding choices, not only on architecture. X n L×k n n , Ct−L+1:t := sn , zt−L+1:t ∈ S×RL×d . t−L+1:t ∈ R b) Modelling dependencies across variables and time: In A centralised detector gθ is trained on windows pooled multivariate telemetry, anomalies often manifest as correlated n across NEs and outputs a reconstruction X̃t−L+1:t and an Hdeviations across subsets of KPIs. A large class of methods n c therefore explicitly models dependencies, either through learned step forecast Xt+1:t+H . From these we compute per-feature attention or graph structure. Graph-based approaches can treat residuals and an anomaly score ent ∈ Rk given by the weighted KPIs as nodes and learn inter-variable relations; MTAD-GAT is combination of reconstruction/forecast errors. We report both a representative example that couples temporal modelling with real-valued scores and binary decisions ytn = 1{ent > τ n } ∈ feature-wise graph attention for multivariate time series AD [2]. {0, 1}k , where τ n is estimated in an unsupervised manner Recent work further strengthens this direction with correlation- (Sec. VI-B) from validation residuals, per NE and feature. L aware spatial–temporal graph learning [9]. Transformer-based and H are fixed within a domain (TELCO, RAN, EPC) and methods can capture dependencies implicitly through self- time splits are strictly time-ordered. attention [6], often improving performance when interactions IV. DATASETS are non-local in time. A. TELCO Dataset – Public Benchmark c) Score calibration and alerting without labels: A core operational step is turning continuous scores into discrete TELCO (TELeCOmmunication-networks) is a multivariate alerts under limited or absent ground truth. Common strategies time series dataset from a live production mobile network [1]. include parametric thresholds under simple error models (e.g., It provides k=12 KPIs (TS1–TS12) at 5-minute cadence over Gaussian/z-score rules based on mean and standard deviation), seven months (Jan 1–Jul 31, 2021), with per-series anomalous robust statistics (e.g., median-based rules and median absolute events manually labelled by Network Operation Centre (NOC) deviation), and tail modelling via Extreme Value Theory (EVT). experts. We follow the original time-ordered split into train, A widely used EVT baseline is Peaks-Over-Threshold (POT) validation and test sets. Anomalies are rare: on the test period and its streaming variants (SPOT/DSPOT), which fit a tail there are 25 143 timestamps per series and 3 001 anomalous model to score exceedances above a high threshold [10]. More labels in total (≈ 1% positives), with per-KPI event counts recently, the community has also emphasised that time series between 1 and 35. •
2
TABLE I: Selected features used for AD in the RAN dataset. Acronyms: CS/PS = circuit-/packet-switched; PRB = physical resource block; RRC = radio resource control; UE = user equipment, IMSI = International Mobile Subscriber Identity.
TABLE II: Selected features used for AD in the EPC dataset. Acronyms: PGW = packet data network gateway; PDP = packet data protocol; QCI = QoS class identifier. Type
Description Selected dynamic real-valued variables Real PGW PDP-creation failure rate Real Number of PGW PDP-creation rejects Real Number of session-creation rejects Real Number of bearer-modification failures Real Number of session-deletion rejects Real Number of idle-timeout closes Real Number of error-indication messages Real Mean disconnect latency Real Bearer-setup failures (QCI 9) Categorical variables Dynamic Day of week [0–6; 0=Mon] Dynamic Weekend flag (1=yes) Dynamic Hour of day [0–23] Dynamic Minute bucket [0–59]
Type
Description Selected dynamic real-valued variables Real Duration the cell was available during the hour Real Number of CS related drops Real Call setup failure rate for CS traffic Real Number of PS related drops Real Data setup failure rate Real Downlink cell throughput Real Uplink cell throughput Real Downlink traffic volume (GB) Real Uplink traffic volume (GB) Real PRB load in downlink Real Average number of RRC connected UEs Real Maximum number of RRC connected UEs Real Count of transmission-network-affected IMSIs Static real-valued variables Real Sector latitude and longitude Real Sector-level mean and standard deviation statistics per KPI Categorical variables Static Encoded sector identifier Dynamic Day of week [0–6; 0=Mon] Dynamic Weekend flag (1=yes) Dynamic Hour of day [0–23] Dynamic Missing-value flag for PS denominator Dynamic Missing-value flag for CS denominator
V. C OMMON PREPROCESSING
Our input consists of both real-valued and categorical data. Incorporating both real and categorical features allows us to effectively differentiate between network equipment while simultaneously processing all data. We differentiate between four types of data per NE n and time t: n k • Dynamic real – xt ∈ R , time-variant KPIs, such as voice/data traffic load, handovers, and error counters. B. RAN Dataset – Real data from a National MNO n • Dynamic categorical – zt , time-variant categorical flags The dataset comes from a national mobile network operator such as day of the week, hour, and missingness indicators. (MNO) and covers the RAN, which connects user devices to the n • Static real – r , time-invariant real-valued input such as EPC via sectorised base stations. In the operator network under fixed equipment specifications, GPS coordinates or feature study, there are approximately 4 000 base stations, typically means and standard deviations (stds). split into three 120◦ sectors, yielding O(104 ) sectors. We treat n • Static categorical – s , time-invariant categorical input each sector as one monitored unit and aggregate KPIs at sector such as sector, site, technology, frequency band. level, i.e., one multivariate KPI time series per sector. n n We form a context vector Ct−L+1:t = (sn , zt−L+1:t ) that will Sectors are additionally grouped into coarser local areas, later condition the model (Sec. VI). operationally defined geographical clusters of nearby sectors, a) Timeline alignment and splits: We retain the native represented by the local_area field. Data are sampled sampling cadence of each domain (TELCO/EPC: 5 min; RAN: hourly and include throughput, drop/setup failure rates, han60 min). To ensure sufficient temporal context, we apply dover success, physical resource block (PRB) load, traffic training-time eligibility filters: NEs with excessive missingness volumes, and related counters. Alongside dynamic real-valued in the dynamic real KPIs (configurable; default 10%) or KPIs, we use dynamic categorical context (e.g., hour of day, insufficient history to support windowing are excluded from day of week/weekend, missingness flags) and static identifiers scaler/encoder fitting and from training. The minimum history (e.g., sector and site IDs; optional vendor and band). requirement is derived from (L, H) by requiring at least two Experiments monitor around 12 000 sectors using windows non-overlapping windows in each non-empty split. of L=48 input steps and H=8 forecast steps. Representative b) Missing values: From the raw dynamic reals we variables are listed in Table I. Anomalies in the RAN are compute a per-feature missingness mask mnt ∈ {0, 1}k and unlabelled; evaluation relies on expert validation (Sec. VII). append it as dynamic categorical indicators, so the model observes both the filled signal and explicit missingness. We then fill remaining nulls with 0 (for categoricals, the null C. EPC Dataset – Real data from a National MNO is mapped to a dedicated token). No interpolation or gapdependent imputation is used. Control-plane counters and KPIs from the EPC gateway units c) Categorical encoding: Static and dynamic categoricals are collected at 5-minute cadence across two hosts of Packet are ordinal-encoded into Z≥0 using a single encoder fit once Data Network Gateway (PGW). Each record contains 205 per dataset.1 In the model, categorical variables are mapped to dynamic real-valued counters covering session creation, bearer learnable embeddings (Sec. VI). modification (including VoLTE call sessions), failures, timeouts, d) Scaling: Dynamic real KPIs are min–max scaled per and latencies, plus 4 dynamic categorical time features (day NE and per feature using train-split statistics, with a zero-range of the week, weekend, hour of the day, minutes of the hour). Selected variables are shown in Table II. Also this domain is 1 For deployment this avoids refitting encoders when labels are unavailable; unlabelled; evaluation relies on expert validation (Sec. VII). for benchmarking one could fit on train only. 3
guard. Static real attributes are scaled globally across NEs using TABLE III: Per-domain data and training configuration for C-MTAD-GAT: window length L, forecast horizon H, stride S, batch size B, and maximum the same scheme. epochs E used for TELCO, RAN and EPC. e) Windowing and time splits: From each NE series we Domain L H S B E γ extract sliding windows Wtn ∈ RL×k with forecast horizon H RAN 24 7 17 100 30 1 and stride S, choosing valid start times so that t+L+H−1 lies EPC 101 53 89 30 200 1 TELCO 577 257 31 30 150 1 within the series. Splits are strictly time-ordered (contiguous blocks) to avoid temporal leakage and to mirror deployment. For RAN and EPC, the last 20% of each NE timeline is reserved TABLE IV: Optimal Optuna-tuned architecture hyperparameters for C-MTADfor test and the remaining 80% is split into train/val with an GAT on TELCO, RAN and EPC, including kernel sizes, GRU dimensions, layer widths and dropout rates. 80/20 ratio. For the TELCO dataset we use the predefined Parameter RAN EPC TELCO splits provided with the dataset. Windows are assigned to Kernel size (1D conv) 4 4 18 splits by time and we only keep windows whose full input Use GATv2 True True True GRU layers 1 1 1 and forecast target lie entirely within the same split (i.e., no GRU hidden dim 580 780 820 window crosses a split boundary). Each window is paired with Forecasting layers 3 1 4 Forecast hidden dim 400 350 150 its aligned context cnt and an H-step forecast target. Reconstruction layers Reconstruction hidden dim Dropout Init. learning rate
VI. M ETHOD A. Model architecture Given windowed KPI inputs Wtn and aligned context Ctn (Sec. III–V), C-MTAD-GAT extends MTAD-GAT with (i) lightweight context conditioning, (ii) dynamic graph attention (GATv2), and (iii) dual forecasting and reconstruction heads. For each domain (TELCO, RAN, EPC) we train a single centralised model whose parameters are shared across all network elements (NEs), while static and dynamic metadata modulate the shared backbone (Fig. 1). a) Context conditioning: We embed categorical metadata (static and dynamic) with learnable embeddings and project continuous static attributes (when available) to the same latent space. These context representations condition the early temporal feature extractor by modulating intermediate activations (a FiLM [15]/conditional-convolution style mechanism), allowing the shared model to adapt to systematic differences across heterogeneous NEs (e.g., sector, band, vendor, site) without training per-NE detectors. b) Dependency modelling via graph attention: From the context-conditioned temporal features, we form two attentionenhanced views as in MTAD-GAT [2]: (i) a feature-attention module that treats KPI dimensions as nodes and learns intervariable dependencies (spatial graph attention), and (ii) a temporal-attention module that treats timesteps as nodes and learns temporal dependencies (temporal graph attention). We replace the original GAT layers with GATv2 [16], where attention coefficients are a function of both source and target node representations, improving expressiveness in directional and context-sensitive interactions. Outputs from temporal features, feature attention, and temporal attention are fused into a shared sequence representation. c) Sequence encoder and dual decoders: A GRU encoder aggregates the fused representation over the window into a latent state. From this state we produce two outputs: (i) a non-autoregressive multi-step forecasting head that predicts the next H steps for all KPIs in one forward pass, and (ii) a deterministic GRU autoencoder head that reconstructs the input window. Compared to MTAD-GAT’s VAE head, the deterministic reconstruction avoids sampling noise and KLweight sensitivity, which we found to be important for stable training and calibration in telecom monitoring.
1 400 0.07 2.487 × 10−4
5 800 0.10 2.488 × 10−4
1 150 0.04 1.728 × 10−4
d) Training objective and optimisation: We train on sliding windows under the standard assumption that anomalies are rare. The objective is a weighted sum of forecasting and reconstruction losses (RMSE): L = Lforecast + γ Lrecon , with γ fixed per experiment. Optimisation uses Adam with early stopping on validation loss. Domain-specific settings (window length L, horizon H, stride S, batch size B, epochs E) are in Tab. III, and Optuna-tuned architecture hyperparameters are in Tab. IV. B. Unsupervised anomaly scoring and calibration Our operational goal is fully label-free alerting: thresholds are derived from validation residuals only (no tuning on incident labels), with per-(NE, feature) flexibility and a simple, explainable rule. For each NE n, feature f , and timestamp t, we compute a nonnegative error by combining forecasting and reconstruction residuals (equal weight in our experiments): rec en,f,t = 12 efor n,f,t + en,f,t . For each (NE, feature) pair we fit a simple parametric model to validation errors and set a threshold as a high quantile. Concretely, we model {en,f,t }t∈VAL with an exponential distribution Exp(θn,f ), whose MLE scale is the sample mean θ̂n,f . Given a target tail probability p (fixed per domain), the threshold is τfn = −θ̂n,f ln(1 − p). We flag anomalies when en,f,t > τfn . This yields a transparent calibration mechanism with a single interpretable knob (p) that controls alarm volume consistently across datasets. a) Distributional sanity checks: We validate the exponential-tail assumption by comparing it to Gamma fits per (NE, feature) using likelihood-based criteria (LRT/AIC) and out-of-sample log-likelihood on held-out data. While Gamma can provide slightly heavier tails on RAN, the added complexity 4
Fig. 1: Architecture of C-MTAD-GAT for contextual and numerical input data.
For each feature f , consecutive positive timestamps are merged into events: ground-truth Gf = {gkf } and predictions Pf = {pfℓ }, where each event is a time interval. For any g and p we define the intersection-over-union (IoU)
yields limited practical benefit relative to the simplicity and operational stability of the exponential calibration; therefore we use the exponential model in all reported results. For completeness, we also compare against EVT-style peaks-overthreshold calibration on TELCO in Sec. VIII-A.
IoU(g, p) =
|g ∩ p| , |g ∪ p|
VII. E VALUATION Evaluating AD in telecom networks is challenging: anomalies with | · | denoting duration. Each predicted event p ∈ Pf rarely have a clear start or end point, may affect only a subset is affiliated to the ground-truth event arg maxg∈Gf IoU(g, p). of KPIs with time lags across features, and labels are often We count a true positive (TP) if maxg∈Gf IoU(g, p) > 0, subjective or incomplete. In practice there is also a tension otherwise a false positive (FP); any g ∈ Gf not overlapped by between early detection (operationally valuable but prone to any p ∈ Pf is a false negative (FN). Event-level P, R and F1 false alarms) and full anomaly coverage (useful for post-mortem are then computed in the usual way. Affiliation metrics are intentionally forgiving: on TELCO a analysis but sometimes too late for mitigation). We therefore trivial detector that flags every timestamp as anomalous still use different strategies depending on the available supervision: attains per-feature affiliation F1 around 0.67–0.68. Affiliation event-level metrics on the TELCO benchmark, and expertscores must therefore be interpreted together with stricter guided evaluation on RAN and EPC. pointwise metrics and the Random baseline to avoid overcrediting overly active detectors. A. TELCO benchmark: metrics and setup c) Aggregation: Macro, Micro and Union: We summarise On the TELCO open benchmark we can use labelled TELCO performance in three complementary ways: anomalies and therefore adopt standard quantitative metrics. We • Macro: compute (Pf , Rf , F1f ) separately for each KPI compare C-MTAD-GAT to three strong baselines: MTAD-GAT, f and report the unweighted average across features. This DC-VAE (dilated-convolutional VAE, the strongest published treats all KPIs equally, regardless of their frequency or TELCO baseline), and a β-MTAD-GAT variant with downnumber of events. weighted KL term (β=0.2). All models are trained on the • Micro: first pool TP/FP/FN counts across all features, same TELCO splits and use the same label-free per-feature then compute precision, recall and F1 from these global thresholds on validation errors, as described in Subsec. VI-B; totals. Micro scores therefore emphasise KPIs with many TELCO labels are reserved for evaluation only. events. a) Pointwise timestamp-level metrics: For each KPI f we • Union: take a logical OR across features at each timestamp turn scores into binary timestamp labels and compute precision to form single ground-truth and predicted streams, then (P), recall (R), and F1 at the timestamp level. Because TELCO apply the same pointwise or event-affiliation rules. Union is highly imbalanced, we also report a prevalence-matched scores capture “at least one KPI in trouble” behaviour, Random baseline: for each KPI, Random flags each timestamp which is closer to how operators perceive incidents. as anomalous with probability equal to that KPI’s empirical anomaly prevalence. This provides a natural floor: any useful model should substantially outperform this baseline, even if B. RAN and EPC: expert-centred evaluation In operational RAN and EPC environments we do not have the resulting F1 scores look numerically small. b) Event-wise affiliation: Pointwise metrics are strict: dense, reliable anomaly labels. Many statistically significant missing a few timestamps in a long incident heavily penalises deviations are expected (e.g., traffic spikes during events) and recall. To better reflect incident-level performance, we also not business anomalies, while some subtle degradations are report event-level affiliation scores following [17]. only evident in hindsight via trouble tickets or configuration 5
C-MTAD-GAT β-MTAD-GAT MTAD-GAT DC-VAE changes. For these domains we therefore combine quantitative Feature GT Pred F1 Pred F1 Pred F1 Pred F1 proxies with qualitative expert assessment. T1 20 6 0.445 1 0.095 0 0.000 19 0.538 Quantitatively, we track validation forecast and reconstrucT2 35 18 0.554 3 0.142 0 0.000 59 0.599 tion loss across seeds and domains (Fig. 2). Lower, more T3 7 36 0.573 28 0.584 14 0.590 33 0.579 T4 8 71 0.724 62 0.744 12 0.708 79 0.678 stable losses indicate that the model better captures normal 0.552 8 0.521 4 0.415 12 0.621 T5 8 15 dynamics and typically correlate with smoother residuals and T6 7 15 0.802 10 0.814 1 0.249 31 0.844 T7 10 101 0.734 73 0.709 2 0.206 178 0.683 fewer spurious alerts. Qualitatively, we inspect time series, 0.819 19 0.773 1 0.222 34 0.773 T8 8 25 residuals, and alert timelines for a curated set of NEs and T9 17 125 0.656 128 0.693 93 0.611 125 0.655 T10 19 31 0.487 29 0.426 3 0.079 34 0.468 periods, in collaboration with network operations experts. 0.772 40 0.765 15 0.715 60 0.636 T11 3 50 Anomalies are considered useful if they (i) coincide with T12 1 10 0.632 28 0.614 4 0.658 49 0.553 periods of degraded performance, (ii) triggered or would TABLE V: TELCO — Affiliation (event-level) F1 per feature. Leftmost GT plausibly trigger investigations or corrective actions, or (iii) = ground-truth events per feature. Each model block shows Pred (predicted align with known incidents or configuration changes. This events). Best is bold; second-best is shaded. expert-centred validation reflects how AD is actually consumed in telecom operations and complements the benchmark-style TELCO metrics in Sec. VII-A. balanced precision–recall profile: recall remains close to DC-VAE’s while precision is higher, yielding better F1 and VIII. R ESULTS AND D ISCUSSION fewer alarms. On the union stream, our model raises far We report results on three settings: the public TELCO benchfewer incident windows than DC-VAE while maintaining mark, large-scale RAN and EPC datasets from a a national a higher F1, reducing the number of alarms that operators MNO, and qualitative case studies from live deployments. must inspect in daily operations. Per-feature scores in On TELCO, C-MTAD-GAT is compared against MTAD-GAT, Table V show that these gains are distributed across KPIs a β-MTAD-GAT variant, and the Telco-specific DC-VAE rather than driven by a single outlier feature. under identical unsupervised calibration, using both event-level • Pointwise timestamp-level. Pointwise F1 scores in Ta(affiliation) and timestamp-level (pointwise) metrics. On RAN ble VIII are lower in absolute value, as expected under and EPC we analyse validation losses across multiple seeds, severe imbalance, but they act as a useful counterweight ablate architectural choices (GAT vs. GATv2, context blocks, to affiliation. C-MTAD-GAT achieves the best Macro and AE vs. VAE head), and study how performance scales with Union pointwise F1 and matches DC-VAE on Micro F1, the number of network elements (NEs). Finally, we discuss while firing fewer positives than both DC-VAE and the operational feedback and incident case studies illustrating how prevalence-matched Random baseline. The Random row the model behaves in production. illustrates that even moderate-looking F1 values correspond to clear gains over chance. Per-feature pointwise scores in Table VII confirm that improvements are spread A. TELCO benchmark: quantitative comparison over multiple KPIs rather than isolated to a few “easy” We first evaluate C-MTAD-GAT on the public TELCO ones. dataset, comparing it to MTAD-GAT, a β-MTAD-GAT variant • Backbone choice and robustness. The VAE-based with down-weighted KL, and the TELCO-specific DC-VAE MTAD-GAT variants require careful tuning of the KL baseline. All models use the same train/validation/test splits weight and additional regularisation tricks, and still and the same unsupervised calibration protocol (per-feature underperform the simpler GRU-AE head in C-MTADthresholds derived from validation errors, without tuning on GAT under the same unsupervised calibration. Standalone TELCO labels; cf. Secs. VI–VII). Architecturally, C-MTADVAE variants (without graph attention; not shown) exhibGAT replaces MTAD-GAT’s GAT by GATv2, injects context ited similar sensitivity: performance degraded markedly via conditional convolutions, and uses a deterministic GRU away from hand-tuned settings, which is problematic reconstruction head without KL regularisation. in monitoring pipelines that must be retrained regularly Tables V and VII report per-KPI F1 scores for event-level afunder resource and reliability constraints. In contrast, filiation and timestamp-level pointwise evaluation, respectively. the deterministic GRU-AE backbone was robust: even The corresponding Macro/Micro/Union aggregations, together non–fully optimised hyperparameters yielded competitive with the number of predicted events/timestamps, are shown performance, which is crucial in large-scale operations. in Tables VI and VIII. As discussed in Sec. VII-A, affiliation • Thresholding robustness (POT vs. simple tails). For scores are more forgiving and can be inflated by trivially overMTAD-GAT on TELCO we also compared our simactive detectors; they must therefore be interpreted together ple validation-based thresholds against POT/SPOT-style with stricter pointwise metrics. extreme-value tails (Table IX). In almost all KPIs, the • Affiliation event-level. Across Macro/Micro/Union aggresimpler per-feature thresholds derived from the fitted error gations in Table VI, C-MTAD-GAT attains the highest distribution yielded higher or comparable F1 while being affiliation F1, with DC-VAE consistently second. βeasier to deploy and maintain. This supports our choice MTAD-GAT achieves higher precision but substantially of using a light-weight distributional model for errors and lower recall, while MTAD-GAT is even more conservative rejecting POT/SPOT-style tails in the production setting. and misses many incidents. C-MTAD-GAT offers a more
6
(a) Validation forecast loss.
(b) Validation reconstruction loss.
Fig. 2: RAN vs. EPC. Left curves in each panel: RAN; right: EPC. Curves compare MTAD-GAT (baseline) and C-MTAD-GAT (ours). Mean across seeds with shaded ±1 sd; last-epoch whisker shown when n ≥ 2. Lower is better.
Macro Model
P
R
Micro F1
P
R
Union F1
P
R
Macro Model
F1
DC-VAE 0.644 0.682 0.663 0.694 0.589 0.637 0.561 0.798 0.659 MTAD-GAT 0.589 0.339 0.430 0.412 0.201 0.270 0.601 0.446 0.512 β-MTAD-GAT 0.716 0.591 0.647 0.793 0.420 0.549 0.549 0.674 0.605
Random DC-VAE MTAD-GAT β-MTAD-GAT
C-MTAD-GAT 0.707 0.673 0.690 0.781 0.544 0.641 0.582 0.776 0.665
C-MTAD-GAT β-MTAD-GAT MTAD-GAT
DC-VAE
F1
Pred
F1
Pred
F1
Pred
F1
T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 T11 T12
0.029 0.143 0.019 0.156 0.268 0.300 0.115 0.164 0.030 0.027 0.043 0.035
2 4 53 80 28 23 102 40 479 90 177 131
0.010 0.016 0.021 0.154 0.299 0.262 0.119 0.159 0.033 0.024 0.030 0.000
0 0 25 14 12 1 4 1 341 9 51 18
0.000 0.000 0.025 0.052 0.186 0.019 0.025 0.008 0.024 0.000 0.083 0.000
21 107 58 99 35 60 231 70 447 91 171 92
0.055 0.115 0.020 0.165 0.284 0.251 0.103 0.156 0.036 0.010 0.063 0.000
412 501 138 179 106 107 235 237 561 489 21 15
7 46 71 91 43 33 129 55 453 93 210 158
R
Micro F1
P
Union
R
F1
P
R
F1
0.010 0.010 0.010 0.015 0.015 0.015 0.047 0.113 0.067 0.220 0.096 0.134 0.127 0.063 0.084 0.103 0.110 0.107 0.350 0.028 0.052 0.078 0.012 0.021 0.112 0.042 0.061 0.385 0.071 0.120 0.111 0.045 0.064 0.097 0.081 0.088
C-MTAD-GAT 0.319 0.107 0.160 0.133 0.062 0.084 0.117 0.115 0.116
TABLE VI: TELCO — Aggregated Affiliation scores. Best is bold; secondbest is shaded. Event Counts. Micro: Ground Truth (GT)=143, MTADGAT=149, β-MTAD-GAT=429, DC-VAE=713, C-MTAD-GAT=503. Union: GT=70, MTAD-GAT=133, β-MTAD-GAT=337, DC-VAE=567, C-MTADGAT=389.
Feature GT Pred
P
TABLE VIII: TELCO — Aggregated Pointwise scores. Best is bold; secondbest is shaded. Timestamp Counts. Micro: Ground Truth (GT)= 3001, Random=3001, DC-VAE=1482, MTAD-GAT=476, β-MTAD-GAT=1209, CMTAD-GAT=1389. Union: GT= 1186, Random=2850, DC-VAE=1268, MTAD-GAT=445, β-MTAD-GAT=991, C-MTAD-GAT=1163.
πf
TABLE IX: Telco results: per-feature precision (P), recall (R), and F1 for MTAD-GAT comparing the Exponential Mean-Std thresholding vs POT thresholding. Bold marks the higher value per row/metric.
0.016 0.020 0.005 0.007 0.004 0.004 0.009 0.009 0.022 0.019 0.001 0.001
POT-threshold
TABLE VII: TELCO — Pointwise F1 per feature. Leftmost GT = groundtruth events per feature. Each model block shows Pred (predicted timestamps). Best is bold; second-best is shaded.
B. RAN and EPC datasets: quantitative ablations We evaluate C-MTAD-GAT and ablations on nation-wide RAN and EPC datasets. For each configuration and seed, we log validation forecasting and reconstruction losses at every epoch and retain the minimum over epochs of each metric; tables report mean ± standard deviation of these per-seed minima across seeds. We treat C-MTAD-GAT (AE, ctx) as the fixed operational baseline (the deployed model), where AE denotes a deterministic GRU autoencoder reconstruction head (no KL term) and ctx denotes full context injection into both temporal convolution blocks. Row names in Tables X–XI vary three factors: (i) backbone/attention (MTAD-GAT: GAT; C-MTADGAT: GATv2), (ii) reconstruction head (AE vs VAE with KL regularisation), and (iii) context injection. Legend: no ctx disables context; ctx@block1/2 injects context only into the first/second temporal convolution block; and ctx injects context into both blocks. For EPC, static metadata are not available,
Exp-threshold
Feature
P
R
F1
P
R
F1
TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS8 TS9 TS10 TS11 TS12
0.684 0.372 0.649 0.682 0.486 0.648 0.553 0.603 0.402 0.514 0.386 0.374
0.180 0.130 0.756 0.518 0.547 0.389 0.383 0.643 0.396 0.221 0.743 0.524
0.285 0.193 0.698 0.589 0.514 0.486 0.452 0.622 0.399 0.309 0.508 0.437
1.000 1.000 0.627 0.690 0.759 0.886 0.685 0.957 0.654 0.622 0.651 0.626
0.050 0.076 0.647 0.962 0.410 0.714 0.766 0.640 0.723 0.288 0.908 0.683
0.095 0.142 0.637 0.803 0.533 0.791 0.723 0.767 0.687 0.394 0.759 0.653
Macro Micro Union
0.529 0.515 0.589
0.452 0.333 0.477
0.488 0.405 0.527
0.763 0.817 0.550
0.572 0.412 0.653
0.654 0.548 0.597
hence ctx always refers to dynamic time-related categoricals (e.g., hour/weekday and missingness flags), and variants that differ only in static-context wiring become effectively identical. • Absolute vs. baseline performance. Tables X and XI report absolute validation minima (lower is better). To quantify robustness across seeds, Tables XII and XIII report differences to the fixed baseline on val_loss|min: ∆ = Other − Baseline (absolute and percent), paired twosided t-test p-values adjusted for multiple comparisons using the Benjamini–Hochberg false discovery rate (BH– FDR; reported as padj ), and Cohen’s d computed on paired differences (negative values favour the baseline). Figure 3 visualises the same baseline-referenced comparisons. • EPC. On EPC, moving from MTAD-GAT (GAT) to C– MTAD-GAT (GATv2) with an AE head yields a modest 7
TABLE X: EPC ablation on validation forecasting and reconstruction loss (mean ± SD of per-seed minima; lower is better). Best is bold, second-best is shaded. Configuration
val_forecast_loss
val_recon_loss
MTAD-GAT (VAE, no ctx) MTAD-GAT (AE, no ctx) C-MTAD-GAT (AE, no ctx) C-MTAD-GAT (AE, ctx@block1) C-MTAD-GAT (AE, ctx@block2) C-MTAD-GAT (VAE, ctx) C-MTAD-GAT (AE, ctx)
0.1021 ± 0.0015 0.1001 ± 0.0016 0.0993 ± 0.0018 0.0971 ± 0.0010 0.0981 ± 0.0005 0.0984 ± 0.0011 0.0968 ± 0.0004
0.1410 ± 0.0007 0.1378 ± 0.0007 0.1374 ± 0.0007 0.1368 ± 0.0009 0.1380 ± 0.0005 0.1401 ± 0.0005 0.1367 ± 0.0008
TABLE XII: EPC ablations reported relative to a fixed baseline CMTAD-GAT (AE, ctx). Each row reports the mean gap to the baseline (Other−baseline) in absolute units (∆) and percent, computed on per-seed minima of val_loss|min (lower is better). padj are BH–FDR–adjusted twosided paired t-test p-values; Sig encodes significance (∗ p<0.05, ∗∗ p<10−2 , ∗∗∗ p<10−3 , ∗∗∗∗ p<10−4 ). Cohen’s d is computed on the paired differences (Other−baseline; positive favours the baseline). Configuration MTAD-GAT (VAE, no ctx) C-MTAD-GAT (VAE, ctx) MTAD-GAT (AE, no ctx) C-MTAD-GAT (AE, no ctx) C-MTAD-GAT (AE, ctx@block2) C-MTAD-GAT (AE, ctx@block1)
TABLE XI: RAN ablation on validation forecasting and reconstruction loss (mean ± SD of per-seed minima; lower is better). Best is bold, second-best is shaded. Configuration
val_forecast_loss
val_recon_loss
MTAD-GAT (VAE, no ctx) MTAD-GAT (AE, no ctx) C-MTAD-GAT (AE, no ctx) C-MTAD-GAT (AE, ctx@block1) C-MTAD-GAT (AE, ctx@block2) C-MTAD-GAT (AE, dyn ctx only) C-MTAD-GAT (AE, static ctx only) C-MTAD-GAT (VAE, ctx) C-MTAD-GAT (AE, ctx)
0.1661 ± 0.0010 0.1671 ± 0.0021 0.1669 ± 0.0009 0.1466 ± 0.0255 0.1626 ± 0.0246 0.1636 ± 0.0015 0.1661 ± 0.0010 0.1629 ± 0.0030 0.1640 ± 0.0018
0.1329 ± 0.0002 0.0846 ± 0.0014 0.0844 ± 0.0006 0.0865 ± 0.0055 0.0896 ± 0.0124 0.0819 ± 0.0005 0.0826 ± 0.0004 0.1305 ± 0.0001 0.0820 ± 0.0008
∆
∆ (%)
padj
Sig
d
0.0097 0.0051 0.0044 0.0031 0.0027 0.0004
4.15 2.18 1.88 1.33 1.16 0.17
< 10−4 < 10−4 0.0013 0.0068 0.00015 0.49
**** **** ** ** *** —
4.22 4.35 1.60 1.20 2.24 0.24
TABLE XIII: RAN ablations reported relative to a fixed baseline CMTAD-GAT (AE, ctx). Each row reports the mean gap to the baseline (Other−baseline) in absolute units (∆) and percent, computed on per-seed minima of val_loss|min (lower is better). padj are BH–FDR–adjusted twosided paired t-test p-values; Sig encodes significance (∗ p<0.05, ∗∗ p<10−2 , ∗∗∗ p<10−3 , ∗∗∗∗ p<10−4 ). Cohen’s d is computed on the paired differences (Other−baseline; positive favours the baseline). Config. MTAD-GAT (VAE, no ctx) C-MTAD-GAT (VAE, ctx) C-MTAD-GAT (AE, ctx@block2) MTAD-GAT (AE, no ctx) C-MTAD-GAT (AE, no ctx) C-MTAD-GAT (AE, static ctx only) C-MTAD-GAT (AE, dyn ctx only) C-MTAD-GAT (AE, ctx@block1)
∆ 0.0546 0.0515 0.0060 0.0054 0.0050 0.0024 -0.0005 -0.0136
∆ (%)
padj
Sig
d
22.1 20.8 2.45 2.20 2.03 0.97 -0.23 -5.50
−4
**** **** — ** **** ** — —
22.7 16.8 0.19 1.65 2.88 1.34 -0.39 -0.66
< 10 < 10−4 0.59 0.0025 < 10−4 0.0069 0.35 0.13
but consistent improvement in validation loss across seeds (Tables X and XII). VAE-based variants are systematically worse than AE variants, with significant degradations and larger effect sizes. Because EPC lacks static metadata, context mechanisms are limited to dynamic time-related • a model trained jointly on the same six sectors categoricals; accordingly, several C-MTAD-GAT AE vari(model_6); ants are statistically indistinguishable from each other, • centralised models trained on increasingly large sets of with performance differences within numerical noise. sectors (50, 100, 500, 1000, 5000, 7000, and all sectors), • RAN. On RAN, context-aware C-MTAD-GAT AE variants always evaluating on the original six. cluster near the baseline, while VAE variants degrade sharply with large and significant gaps (Tables XI and For each configuration and seed we record, for every XIII). The best mean val_loss|min is sometimes sector, the minima over epochs of the validation forecast achieved by ctx@block1, but this variant exhibits higher and reconstruction losses as in Sec. VIII-B. Across the six across-seed variance (wider confidence intervals in Fig. 3), sectors, these validation losses remain within a few percent suggesting sensitivity to initialisation on heterogeneous when moving from per-sector to fully centralised models, with RAN dynamics. In contrast, the full-context AE baseline no systematic degradation as more sectors are added. Seedis slightly more conservative in mean loss but more stable to-seed variability is non-negligible: some large-model seeds across seeds. still outperform some small-model seeds and vice versa, but Operational takeaways. Across both operator datasets, there is no evidence of a collapse in performance as additional (i) replacing GAT by GATv2 is never harmful and is often sectors are absorbed into a single model. mildly beneficial, (ii) context injection is most valuable on a) Stability of anomaly patterns: Validation loss alone heterogeneous RAN data (dynamic context accounts for most does not tell us whether larger models raise similar alarms. of the gain), and (iii) deterministic AE heads are substantially To quantify stability of the detected anomaly patterns, we more stable than VAE variants under repeated retraining. These consider, for each sector and seed, the Jaccard overlap between results support the deployed design choice: C-MTAD-GAT with the anomaly rows flagged by the per-sector model (model_1) GATv2, context injection, and a GRU-AE reconstruction head. and those flagged by a larger family (e.g., model_50). For a given sector and seed, let Abaseline and Afamily be the sets of anomaly keys; we define C. Scalability and stability vs. model granularity |Abaseline ∩ Afamily | A practical deployment question is whether to run one J= . |Abaseline ∪ Afamily | centralised model over many NEs or many small per-NE models. To probe this trade-off on RAN, we selected six representative sectors, including empirically challenging ones where models show lower validation performance, and compared: • separate models trained on each of the six sectors individually (family model_1);
We then average J across seeds and sectors, and report 95% confidence intervals over the same population. Figure 4a shows how this Jaccard overlap evolves as the training set grows, restricted to the six selected sectors. As expected, the overlap decreases as we move from per-sector 8
TABLE XIV: Illustrative RAN and EPC incidents surfaced by C-MTAD-GAT.
(a) Leaderboard — RAN. Mean ± 95% CI of per-seed values for the chosen metric (lower is better). Stars mark paired t-test significance vs the best. The best configuration appears at the top.
Dom.
Counter
RAN
Transmission / back- External fault in the haul stability KPIs transmission provider’s network.
Root-cause summary
EPC
Update Bearer Inbound roamers; failed Adjust MME MME (Mobility QCI/ARP modification configuration (static Management Entity) on new MME. QCI/ARP for roamers). Reject
EPC
Maximal Exceeded
EPC
Create Session Reject Signalling storm after (PGW not responding) public-warning / cellbroadcast event.
Tune memory allocation; monitor behaviour during/after event.
EPC
Suspend Notification Planned change to Reject reduce RADIUS / MVNO signalling load.
Acknowledge new baseline; no remediation needed.
Durations Stricter maximal call duration on new MME platform.
Operator action Resolve transmission issue and monitor the affected area.
Align VoLTE callduration limits with previous platform.
representative sectors, growing the training set from one sector to all sectors reduces the Jaccard overlap with the per-sector model from 1 to roughly 0.45–0.5. To contextualise this drift, we also examine the intrinsic seed-to-seed variability of a fixed centralised model family (e.g. model_all). Figure 4b shows, for each seed and family, the Jaccard overlap between that centralised model and its corresponding per-sector baseline, aggregated over the six sectors. For the fully centralised family, these overlaps range from approximately 0.25 to 0.75 (mean ≈ 0.5), which is of the same order as the degradation observed when moving from single-sector to all-sectors training. This suggests that the drift introduced by centralisation is comparable to the intrinsic seedto-seed variability of the model, rather than an additional, much larger source of instability. Taken together, the loss-based and Jaccard-based analyses indicate that, for large RAN deployments, a single centralised C-MTAD-GAT model is viable in practice and dramatically simpler to operate than thousands of small models. Centralisation comes with a modest change in the anomaly sets, but without catastrophic drift: even the all-sectors model retains a substantial fraction of the per-sector alarms. In settings where specific outlier sectors are business-critical, one can layer targeted fine-tuning or per-NE specialisation on top of the centralised backbone.
(b) Leaderboard — EPC. Same convention as (a): mean ± 95% CI across seeds; stars indicate paired t-test p-values vs the best.
(c) Forest — RAN. Each point is the paired mean difference (Other − Best) across shared seeds, with 95% CI; the vertical line at 0 indicates parity. Stars encode paired t-test p-values.
D. Operational Case Studies In this section we move from aggregate metrics to concrete operational behaviour. We illustrate how the deployed C-MTADGAT behaves in a live EPC and RAN settings and how its outputs are used by network operations. Examples are drawn from the EPC and RAN datasets, described in Sec. IV-C. For business confidentiality, EPC host identifiers are anonymised (e.g., host-10, host-50), and charts show relative rather than absolute counter values. 1) Feedback from Network Operations: Feedback from operations engineers emphasized three recurring points: • Actionability over pure accuracy. What mattered most was whether an alert led to a useful insight or operational decision. Precision in the 60–70% range was considered
(d) Forest — EPC. Mean differences relative to the best configuration, 95% CI, and paired t-test significance as in (c).
Fig. 3: Seed-robust ablation comparisons on RAN and EPC datasets. Leaderboards ((a),(b)) summarize absolute performance (mean across seeds with 95% CI; lower is better). Forest plots ((c),(d)) show differences to the baseline model (Other − baseline) with 95% CI; values > 0 mean the other model is worse. Unless otherwise stated, all panels use the same metric and statistic (e.g., val_loss with min across epochs).
models towards large centralised models trained on thousands of sectors: families trained on 50–500 sectors still agree with model_1 on roughly 60–70% of anomaly rows, whereas the all-sectors model keeps around 45–50% overlap. On our six 9
(a) EPC (each line is a host).
(a) Mean Jaccard vs. model family on the six selected sectors.
(b) RAN (each line is a local_area).
(b) Seed–family heatmap: Jaccard between each centralised family and its per-sector baseline, across seeds.
Fig. 4: Scalability and stability of anomaly patterns on six RAN sectors. (a) Jaccard overlap between anomaly rows from the per-sector model (model_1) and larger centralised models, averaged over seeds; error bars denote 95% confidence intervals across sectors. (b) For each family (columns) and seed (rows), Jaccard overlap between the centralised model and the corresponding per-sector model, aggregated over the same six sectors; values around 1 indicate almost identical anomaly sets, values around 0.5 indicate moderate drift.
Fig. 5: Aggregated number of anomalies in specific time windows on the EPC (top) and RAN (bottom) datasets. In both cases each curve corresponds to a network element (host in EPC, local_area in RAN). Peaks indicate periods where multiple network elements are simultaneously anomalous and are used to prioritise operator attention before drilling down into specific counters and elements.
of when the system deviates and how severe the deviation is. Concretely, for each counter we convert the normalised reconstruction/forecast error into five discrete priority levels by binning the upper tail of that counter’s validation error distribution (level 5 = most extreme). We then aggregate these acceptable if the remaining false positives were easy to priorities across NEs and counters at each time step to obtain an inspect and helped maintain situational awareness. aggregated priority score (sum of per-counter priority levels), • Multi-metric drift rather than single thresholds. Engi- which emphasises periods with widespread and/or extreme neers valued the ability to highlight subtle, multi-counter deviations. deviations that would not trigger traditional single-KPI In addition, we report the aggregated number of anomalies, thresholds, especially in the EPC domain where behaviour defined as the count of (NE, counter) pairs whose error exceeds is distributed across layers and functions. This was seen the anomaly threshold at each time step (i.e., the number of as a scalable way to monitor complex platforms without active alarms, irrespective of priority). an explosion of hand-crafted rules. Figure 5 shows example time series of these aggregated • Generalisation across heterogeneous infrastructure. Cate- signals on EPC (top) and RAN (bottom), grouped as indicated gorical embeddings and context injection allowed a single in the figure caption. In both domains, short-lived spikes model to operate across different hosts and configura- correspond to periods where many counters are simultaneously tions without per-host fine-tuning. This was seen as a flagged across one or more NEs and typically align with prerequisite for practical deployment in large, evolving operationally relevant events (e.g., configuration changes, networks. signalling storms), whereas a low, noisy baseline of occasional 2) Operational Workflow and Prioritisation: To support small peaks is treated as normal background variability. day-to-day use, we introduced an aggregated anomaly priority The resulting workflow is two-stage: (i) operators monitor the view that combines anomaly scores over time, network elements aggregated priority stream to identify periods of interest, and (ii) (NEs), and counters. The goal is not to replace per-counter plots for selected peaks they drill down into NE- and counter-level but to provide operators with a high-level, sortable overview views to investigate root causes. This helped focus attention 10
Fig. 7: Detected anomalies in the Update Bearer MME Reject counter. Top: aggregated anomaly priority score (red / purple bars) and sum of the counter across hosts (line); purple bars mark anomalies within maintenance windows. Bottom: per-host counter values over time.
Fig. 6: Spatial footprint of the RAN incident in Fig. 5b: sites with degraded stability (≈ 30 affected base stations in a single RAN area) are highlighted on the map, illustrating how the aggregated number of anomalies localises transmission-related problems to a specific geographical cluster of network elements.
on the most severe or unusual episodes, while allowing lowlevel background anomalies to be treated as benign unless they clustered in time or across counters. 3) Illustrative Incidents: We now summarise several real incidents where the model’s alarms were analysed by domain experts, with an overview provided in Table XIV. In all cases, C-MTAD-GAT was run in the unsupervised mode described earlier, with validation-based thresholds and no access to ground-truth labels. a) Transmission-related instability in one RAN area: The model highlighted a pronounced spike in the aggregated number of anomalies localised to a specific RAN area (Fig. 5b and Fig. 6). Elevated anomaly scores across approximately 30 sites within the same local_area indicated widespread instability. Investigation showed that a fault in the external transmission provider’s network intermittently disrupted backhaul connectivity, degrading stability across the affected sites. After the transmission fault was resolved, KPIs and traffic levels returned to normal and the aggregated anomaly number of anomalies dropped back to its baseline, with no further customer-visible impact. b) Update Bearer MME Reject increase (EPC): The model also flagged the onset of an extended period with elevated values of the Update Bearer MME Reject counter (Fig. 7). The aggregated anomaly priority score showed distinct spikes aligned with increases in this counter across hosts. Domain experts traced the issue to inbound roamers triggering failed modifications of Quality of Service Class Identifier (QCI) and Allocation and Retention Priority (ARP) values, leading to rejected bearer updates. The problem was not yet visible through customer complaints, so the anomaly acted as an early warning; after adjusting the MME configuration to enforce static parameters for roamers, both the counter and the anomaly signal returned to normal levels. c) VoLTE call-duration limitations (EPC): In another case, the model surfaced anomalies in the Maximal Durations Exceeded counter (Fig. 8), indicating an unexpected rise in sessions terminated by reaching a maximal11
Fig. 8: Anomalies in the Maximal Durations Exceeded counter, linked to unintended VoLTE call-duration limits. Top: aggregated anomaly priority (bars); purple bars mark anomalies within maintenance windows. and counter sum across hosts (line). Bottom: per-host counter trajectories.
duration limit. This was traced to a misconfiguration that imposed stricter VoLTE call-duration limits on the new MME platform than on the previous one. The anomaly thus acted as a regression detector after a platform change; once the configuration was corrected, the counter and associated anomalies decreased to their previous baseline. d) Create Session Reject due to PGW not responding (EPC): The model also detected a sharp increase in the Number of create session reject due to PGW not responding counter (Fig. 9). This coincided with a mass cell-broadcast / public-warning event that caused many users to simultaneously wake their phones, creating a surge in idle-to-connected transitions. The resulting spike in bearer-modification requests overloaded parts of the EPC signalling path; response delays and timer expiries triggered session release and re-creation, effectively creating a “signalling storm”. Memory-allocation tuning, combined with the natural decay of the broadcast effect, brought the counter back to normal, and the anomaly view helped correlate the symptom with the temporal pattern of the event. e) Suspend Notification Reject after configuration change (EPC): A further anomaly cluster involved an increase in the Number of Suspend Notification Reject counter (Fig. 10). Domain experts linked this to a planned configuration change intended to reduce signalling load caused by a virtual service provider’s Remote Authentication Dial-In User Service (RADIUS) server (an MVNO integration). The timing of the anomalies matched the maintenance window (purple bars), indicating that the model was reacting to a new steady-state behaviour rather than an unexpected fault. The
IX. C ONCLUSION
Fig. 9: Anomalies in the Number of create session reject due to PGW not responding counter during a public-warning event. Top: aggregated anomaly priority (bars) and counter sum across hosts (line). Bottom: per-host counter values revealing the transient signalling storm.
Fig. 10: Anomalies in the Number of Suspend Notification Reject counter following a planned configuration change. Top: aggregated anomaly priority (bars) and counter sum across hosts (line). Bottom: perhost counter trajectories; purple bars indicate anomalies within maintenance windows, confirming a deliberate shift in the operational baseline rather than a fault.
new configuration proactively rejected specific requests when the provider did not respond promptly, shifting the expected baseline of this counter; here the anomaly view was mainly useful as a marker of a changed operating regime rather than a business-critical incident.
We have presented C-MTAD-GAT, a context-aware extension of MTAD-GAT that combines GATv2 attention, conditional convolutions over categorical metadata, and a deterministic GRU-AE reconstruction head for unsupervised anomaly detection in telecom time series. On the public TELCO benchmark, C-MTAD-GAT consistently outperforms MTADGAT, a β-MTAD-GAT variant, and the Telco-specific DC-VAE under a common unsupervised calibration protocol, achieving higher event-level and timestamp-level F1 while raising fewer alarms. On large-scale RAN and EPC datasets from a national operator, ablations show that C-MTAD-GAT backbone is more robust than MTAD-GAT variants, that injecting context is particularly beneficial on heterogeneous RAN data, and that a single centralised model trained over thousands of NEs offers a favourable trade-off between scalability and per-NE performance. Our scalability and Jaccard analyses further indicate that the drift induced by centralisation is of the same order as the intrinsic seed-to-seed variability of the model, rather than a catastrophic loss of signal. The operational case studies demonstrate that fully unsupervised anomaly detection is feasible and useful in live telecom networks, even in the absence of labels. C-MTAD-GAT systematically surfaced network behaviours that engineers judged relevant—early warnings, regression detections, and markers of new baselines—while also illustrating that statistically significant deviations are not automatically business-critical. In practice, value arises from how well the model helps engineers understand multi-metric drift, relate anomalies to changes and incidents, and reason about evolving operating regimes. Humanin-the-loop validation therefore remains central: expert feedback is needed both to interpret alerts and to decide when persistent deviations should be reclassified as normal behaviour, informing change-aware monitoring and retraining schedules. Future work will focus on tightening the loop between model output and operations. Concretely, we plan to (i) incorporate lightweight root-cause suggestion mechanisms, for example by ranking counters and NEs that contribute most to each anomaly; (ii) integrate anomaly alerts and aggregated priority scores directly into NOC ticketing workflows, so that alerts can be triaged and closed within existing processes; and (iii) explore adaptive retraining and error-drift monitoring strategies that automatically detect when the model should be updated in response to persistent baseline shifts.
4) Operational lessons: Across these incidents, several patterns emerge. First, fully unsupervised anomaly detection is operationally useful even without labels: the model consistently surfaced network behaviours that engineers deemed relevant, either as early warnings, regression detectors, or markers of new baselines. Second, human-in-the-loop validation is essential to turn raw anomaly streams into business value. Expert feedback is needed to distinguish between mathematically significant deviations and genuinely business-critical issues, and to reinterpret persistent anomalies as new “normal” regimes once ACKNOWLEDGMENTS planned changes take effect. Third, the case studies highlight This research was supported by the Research Council of the importance of monitoring baseline shifts and deciding Norway through the Machine Learning for Irregular Time Series when to retrain. In a live network, configuration changes and (ML4ITS, grant no. 312062) and by SFI NorwAI (Centre for traffic evolution regularly move counters to new operating Research-based Innovation, grant no. 309834). SFI NorwAI ranges; anomalies should both draw attention to such shifts is co-financed by the Research Council of Norway and its and then inform subsequent model updates, for instance via partners. scheduled retraining or unsupervised error-drift monitoring. Finally, engineers consistently asked for tighter integration of R EFERENCES model output with existing tooling, e.g., root-cause hints and [1] M. García, P. González, R. Martínez, D. Fernández, R. García, and direct surfacing of high-priority anomalies in NOC ticketing S. Alfaro Couto, “One Model to Find Them All: Deep Learning for systems. These requirements inform the future work outlined Multivariate time-series anomaly detection in mobile network data,” IEEE in the conclusion. Trans. Netw. Serv. Manag., vol. 21, no. 2, pp. 1601–1616, 2024. 12
[2] H. Zhao et al., “Multivariate Time-Series Anomaly Detection via Graph Attention Network,” in Proc. IEEE Int. Conf. Data Mining (ICDM), 2020, pp. 841–850. [3] P. Malhotra, A. Ramakrishnan, G. Anand, L. Vig, P. Agarwal, and G. Shroff, “LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection,” CoRR, vol. 1607, 2016. [4] Y. Su, Y. Zhao, C. Niu, R. Liu, W. Sun, and D. Pei, “Robust anomaly detection for Multivariate Time Series through Stochastic Recurrent Neural Network,” in Proc. ACM SIGKDD Conf. Knowl. Discov. Data Min. (KDD), 2019. [5] D. Li, D. Chen, B. Jin, L. Shi, J. Goh, and S.-K. Ng, “MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks,” in Proc. Int. Conf. Artif. Neural Netw. (ICANN), 2019, pp. 703–716. [6] J. Xu, H. Wu, J. Wang, and M. Long, “Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy,” in Proc. ICLR, 2022. [Online]. Available: https://openreview.net/forum?id=LzQQ89U1qm_ [7] Y. Yang, C. Zhang, T. Zhou, Q. Wen, and L. Sun, “DCdetector: Dual Attention Contrastive Representation Learning for Time Series Anomaly Detection,” in Proc. ACM SIGKDD Conf. Knowl. Discov. Data Min. (KDD), 2023, pp. 3033–3045. [8] X. He, Y. Li, J. Tan, B. Wu, and F. Li, “OneShotSTL: One-Shot Seasonal-Trend Decomposition For Online Time Series Anomaly Detection And Forecasting,” Proc. VLDB Endow., pp. 1399–1412, 2023. [Online]. Available: https://dblp.org/rec/journals/pvldb/HeLTWL23 [9] Y. Zheng et al., “Correlation-Aware Spatial–Temporal Graph Learning for Multivariate Time-Series Anomaly Detection,” IEEE Trans. Neural Netw. Learn. Syst., pp. 1–15, 2023. [10] A. Siffer, P. Fouque, A. Termier, and C. Largouet, “Anomaly Detection in Streams with Extreme Value Theory,” in Proc. ACM SIGKDD Conf. Knowl. Discov. Data Min. (KDD), 2017, pp. 1067–1075. [11] S. Schmidl, F. Naumann, and T. Papenbrock, “AutoTSAD: Unsupervised Holistic Anomaly Detection for Time Series Data,” Proc. VLDB Endow., vol. 17, no. 11, pp. 2987–3002, 2024. [12] T. Li and X. Li, “Novel alarm correlation analysis system based on association rules mining in telecommunication networks,” Information Sciences, vol. 180, no. 16, pp. 2960–2978, 2010. [13] H. W. Oleiwi, D. N. Mhawi, and H. Al-Raweshidy, “MLTs-ADCNs: Machine learning techniques for anomaly detection in communication networks,” IEEE Access, vol. 10, pp. 91 006–91 017, 2022. [14] J. Zheng, D. Feng, Z. Yang, Y. Xiang, H. Zhang, and S. Li, “TransKS: An Anomaly Detection Method for Telecommunication Networks Based on Deep Learning,” IEEE Access, vol. 11, pp. 118 048–118 060, 2023. [15] E. Perez, F. Strub, H. De Vries, V. Dumoulin, and A. Courville, “FiLM: Visual reasoning with a general conditioning layer,” in Proc. of the AAAI conference on artificial intelligence, vol. 32, no. 1, 2018. [16] S. Brody, U. Alon, and E. Yahav, “How Attentive are Graph Attention Networks?” in Proc. ICLR, 2022. [17] R. Huet, L. Navarro, F. Rossi, R. Emonet, E. Fromont, and S. Malinowski, “Local Evaluation of Time Series Anomaly Detection Algorithms,” in Proc. ACM SIGKDD Conf. Knowl. Discov. Data Min. (KDD), 2022, pp. 635–645.
13