Advancing Anomaly Detection for Smarter and More Resilient Mobile Networks

Across bustling cities and remote rural landscapes, mobile networks serve as the connective tissue of modern life. They sustain economies, enable industries, and shape daily interactions in ways that are rarely visible to the end user, yet essential to the seamless functioning of society. As these networks grow more complex and dynamic, the challenge is not simply to keep them running but to ensure flawless performance under constantly changing conditions.

To achieve this, operators take a vigilant approach. They monitor a broad set of Key Performance Indicators (KPIs). These include latency, throughput, call setup success rate, downlink resource block utilization, unavailability rate, and user downlink average throughput. KPIs are not viewed as static numbers, but as real-time signals of network health. With the shift toward self-organizing and autonomous networks, early and accurate anomalydetection of KPI issues is key. This enables proactive interventions, self-healing capabilities, and uninterrupted user experiences.

So, how can we interpret irregularities in these KPIs and what do they truly mean for network performance?

Understanding Anomalies in Mobile Networks

When monitoring such KPIs, it becomes clear that not all anomalies carry the same operational significance. Some are isolated events with limited impact, while others represent sustained or context-dependent deviations that if unresolved, can degrade performance and compromise user experience. In practice, anomalies typically fall into three categories:

Collective anomalies are particularly critical in mobile networks and typically fall into two categories:

• Amplitude anomalies: KPI values remain consistently above or below their expected range over a given period, such as a prolonged increase in unavailability rate after a system update.
• Shape anomalies: Changes in the temporal pattern of the KPI, like an altered daily utilization cycle that no longer follows the expected peaks and troughs.

A Data-Driven Framework Tailored to KPI Diversity

To address the wide range of KPI behaviors, Cyient developed an adaptive anomaly detection framework tailored to each metric’s characteristics. It begins with unsupervised clustering, where KPIs with similar statistical patterns are grouped automatically, as shown in Figure 2. These clusters then guide the choice of the most suitable anomaly detection algorithm.

Two main properties influence clustering:

• Periodicity: Some KPIs follow predictable daily cycles. For example, the Downlink Resource Block Utilization Rate follows a 24-hour pattern, peaking during busy hours and dipping at night. Others, such as the Unavailability Rate, do not follow cycles but show irregular changes caused by hardware failures or maintenance.
• Variability: The degree of fluctuation over time. Stable KPIs like Call Setup Success Rate have low variability, whereas KPIs such as User Downlink Average Throughput are highly variable due to shifting user demand and network load.

A key strength of the framework is that it operates without relying on labelled data. In telecom, labelling anomalies across large time series datasets is both expensive and impractical. By using unsupervised methods for clustering and detection, the framework remains scalable, cost-effective, and suitable for deployment in live networks.

Figure 2: Unsupervised clustering of time series from mobile network KPIs based on statistical similarity.

Matching Detection Algorithms to KPI Charateristics

By analyzing the statistical profiles of KPI clusters, the framework applies algorithms optimized for each group’s behavior and operational context:

1. STUMPY

Ideal for high-variability KPIs such as throughput and resource utilization. These are prone to shape anomalies, where unusual temporal patterns emerge. This Matrix Profile-based method evaluates all subsequences in a time series to identify motifs (recurring normal patterns) and discords (rare or unusual sequences). Motifs help establish a baseline of normal behavior, while discords highlight deviations that could indicate service issues. Its efficiency and robustness make STUMPY particularly effective in periodic and dynamic time series.

2. STTM (Smart Trouble Ticket Management)

Designed for low-variability or nearly flat KPIs such as success rates. These are more susceptible to amplitude anomalies. For these metrics, STUMPY might trigger false alarms, as even minor fluctuations can appear significant. STTM addresses this by clustering base stations into groups representing distinct performance profiles and monitoring transitions between clusters over time. When a base station moves from a high-performance cluster to one associated with degradation, STTM flags the change as an anomaly. This method is especially effective at detecting subtle, long-term degradations while avoiding unnecessary alerts.

This adaptive, cluster-based strategy ensures that each KPI group is analyzed with the most suitable method. It improves detection accuracy, reduces false positives, and remains scalable and efficient for large-scale networks.

Proven Impact and Performance Insights

Results published in Cyient’s IEEE Access paper titled “An Adaptive Framework for Collective Anomaly Detection in Key Performance Indicators From Mobile Networks”, show that the framework outperforms traditional anomaly detection approaches. Benchmarking against legacy methods highlights significant improvements:

• Shape anomaly detection: Achieved higher accuracy in identifying deviations in complex KPI patterns compared to conventional statistical techniques.
• Amplitude anomaly detection: Offered greater sensitivity to sustained deviations while avoiding unnecessary alerts—an area where older approaches struggled.
• Overall detection rate: Delivered marked improvements across shape, amplitude, and combined categories, ensuring relevant issues are captured.

These findings confirm the framework’s strengths:

• Flexibility: Adaptable to diverse KPI types and multiple radio access technologies.
• Scalability: Capable of processing massive, high-dimensional datasets without labelled training data.
• Future readiness: Designed to support next-generation architectures such as 5G, Open RAN, and beyond.

These results demonstrate that Cyient’s adaptive framework not only improves technical detection but also enables operators to reduce downtime, optimize resources, and safeguard customer experience.

According to Ericsson’s Mobility Report 2024, global mobile network data traffic is projected to grow almost 200 percent between 2024 and the end of 2030, making advanced anomaly detection essential. In parallel, GSMA Intelligence forecasts that 5G connections will surpass 5.5 billion by 2030, further highlighting the need for scalable, automated monitoring.

These industry projections highlight the growing scale and complexity of mobile networks and underscore why Cyient’s adaptive framework is so critical. By improving technical detection, reducing downtime, optimizing resources, and safeguarding customer experience, the framework directly addresses the challenges posed by this rapid growth.

A Key Enabler For Autonomous Networks

This work represents a major step toward smarter, more resilient mobile networks. By combining advanced data mining, machine learning, and deep telecom expertise, Cyient equips operators to detect and resolve issues more quickly and accurately. This innovation is pivotal in driving the transition to fully autonomous networks, ensuring consistent service quality, greater operational efficiency, and improved customer experience.