Anomaly Detection

Classical parametric and non-parametric techniques that model the underlying probability distribution of normal data. Anomalies are flagged as observations falling in low-probability regions.

• Z-Score: Flags points exceeding a standard deviation threshold from the mean. Effective for univariate, Gaussian-like data.
• Interquartile Range (IQR): Identifies outliers as points below Q1 - 1.5IQR or above Q3 + 1.5IQR. Robust to non-normal distributions.
• Grubbs' Test: Iteratively detects a single outlier in a univariate dataset assumed to be normally distributed.
• Mahalanobis Distance: Measures the distance of a point from a distribution's centroid, accounting for covariance between variables. Essential for multivariate anomaly detection.

Algorithms that assume normal data points occur in dense neighborhoods, while anomalies lie in sparse regions of the feature space. These methods make no assumptions about the underlying data distribution.

• DBSCAN: Clusters points based on density connectivity. Points not belonging to any cluster are classified as noise or anomalies. Requires tuning of epsilon (neighborhood radius) and minPts.
• Local Outlier Factor (LOF): Computes the local density deviation of a point relative to its k-nearest neighbors. A point with substantially lower density than its neighbors is an anomaly.
• Histogram-Based Outlier Score (HBOS): A fast, unsupervised method that creates univariate histograms for each feature and computes an outlier score based on bin frequency.

Non-parametric algorithms that exploit the inherent separability of anomalies. Anomalies are few and distinct, requiring fewer random partitions to isolate than normal points.

• Isolation Forest: Builds an ensemble of random trees. The path length from the root to a leaf node serves as the anomaly score. Anomalies consistently have shorter average path lengths.
• Extended Isolation Forest: Addresses bias in standard Isolation Forest by using hyperplanes with random slopes for splits, rather than axis-parallel cuts.
• Random Cut Forest (RCF): An unsupervised streaming algorithm from AWS that assigns an anomaly score based on changes in model complexity when a point is added to the forest.

Neural network architectures trained to compress and reconstruct normal data. The core assumption is that models trained exclusively on normal patterns will exhibit high reconstruction error when attempting to encode anomalous instances.

• Autoencoder (AE): A bottleneck architecture where the encoder compresses input into a latent representation and the decoder reconstructs it. The Mean Squared Error between input and output is the anomaly score.
• Variational Autoencoder (VAE): A probabilistic extension that learns a distribution over the latent space. Anomalies are detected using the reconstruction probability, which is more principled than raw error.
• LSTM-Autoencoder: Combines LSTM layers with an autoencoder structure to learn temporal dependencies in sequences, making it highly effective for time-series telemetry anomaly detection.

Models trained exclusively on the 'normal' class to learn a tight decision boundary encapsulating normal behavior. Any point falling outside this boundary during inference is classified as an anomaly.

• One-Class SVM: Finds a hyperplane in a high-dimensional kernel space that separates normal data from the origin with maximum margin. The nu parameter controls the upper bound on the fraction of training errors.
• Support Vector Data Description (SVDD): Finds the smallest hypersphere that encloses the normal data. Points outside the sphere are anomalies.
• Deep SVDD: A neural network adaptation that jointly learns a feature representation and a minimal enclosing hypersphere, significantly outperforming kernel methods on high-dimensional data like network telemetry.

Methods that predict expected future values based on historical patterns. Anomalies are identified as significant deviations between the predicted and actual observed values, often using dynamic thresholding on residuals.

• ARIMA/SARIMA: Classical statistical models that capture autoregressive, differencing, and moving average components. SARIMA extends this with explicit seasonality modeling.
• Prophet: A decomposable time-series model from Meta that handles strong seasonal effects, holiday effects, and changepoints. Robust to missing data and outliers.
• Transformer-Based Forecasters: Architectures like Informer and Autoformer use self-attention mechanisms to capture long-range dependencies in telemetry streams, outperforming LSTMs on sequences with extended periodicities.

The dominant paradigm for network anomaly detection where algorithms identify hidden structures in unlabeled data. Since labeling network attacks or rare failures is often impossible, these methods learn a baseline of 'normal' behavior and flag deviations.

• Autoencoders: Learn a compressed representation of normal data; high reconstruction error signals an anomaly.
• Isolation Forest: Exploits the fact that anomalies are few and different, isolating them quickly through random partitioning.
• DBSCAN: Density-based clustering that marks points in low-density regions as outliers without pre-specifying the number of clusters.

Specialized techniques for identifying unexpected patterns in time-ordered observations like server load, throughput, or call drop rates. Unlike static data, temporal dependencies and seasonality must be accounted for.

• Seasonal Decomposition: Deconstructs a signal into trend, seasonal, and residual components; anomalies appear in the residual.
• ARIMA: A classical statistical model that forecasts expected values; significant deviations from the prediction are flagged.
• LSTM Networks: Deep learning models that learn long-term dependencies, making them highly effective for complex, non-linear temporal patterns in network traffic.

Analyzes multiple interconnected variables simultaneously to find anomalies invisible to univariate checks. A single metric might look normal, but its relationship with others can reveal a critical issue.

• Principal Component Analysis (PCA): Projects high-dimensional data onto a lower subspace; anomalies have high reconstruction error from this simplified representation.
• One-Class SVM: Trained only on 'normal' operational data to learn a tight decision boundary encapsulating standard behavior.
• Graph Neural Networks: Model complex, non-Euclidean dependencies between network elements for topology-aware anomaly scoring.

The silent killer of production anomaly detection systems. Concept drift occurs when the statistical properties of the target variable change, while data drift is a shift in input feature distributions. Both render models trained on historical data inaccurate.

• Change Point Detection: Algorithms that identify abrupt shifts in a time series' generative process, such as a sudden mean or variance change.
• Online Learning: Models that continuously adapt to new data distributions without full retraining.
• Dynamic Thresholding: Automatically adjusts alert boundaries based on recent statistical properties, preventing alert fatigue from static limits.

Standard accuracy is useless for anomaly detection where normal data vastly outnumbers anomalies. Specialized metrics are required to avoid being misled by a model that simply predicts 'normal' every time.

• Precision-Recall AUC: Summarizes the trade-off between precision and recall across thresholds; far more informative than ROC-AUC for highly imbalanced datasets.
• F1-Score: The harmonic mean of precision and recall, providing a single metric that balances false positives and false negatives.
• Alert Fatigue: The operational consequence of poor precision—too many false positives desensitize NOC teams, leading to missed critical incidents.

Anomaly detection answers 'is something wrong?'—RCA answers 'why?' This systematic process moves beyond symptoms to identify the fundamental origin of a fault within a complex, interconnected system like a RAN.

• Correlation Analysis: Automatically correlates an anomaly with contemporaneous events, configuration changes, or metric spikes across the topology.
• Causal Inference: Advanced techniques that move beyond correlation to identify directional cause-and-effect relationships.
• Service Dependency Graphs: Maps the relationships between network functions to trace a service-impacting anomaly back to its originating component.