Autoencoder

The autoencoder's architecture forces data through a latent bottleneck layer with fewer neurons than the input. This constraint prevents the network from simply learning the identity function. Instead, it must learn a compressed, lower-dimensional representation that captures the most salient statistical features of normal data.

• The bottleneck acts as an information filter, discarding noise and redundant correlations.
• Dimensionality of the bottleneck is a critical hyperparameter: too small loses essential structure, too large risks learning the identity.
• This forced compression is what makes the autoencoder a powerful unsupervised feature extractor.

The core mechanism for anomaly detection is the reconstruction error, typically measured by Mean Squared Error (MSE) or Mean Absolute Error (MAE) between the input vector and its decoded output. A model trained exclusively on normal operational telemetry learns to reconstruct 'normal' patterns with low error.

• When an anomalous data point (e.g., a sudden spike in call drop rate) is passed through, the decoder produces a 'normalized' version based on its training.
• The resulting high reconstruction error serves as a continuous anomaly score.
• A threshold is set on this score; exceeding it triggers an alert, making it ideal for KPI anomaly detection.

Unlike standard autoencoders that learn a deterministic latent vector, Variational Autoencoders (VAEs) learn the parameters of a probability distribution (typically Gaussian) in the latent space. This provides a probabilistic framework for anomaly detection.

• The encoder outputs a mean (μ) and variance (σ) for each latent dimension, not a fixed point.
• Anomaly scoring can use the reconstruction probability, a more principled metric than raw reconstruction error.
• VAEs generate smoother latent manifolds, making them more robust to noisy data and better at detecting subtle contextual anomalies.

For network telemetry, data is inherently temporal. A Sequence-to-Sequence (Seq2Seq) autoencoder uses recurrent layers like LSTM or GRU in both the encoder and decoder to learn temporal dynamics.

• The encoder compresses a time window of KPI readings into a fixed-length context vector.
• The decoder attempts to reconstruct the entire sequence from this vector.
• This architecture excels at time-series anomaly detection because it models the expected temporal evolution of metrics, flagging sequences that deviate from learned dynamic patterns, such as a gradual performance degradation before a failure.

To prevent overfitting and force the discovery of more robust features, regularization techniques are applied directly to the autoencoder's training objective.

• Sparse Autoencoders add a penalty (e.g., L1 regularization or KL divergence) to the loss function, constraining most neurons in the latent layer to be inactive, leading to a sparse representation.
• Denoising Autoencoders (DAEs) are trained to reconstruct a clean input from a deliberately corrupted version (e.g., adding Gaussian noise). This forces the model to learn the true data manifold, not just memorize the training set, making it highly effective for novelty detection in noisy telemetry streams.

A single autoencoder can ingest hundreds of Performance Management (PM) counters and Key Performance Indicators (KPIs) simultaneously, performing multivariate anomaly detection. The model learns the complex, non-linear correlations between metrics like throughput, latency, and handover success rate.

• A point anomaly in a single counter is easily caught, but the true power is detecting collective anomalies where a combination of metrics is subtly 'off' while each individually appears normal.
• This holistic view is critical for identifying complex faults like a misconfigured antenna tilt that causes a specific, correlated shift in signal strength and interference metrics across neighboring cells.

The fundamental anomaly score generated by an autoencoder. It quantifies the difference between the original input vector and the model's output. The core assumption is that an autoencoder trained solely on normal network telemetry will fail to accurately reconstruct anomalous data points.

• Mean Squared Error (MSE): Commonly used for continuous KPI data like latency or throughput.
• Binary Cross-Entropy: Applied when input features are normalized between 0 and 1.
• Scoring Logic: If reconstruction_error > dynamic_threshold, an alert is triggered. This threshold is often set based on the 99th percentile of errors observed on a validation set.

The central, compressed layer of an autoencoder that forces the network to learn a low-dimensional representation of the input data. This bottleneck prevents the network from simply learning the identity function.

• Dimensionality Reduction: Compresses high-dimensional telemetry vectors (e.g., 100+ KPIs) into a compact code.
• Feature Extraction: The latent space captures the essential, non-linear correlations between metrics like PRB utilization and CQI.
• Undercomplete Constraint: The bottleneck dimension must be strictly smaller than the input dimension to force meaningful generalization.

A probabilistic spin on the standard autoencoder. Instead of encoding an input as a single point in the latent space, a VAE encodes it as a distribution (typically a Gaussian defined by a mean and variance). This makes VAEs powerful generative models.

• KL Divergence Loss: Adds a regularization term that forces the latent distributions to be close to a standard normal distribution.
• Anomaly Detection Use: Anomalies can be detected not just by reconstruction error, but also by a low probability score in the latent space, indicating the sample is far from the learned data manifold.

An architecture designed for time-series telemetry where both the input and output are sequences. It typically uses an LSTM or Transformer encoder to compress a window of historical KPI data into a context vector, and a decoder to reconstruct the sequence.

• Temporal Dependency: Captures normal behavioral patterns over time, such as a gradual nightly traffic dip.
• Collective Anomaly Detection: Excels at identifying anomalous sequences where individual points may look normal, but the overall pattern is broken (e.g., a missing handover spike during a scheduled event).

A robust variant trained to reconstruct a clean input from a corrupted version of it. During training, noise (e.g., Gaussian noise or dropout) is intentionally added to the input, but the loss is calculated against the original, uncorrupted data.

• Robust Feature Learning: Forces the model to learn stable representations that are insensitive to minor, noisy fluctuations in telemetry data.
• Resilience: Prevents the model from overfitting to the specific noise profile of a single base station, making it more generalizable across the entire RAN.

A comparison of two unsupervised methods for novelty detection. A One-Class SVM finds a tight, hard-boundary hyperplane around the normal data in a kernelized space. An autoencoder learns a non-linear manifold.

• One-Class SVM: Computationally lighter for low-dimensional data but struggles with very high-dimensional, unstructured inputs.
• Autoencoder: Superior for learning complex, hierarchical patterns in raw, high-dimensional telemetry without manual feature engineering.
• Hybrid Approach: Use an autoencoder for dimensionality reduction and feed the latent vectors into a One-Class SVM for final classification.