Change Point Detection

The fundamental operational distinction in change point analysis:

• Offline (Retrospective): The entire time series is available. Algorithms like PELT or Binary Segmentation globally optimize the placement of all change points to minimize a cost function. Used for forensic analysis of historical network outages.
• Online (Sequential): Data arrives as a stream. Algorithms like CUSUM or Bayesian Online Change Point Detection must balance detection delay against false alarm rate, processing each observation in real-time to trigger immediate alerts for active service degradation.

Two competing philosophies underpin detection algorithms:

• Frequentist (Likelihood Ratio): Tests the null hypothesis of 'no change' against the alternative of a single change at an unknown location. CUSUM accumulates evidence over time, triggering an alarm when the cumulative sum exceeds a threshold derived from the desired Average Run Length (ARL0).
• Bayesian (Posterior Probability): Treats the change point location as a random variable. The Bayesian Online Change Point Detection algorithm computes the posterior probability of a run length, elegantly handling uncertainty and providing a full predictive distribution rather than a hard threshold.

The engine of offline detection is the minimization of a cost function plus a penalty term to control segmentation granularity:

• Cost Functions: Measure homogeneity within a segment. Common choices include Least Squares Deviation (detects mean shifts), Gaussian Negative Log-Likelihood (detects mean and variance shifts), and Kernel-Based Costs (detects distributional changes without parametric assumptions).
• Search Methods: PELT (Pruned Exact Linear Time) provides an exact solution efficiently. Binary Segmentation is a greedy, computationally cheaper approximation. Segment Neighborhood is exact but computationally expensive, scaling quadratically with data points.

Change points are categorized by the statistical moment they affect:

• Mean Shift: An abrupt jump or drop in the average level of a signal. In a RAN, this corresponds to a sudden increase in average latency after a routing misconfiguration. Detected well by CUSUM.
• Variance Shift: A change in the volatility or dispersion of the signal, even if the mean remains constant. This manifests as an increase in jitter or signal instability, often a precursor to a link flap. Detected by monitoring changes in the squared residual of a model.

A critical distinction in time-series analysis:

• Change Point Detection identifies a persistent, structural shift in the system's operating regime. The signal does not return to its previous state. Example: A permanent reconfiguration of a cell's antenna tilt.
• Anomaly Detection identifies a transient, outlying observation that deviates from the norm but does not represent a new regime. The signal returns to baseline. Example: A single, brief spike in CPU utilization due to a cron job.
• Change points often cause a subsequent flood of point anomalies until the detection model adapts to the new normal.

In AI-enhanced RANs, change point detection acts as a sentinel for configuration and environmental shifts:

• Cell Sleeping Activation: Detecting the exact moment a power-saving feature deactivates a carrier, causing a step-change in available Physical Resource Blocks (PRBs).
• Interference Onset: Identifying the abrupt increase in the Noise Floor when a neighboring cell begins transmitting on an overlapping frequency.
• Traffic Engineering: Spotting a sudden, sustained shift in the uplink/downlink traffic ratio, triggering a TDD slot reconfiguration. This is a multivariate mean shift problem.

A phenomenon in online learning where the statistical properties of the target variable change over time. Unlike an abrupt change point, concept drift can be gradual or incremental, causing model performance to degrade silently. Change point detection algorithms are often deployed to identify the exact moment a drift event transitions from a slow shift to a critical failure in a network's predictive model.

The broader discipline of identifying unexpected patterns in sequential data. Change point detection is a specialized subset focused on structural breaks in the generative process, rather than isolated outlier points. Key distinctions include:

• Point anomalies: A single spike in latency
• Change points: A permanent shift in the mean latency baseline
• Collective anomalies: An unusual sequence that is not a permanent shift

A technique that deconstructs a time series into trend, seasonal, and residual components. Change point detection algorithms often operate on the residual component after removing known seasonality. For example, a sudden change in the residual variance of hourly call attempts, after accounting for daily business cycles, signals a network fault rather than a normal traffic fluctuation.

The systematic process of identifying the fundamental origin of a fault. Change point detection provides the precise temporal anchor for RCA by answering when the system state changed. Correlating a detected change point in a KPI with a timestamped configuration push, software upgrade, or external event is the first step in automated incident remediation workflows.

The Cumulative Sum control chart is a classical sequential analysis technique designed specifically for change point detection. It accumulates deviations from a target mean and triggers an alarm when the cumulative sum exceeds a threshold. CUSUM is highly sensitive to small, persistent shifts in the process mean and remains a benchmark algorithm in network telemetry monitoring for detecting subtle degradation.