Multivariate Anomaly Detection

Unlike univariate methods that monitor metrics in isolation, multivariate detection analyzes the covariance structure between variables. An anomaly is flagged when the relationship between two or more metrics breaks from the learned norm, even if each individual metric appears within its expected range. For example, in a base station, a normal rise in CPU usage accompanied by a proportional increase in throughput is expected, but high CPU with flat or declining throughput indicates a fault. This requires algorithms like Mahalanobis distance or autoencoders that model the full feature space.

High-dimensional telemetry data is often projected into a lower-dimensional latent space to make anomaly detection computationally feasible and to denoise the signal. Principal Component Analysis (PCA) finds orthogonal axes of maximum variance, where anomalies are identified by a high reconstruction error in the residual subspace. More advanced non-linear techniques like t-SNE or autoencoder bottleneck layers preserve the manifold structure of normal data, making subtle deviations more apparent when data points fail to map cleanly to the learned manifold.

Multivariate time-series anomaly detection must account for lagged correlations and dynamic dependencies. A spike in one metric may not cause an anomaly in another until several time steps later. Architectures like Long Short-Term Memory (LSTM) networks and Transformers with attention mechanisms are employed to capture these long-range temporal dependencies. The model learns the expected sequence of joint states; a break in this sequence, such as a handover failure rate rising without a preceding increase in signal interference, constitutes a collective anomaly.

Network behavior is non-stationary; the definition of 'normal' shifts with traffic patterns throughout the day. Multivariate models must adapt to concept drift without retraining from scratch. Techniques include online learning with exponential forgetting factors, where older data is weighted less, and ensemble methods that maintain a pool of models trained on different time windows. This prevents false positives during a routine busy hour while still detecting true anomalies, like a DDoS attack that distorts the normal correlation between packet rate and unique source IPs.

A key challenge is moving beyond a binary anomaly score to identify which specific features caused the alert. SHAP (SHapley Additive exPlanations) values decompose the anomaly score to attribute blame to individual input variables. For deep learning models, attention weights from a Transformer can highlight the time steps and features most responsible for the deviation. This capability is critical for Root Cause Analysis (RCA) in a Network Operations Center, allowing engineers to immediately investigate the specific KPIs that broke their expected correlation.

In a cellular network, the state of one base station is causally linked to its neighbors through interference and handover patterns. Graph Neural Networks (GNNs) model this topology explicitly, treating cells as nodes and neighbor relations as edges. An anomaly is detected not just by a node's own features but by a deviation in the aggregated state of its local graph neighborhood. This spatial awareness allows the system to distinguish a localized hardware fault from a wider regional outage by analyzing the propagation pattern of the anomaly across the graph.

A neural network trained to reconstruct its input through a bottleneck layer that compresses data into a lower-dimensional latent representation. Anomalies are detected by high reconstruction error.

• Training: Learns only on normal operational data to encode the manifold of expected behavior.
• Multivariate Advantage: Captures complex, non-linear interactions between all telemetry features simultaneously.
• Application: Effective for detecting subtle collective anomalies where individual KPIs appear normal but their joint state is aberrant.

A linear dimensionality reduction technique that projects data onto orthogonal axes of maximum variance. Anomalies are identified by their high reconstruction error from a subspace of principal components.

• Mechanism: The majority of normal variance is captured by the first k components; anomalies violate this correlation structure.
• Interpretability: Each principal component is a linear combination of original features, offering insight into which variables contribute to an anomaly.
• Limitation: Assumes linear correlations, making it less effective for complex non-linear relationships compared to autoencoders.

A support vector machine variant trained exclusively on normal data to learn a decision boundary that encapsulates the majority of training points in a high-dimensional feature space.

• Kernel Trick: Uses radial basis function (RBF) kernels to model complex, non-linear decision boundaries.
• Parameter Sensitivity: The nu parameter controls the upper bound on the fraction of training errors, directly influencing the model's tolerance to outliers in the training set.
• Use Case: Highly effective for novelty detection when a clean, representative dataset of normal network behavior is available.

A density-based clustering algorithm that groups tightly packed data points and labels points in low-density regions as noise or anomalies. It does not require pre-specifying the number of clusters.

• Core Parameters: eps defines the neighborhood radius, and min_samples defines the minimum points to form a dense region.
• Multivariate Application: Identifies anomalies as points that do not belong to any cluster of normal operational modes in the joint feature space.
• Advantage: Can discover clusters of arbitrary shape and is robust to outliers, making it suitable for identifying distinct normal operating regimes in a RAN.

A recurrent neural network architecture designed to learn long-term dependencies in sequential data, making it ideal for time-series anomaly detection in network telemetry.

• Mechanism: Uses gating mechanisms (input, forget, output gates) to control information flow, mitigating the vanishing gradient problem.
• Multivariate Forecasting: Can ingest multiple correlated telemetry streams to predict a future window; anomalies are significant deviations from the prediction.
• Pattern Recognition: Learns complex temporal patterns like seasonality and trends across all input features simultaneously, detecting subtle precursors to failures.