Seasonal Decomposition

The trend represents the long-term directional movement of the series after removing seasonal and random fluctuations. It captures the underlying secular progression of the metric—whether network throughput is gradually increasing due to subscriber growth or declining due to equipment aging.

• Computed via moving averages or LOESS smoothing
• In additive models: Y(t) = Trend(t) + Seasonal(t) + Residual(t)
• In multiplicative models: Y(t) = Trend(t) × Seasonal(t) × Residual(t)
• Essential for distinguishing capacity exhaustion from transient anomalies

The seasonal component captures repeating, fixed-period patterns in the data—such as hourly traffic peaks during business hours or weekly dips on weekends. These are deterministic cycles with known periodicity.

• Period must be known a priori (e.g., 24 hours, 7 days, 1 month)
• Extracted via differencing at the seasonal lag or Fourier decomposition
• In telecom RAN data: diurnal call volume patterns, weekend data usage surges
• Removing this component prevents false positives during predictable peak hours

The residual (or irregular) component is what remains after subtracting trend and seasonality. This is the primary target for anomaly detection—it should approximate white noise under normal conditions.

• Anomalies manifest as large residual spikes exceeding a threshold (e.g., 3-sigma rule)
• Residuals should be stationary with zero mean and constant variance
• Autocorrelation in residuals indicates incomplete decomposition
• Real example: A sudden 5x residual spike in call drop rate at 3 AM signals a fault, not normal low-traffic behavior

Choosing between additive and multiplicative decomposition depends on whether the seasonal amplitude is constant or proportional to the trend level.

• Additive: Seasonal magnitude remains constant regardless of trend level. Use when variance is stable. Example: temperature readings in a climate-controlled data center.
• Multiplicative: Seasonal amplitude scales with the trend. Use when variance grows with level. Example: network traffic where peak-hour volume increases proportionally with subscriber count.
• Pseudo-additive: A hybrid for series with zero values, combining additive trend with multiplicative seasonality
• Mis-specification leads to residual contamination, where seasonal patterns leak into the residual component and trigger false alarms

Seasonal-Trend decomposition using LOESS (STL) is a robust, versatile algorithm that handles complex seasonality and is resistant to outliers. It is the preferred method for modern network telemetry analysis.

• Uses locally weighted regression (LOESS) to smooth subseries
• Handles any seasonal period (not just integer values)
• Robust weighting downweights outliers during decomposition, preventing anomaly contamination
• Supports seasonal component evolution over time, unlike classical methods
• Implemented in Python via statsmodels.tsa.seasonal.STL
• Ideal for RAN KPIs with evolving traffic patterns due to network upgrades

After decomposition, the Z-score of each residual point quantifies its deviation from the residual mean in units of standard deviation. This is the simplest and most interpretable anomaly detection method.

• Formula: Z = (Residual(t) - μ_residual) / σ_residual
• Common threshold: |Z| > 3 flags a point as anomalous (3-sigma rule)
• Assumes residuals are normally distributed—validate with a Q-Q plot
• Dynamic thresholding adapts μ and σ over sliding windows to handle concept drift
• Limitation: Univariate—only analyzes one KPI at a time. For correlated metrics (e.g., latency and throughput), use multivariate residual analysis with Mahalanobis distance

The long-term directional movement in a time series after removing seasonal and irregular fluctuations. It represents the underlying data trajectory over extended periods.

• Linear Trend: A constant rate of increase or decrease.
• Non-Linear Trend: Acceleration, deceleration, or structural breaks in the direction.
• Extracted using moving averages or polynomial regression.
• In network telemetry, a rising trend in baseband unit CPU utilization may indicate a need for capacity expansion, independent of daily usage cycles.

The examination of the irregular component left after extracting trend and seasonality. This is the primary signal for anomaly detection.

• A well-decomposed series should leave residuals that are stationary white noise with a mean near zero.
• Anomalies manifest as large spikes or structural patterns in the residuals.
• Statistical tests like the Ljung-Box test verify that residuals are independently distributed.
• A sudden cluster of high-magnitude residuals in handover success rates could signal a faulty neighbor cell configuration.

Seasonal-Trend decomposition using Loess, a robust and versatile filtering method that handles any seasonal periodicity and is resistant to outliers.

• Unlike classical decomposition, STL can model a time-varying seasonal component that evolves over time.
• Controlled by parameters for seasonal window and trend smoothness.
• Handles missing data gracefully.
• Preferred for network telemetry where seasonal patterns (e.g., traffic load) may change as a city's population or infrastructure evolves.

The two fundamental decomposition structures defining how components interact.

• Additive Model: Data = Trend + Seasonal + Residual. Used when the magnitude of seasonal fluctuations is constant, regardless of the trend level.
• Multiplicative Model: Data = Trend × Seasonal × Residual. Used when seasonal amplitude scales proportionally with the trend.
• In telecom, call volume is often multiplicative: a 10% traffic growth trend amplifies the absolute difference between peak and off-peak hours.

A transformation technique used to stabilize the mean of a time series by subtracting the previous observation from the current one.

• First-order differencing removes a linear trend.
• Seasonal differencing (subtracting the value from the same period in the previous cycle) removes a stable seasonal pattern.
• A core preprocessing step before applying models like ARIMA.
• Often used as an alternative or precursor to explicit decomposition when the goal is to feed a stationary signal into a forecasting algorithm.

An extension of the ARIMA model that explicitly incorporates seasonal autoregressive and moving average components.

• Defined by parameters (p,d,q)(P,D,Q)s, where s is the seasonal period.
• Models both the non-seasonal and seasonal dependencies in a single integrated framework.
• Highly effective for forecasting metrics with strong, predictable cycles, such as hourly network throughput.
• Unlike simple decomposition, SARIMA provides formal prediction intervals for anomaly thresholds.