Z-Score

The Z-Score is calculated as Z = (X - μ) / σ, where X is the raw data point, μ is the population mean, and σ is the population standard deviation.

• A Z-Score of 0 means the data point is identical to the mean.
• A Z-Score of +3 indicates the point is three standard deviations above the mean.
• A Z-Score of -3 indicates the point is three standard deviations below the mean.

In normally distributed data, approximately 99.7% of values fall within ±3 standard deviations, making |Z| > 3 a common default threshold for anomaly flagging.

The standard Z-Score interpretation relies on the assumption that the underlying data follows a Gaussian (normal) distribution. In telemetry, this is often violated.

• Network metrics like latency and packet loss frequently exhibit heavy-tailed or skewed distributions.
• Applying Z-Score to non-normal data inflates the false positive rate, triggering alerts on legitimate but rare high-latency events.
• Mitigation involves applying a data transformation (e.g., log transform) or using a modified Z-Score based on the Median Absolute Deviation (MAD) for robust outlier detection.

Z-Score analysis examines each metric in isolation, making it blind to multivariate anomalies where the relationship between variables breaks down.

• A CPU temperature of 75°C might have a low Z-Score if the historical mean is 70°C.
• However, if the CPU load is simultaneously at 5%, the combination is highly anomalous despite neither metric individually exceeding a threshold.
• This limitation necessitates complementing Z-Score with techniques like Mahalanobis distance or autoencoder reconstruction error for holistic system monitoring.

Z-Score is computationally trivial, making it ideal for high-throughput gRPC streaming telemetry pipelines where per-metric analysis must occur with sub-millisecond latency.

• A sliding window continuously updates the running mean (μ) and standard deviation (σ) using Welford's online algorithm.
• Incoming data points are immediately standardized and compared against a static or dynamic threshold.
• This lightweight footprint allows deployment directly on RAN Intelligent Controllers (RICs) without impacting the real-time control loop budget.

A critical weakness of the Z-Score is that the mean and standard deviation themselves are highly sensitive to the outliers they are meant to detect.

• If a massive traffic spike is included in the historical baseline window, it inflates the standard deviation, a phenomenon known as masking.
• This causes the Z-Score of subsequent, smaller anomalies to fall below the detection threshold.
• To prevent masking, baseline statistics should be calculated on a curated, anomaly-free training period or use robust estimators like the interquartile range (IQR).

Network traffic exhibits strong seasonality (hourly, daily, weekly patterns). A global mean is useless for detecting a midnight traffic surge.

• Instead of a single μ and σ, Z-Scores are calculated against a seasonal baseline: the mean and standard deviation for this specific hour of the week over the past month.
• This contextual anomaly detection prevents false alarms during predictable peak hours while catching genuine deviations.
• Advanced implementations use time-series decomposition (STL) to Z-Score the residual component after removing trend and seasonality.