Adaptive Alarm Threshold Prediction in 4G Mobile Networks: A Percentile-Guided Deep Learning Framework with Interpretable Outputs

Ayon Roy; Sadman Sharif; Shiva Prasad Sarkar

cs.NIApr 4, 2026

Adaptive Alarm Threshold Prediction in 4G Mobile Networks: A Percentile-Guided Deep Learning Framework with Interpretable Outputs

Authors: Ayon Roy, Sadman Sharif, Shiva Prasad Sarkar

Abstract

In mobile telecommunications, alarms act as early warning signals. They are triggered when a cell, the basic unit of radio coverage, shuts down or behaves abnormally. This signals a degradation in service quality, which directly affects the customer experience. To fix the issue, operators rely on preset thresholds to decide when an engineer should be sent out. In practice, these thresholds are set manually and remain fixed regardless of the time of day, traffic levels, or overall network conditions. This often leads to serious faults slipping through during busy hours, while minor issues can cause unnecessary callouts when the network is quiet. This paper presents a machine learning framework that automatically predicts four alarm thresholds, audit window duration, inactive time limit, total fluctuation count, and per hour fluctuation limit, from live network behavior. Since no ground truth labels exist for thresholds, we introduce a percentile guided label derivation strategy and evaluate four models on an anonymized dataset of 10,648 cells across three vendors and nine regions from a real 4G network, comprising a Gradient Boosted Trees baseline, a CNN-BiLSTM with attention, the proposed PCTN, and an iTransformer. PCTN performs the best overall with respect to three of the four targets, outperforming a state-of-the-art iTransformer while using 83 percent fewer parameters. Its mixed output heads and dynamic alpha mechanism produce thresholds that are both accurate and interpretable, allowing operators to inspect and adjust the learned policy without retraining. All comparisons are statistically significant at p < 0.001. The framework undergoes daily retraining using new data, which enables the thresholds to constantly adjust to changes in the network.

Figures & tables

Property	Value
Total cell day records	14,054
Unique cells	10,648
Observation dates	10 days
Equipment vendors	3
Geographic regions	9
Alarm snapshots per day (approx.)	144

Table 1: Dataset characteristics.

Figure 1: Vendor distribution and record count per geographic region.

Statistic	Inactive Time (min)	Fluctuation Count
Median	15.4	2
75th percentile	68.1	3
90th percentile	236.8	4
Maximum	1,256.1	66
Below floor ( $\leq$ 15 min inactive / $\leq$ 1 fluctuation)	49.6%	23.2%
Above 2 hours / above 10	19.1%	N/A

Table 2: Statistical summary of the two primary target variables.

Figure 2: Left : mean inactive time per hour. Right : date wise heatmap of mean hourly inactive time.

Figure 3: Adaptive Alarm Threshold Prediction Framework.

Figure 4: CNN-BiLSTM with Multi-Head Attention Architecture.

Figure 6: Standard Transformer vs iTransformer: The Feature-Inversion Concept.

Model	Parameters	Optimizer	Epochs	Loss Function	Hardware
XGBoost	N/A	Gradient	300	Pseudo-Huber	CPU
CNN-BiLSTM	1,153,732	AdamW	50	Huber ( $\delta=1.0$ )	GTX 1650 Ti
PCTN	142,261	AdamW	60	CE + Pinball + BCE	GTX 1650 Ti
iTransformer	818,508	AdamW	60	Quantile (3-head)	T4 GPU

Table 3: Training configuration summary.

Figure 7: PCTN Training and Validation Loss.

Metric	Target	XGBoost	CNN-BiLSTM	PCTN	iTransformer
MAE	threshold_hours	1.2010	0.2361	0.0224 $\ast$	0.0843
	threshold_inactive_min	143.3483	1.3773	1.0638 $\ast$	1.1328
	threshold_fluctuation	0.0137 $\ast$	0.0838	0.0348	0.0532
	each_hour_fluctuation	0.0137 $\ast$	0.0734	0.0380	0.0578
	Average	36.1442	0.4427	0.2898 $\ast$	0.3320
RMSE	threshold_hours	2.5481	0.4439	0.1470 $\ast$	0.1542

Table 4: Overall model performance across all targets. Best values per row are marked with

\ast

Target	Mean $\alpha$	Std $\alpha$
threshold_hours	4.073	0.768
threshold_inactive_min	14.183	2.678
threshold_fluctuation	0.688	0.121
each_hour_fluctuation	0.144	0.077

Table 5: Dynamic alpha statistics across the test set.

Figure 8: Dynamic Alpha ( $\alpha$ ) Distribution Across Test Samples.

Target	Average Spread
threshold_hours	0.19 hours
threshold_inactive_min	1.02 minutes
threshold_fluctuation	0.01
each_hour_fluctuation	0.02

Table 6: Average quantile spread (

P10

P90

) for iTransformer predictions.

Interpretable ML

Interpretable machine learning develops models and explanations that make predictions, evidence, and decision processes understandable to people.

See all 301 papers

Oct 13, 2026

CALM-5G: Event-Level Conformal Risk Control for Predictive Service-Assurance Alarms

Predictive service assurance converts forecasts of key performance indicators into alarms, and that conversion decides whether the assurance function is deployable. We present CALM-5G, an assurance layer that operates above any forecasting backbone and issues alarms with distribution-free, finite-sample guarantees. It calibrates on service-level violation events, scores violation onset directly, selects its calibration scheme out of sample, and reports the alarm duty cycle with every certified miss rate. Four corpora are evaluated separately, namely a production cellular network, commercial 5G traces, an open radio access network testbed and our 5G standalone testbed. Risk control on the regression-derived score yields duty cycles of 0.24 to 0.91. Onset targeting with cross-validated calibration reduces time-in-alarm by 56.3% to 89.7% on three corpora, with no significant change on the fourth. The realised miss rate stays within a two-standard-error tolerance on three corpora and within one standard error of it on the fourth. Under label shift, pooled batch calibration exceeds that tolerance structurally, by 10.9 standard errors on the production corpus. Online calibration restores compliance. Calibration schemes cannot be ranked on the split that fits their thresholds. Miss rate and duty cycle are certified jointly where within-entity dependence leaves sufficient calibration units.

Ömer Faruk İşcanlı, Yağmur Sabucu Sandal

Siemens A.¸S., Istanbul, Türkiye

Online Calibration Conformal Risk Control Model Calibration Conformal Prediction Wireless Communications

Ask PDF

Oct 3, 2026

Diffusion-Based Stress Testing of Overload Monitoring for Resilient Emergency Cellular Networks Using Internet CDR Proxies

Disasters can overload cellular control-plane signaling within minutes, yet fine-grained Radio Resource Control (RRC) or Next Generation (NG) Application Protocol (NGAP) telemetry is privacy-sensitive and costly to collect for analytics. Many emergency monitoring pipelines therefore rely on coarse Call Detail Record (CDR) aggregates. We treat Internet activity in CDR grids as a practical proxy for hidden signaling stress under that constraint. We train a lightweight convolutional neural network (CNN) on stylized overload injections, stress-test it with diffusion-synthesized surges that preserve normal traffic structure, and adapt the detector by retraining on hard synthetic samples. Under stress-test conditions, the default alert threshold fails even though receiver operating characteristic (ROC) curves stay strong: the detector still assigns overloaded cells a larger overload probability than normal cells, but those probabilities fall below the default cutoff 0.5 and are labeled normal, so the F1-maximizing threshold -- selected post hoc on the same stress-test grids (oracle

τ^*

) -- shifts by

0.32 \pm 0.03

(operating-point drift). Across three random seeds, hard-sample adaptation raises thresholded performance (F1) from 0% (no alerts at the default cutoff 0.5 on any seed) to

85.67 \pm 14.37

% and ranking from ROC-AUC

0.886 \pm 0.040

0.99996 \pm 0.00007

. Diffusion-synthesized surges expose threshold fragility that matched-condition training -- training and testing on the same stylized injections -- hides, and hard-sample adaptation restores usable alerts at the default cutoff. Together, these steps define a reusable pre-deployment stress test for emergency monitors. Internet-only CDR input further supports lightweight AI-native workflows that combine monitoring, recalibration, and adaptation.

Bilal Hussain, Xiao Tang, Tan Li +3

College of Professional and Continuing Education, The Hong Kong Polytechnic University, Hong Kong, China

Distribution Shift Robustness Wireless Communications

Ask PDF

Jul 20, 2026

Adaptive Two-Stage Online Learning for Service-Affecting Failure Detection in Mobile Core Networks

Mobile network operators monitor aggregated traffic volumes to assess the operational health of core network infrastructure. Reliable failure detection is challenging due to strong temporal structure, non-stationarity, measurement artefacts, and extreme class imbalance, which limit static threshold-based monitoring. This paper proposes a two-stage online learning framework for traffic-based failure detection in mobile core networks. Stage I incrementally models normal traffic dynamics using lightweight regression with time-aware features. Stage II analyses prediction residuals together with contextual indicators to detect genuine service-affecting network failures. The framework operates fully online under a prequential evaluation protocol, enabling continuous adaptation with low computational overhead. Across linear and non-linear models, the proposed two-stage architecture achieves the best precision-recall trade-off, attaining the highest recall, F1-score, and AUC at acceptable false positive rates. These results demonstrate the importance of explicit residual decomposition for reliable failure detection in streaming mobile core network data.

J. du Toit, G. Fita, J. Salzwedel +2

Department of Electrical and Electronic Engineering, Stellenbosch University, South Africa · Technology Strategy Planning, Architecture & Assurance, Vodacom Group Limited, South Africa · Core Data Networks Performance Management, Vodacom Group Limited, South Africa +1

Online Anomaly Detection Wireless Communications Time-Series Anomaly Detection Fault Diagnosis Anomaly Detection

Ask PDF

Abstract

Interpretable ML

Explore similar work

CALM-5G: Event-Level Conformal Risk Control for Predictive Service-Assurance Alarms

Diffusion-Based Stress Testing of Overload Monitoring for Resilient Emergency Cellular Networks Using Internet CDR Proxies

Adaptive Two-Stage Online Learning for Service-Affecting Failure Detection in Mobile Core Networks