Reliable anomaly detection is a deployment bottleneck for 5G/Open RAN observability and emerging self-optimizing 6G systems, where hundreds of heterogeneous KPIs, severe class imbalance, and strict alert budgets make purely numerical scores brittle. We present KAC, a deployment-oriented KPI-aware multimodal anomaly-detection framework that uses KPI-level residual-text alignment to turn compact operator-style summaries into a learnable feedback signal over full-KPI temporal evidence. This gives the detector broad numerical coverage like modern time-series models, while retaining the sparse KPI-specific reasoning that makes operator feedback sustainable in a future operator-facing workflow. Across public telecom telemetry, enterprise-scale Open RAN observability data, and a Nokia benchmark built from real 5G RAN production packet traces with realism-hardened injected anomalies, KAC achieves strong threshold-based detection performance while remaining competitive on threshold-free ranking metrics. On TelecomTS, at a fixed 2.5 percent false-positive-rate operating point, KAC achieves the highest recall among the evaluated residual-based methods while maintaining comparable precision; across the evaluated benchmarks, it remains robust under substantial class imbalance. KAC is integrated in pre-production shadow mode with Nokia's GKE-based KPI construction pipeline, where it continuously scores telemetry windows alongside an internal packet-level anomaly detector for operational evaluation.
Figures & tables
Fig. 1: Overview of KAC. A frozen forecasting backbone yields per-KPI residual and uncertainty features, while a compact KPI-aware text summary is encoded into token representations. Learnable KPI queries extract per-KPI text representations, and a shared projector produces matched per-KPI residual representations; the two views of each KPI are aligned by an uncertainty-weighted contrastive objective, while gated multimodal fusion produces the window-level anomaly prediction.
Scenario 1
Scenario 2
Method
Prec.
Rec.
F1
AUROC
AP
Prec.
Rec.
F1
AUROC
AP
Supervised methods
QR-TAN (ctx=20)
.954 ± .025
.894 ± .018
.923 ± .007
.974 ± .007
.978 ± .005
.738 ± .092
.700 ± .000
.716 ± .042
.919 ± .026
.762 ± .035
Chronos-2 + LR
.916 ± .000
.887 ± .000
.901 ± .000
.967 ± .000
.970 ± .000
.643 ± .000
.900 ± .000
.750 ± .000
.913 ± .000
.842 ± .000
MOMENT + linear
.806 ± .026
.775 ± .034
.789 ± .013
.895 ± .009
.901 ± .010
.132 ± .022
.620 ± .130
.218 ± .038
.796 ± .016
.245 ± .027
Mantis + linear
.931 ± .000
.927 ± .000
.929 ± .000
.980 ± .000
.982 ± .000
.667 ± .000
1.00 ± .000
.800 ± .000
.995 ± .000
.926 ± .000
TABLE II: Experimental results on TelecomTS under balanced and imbalanced test settings.
Dataset
Variant
Precision
Recall
F1
AUROC
AP
TelecomTS
V1: Residual-only
0.943 ± 0.015
0.895 ± 0.016
0.918 ± 0.010
0.972 ± 0.004
0.976 ± 0.002
V2: + Text fusion
0.967 ± 0.010
0.953 ± 0.011
0.960 ± 0.007
0.987 ± 0.004
0.988 ± 0.005
V3: KAC (ours)
0.961 ± 0.016
0.960 ± 0.009
0.960 ± 0.004
0.988 ± 0.002
0.988 ± 0.003
SpotLight
V1: Residual-only
0.920 ± 0.008
0.953 ± 0.013
0.937 ± 0.007
0.975 ± 0.006
0.968 ± 0.009
V2: + Text fusion
0.931 ± 0.012
0.951 ± 0.014
0.940 ± 0.010
0.974 ± 0.011
0.967 ± 0.022
V3: KAC (ours)
0.939 ± 0.006
0.961 ± 0.011
0.950 ± 0.003
0.986 ± 0.005
0.984 ± 0.006
TABLE VIII: Component ablation on benchmarks. V1 removes text, V2 adds text fusion, and V3 adds KPI-level contrastive alignment.
O-RAN enables a disaggregated baseband stack with programmable functions that communicate over standardized open interfaces. The same openness that enables multi-vendor composition also expands the attack surface across logically decoupled tiers that make up the compute continuum. Among these threats, Denial-of-Service and performance-degradation attacks, which account for the majority of catalogued O-RAN threats, are particularly difficult to detect. Traditional Time-Series Anomaly Detection (TSAD) methods fail in this new regime where labelled baselines are scarce, threats evolve faster than detectors can be retrained, and the high-dimensional multivariate telemetry overwhelms monolithic inference models. To address these challenges, we present DAST, a zero-shot multi-agent framework for cross-interface anomaly detection in O-RAN that chains a three-stage VLM → LLM → VLM pipeline. DAST converts multivariate KPI streams into visual representations, scores textual per-interface descriptions against O-RAN domain knowledge, and verifies suspects on high-resolution heatmaps to output the problematic interfaces, the anomalous time intervals, an indicative O-RAN WG11-aligned operational impact rating and the decision rationale. We evaluate DAST on real network traces collected from an O-RAN testbed under representative performance degradation scenarios, achieving 0.910 F1-Score and 0.843 Accuracy, outperforming state-of-the-art TSAD baselines.
Francesco Spinelli, Esteban Municio, Pau Baguer +2
i2CAT Foundation · NEC Laboratories Europe · ICREA
Mobile network operators must monitor thousands of heterogeneous network elements across the radio access network and the packet core, each exposing high-dimensional KPI time series. The scale and cost of incident labelling make supervised approaches impractical, motivating unsupervised anomaly detection robust to context shifts and nonstationarity. We propose C-MTAD-GAT (Context-aware Multivariate Time-series Anomaly Detection with Graph Attention), an anomaly detection framework designed to operate as a single shared model across large populations of network elements. The model combines temporal and feature-wise graph attention with lightweight static and dynamic context conditioning and a dual-head decoder for reconstruction and multi-step forecasting. It produces per-element, per-feature anomaly scores, converted to alerts via fully unsupervised thresholds calibrated from validation residuals. On the TELCO dataset released with DC-VAE \cite{garcia2023onemodel}, C-MTAD-GAT improves event-level affiliation and pointwise F1 while generating fewer alarms than prior graph-attention and VAE-based baselines. We then apply the same system to nation-scale radio access and evolved packet core control-plane counter data from a mobile network operator, where it is deployed. Operator feedback indicates the alerts are actionable and support daily monitoring, showing scalability across domains without relying on labelled incidents.
Sara Malacarne, Eirik Hoel-Høiseth, Erlend Aune +2
Telenor Research and Innovation, Norway · Norwegian University of Science and Technology (NTNU), Norway · Hance, Norway +2
We propose C-MTAD-GAT, an unsupervised, context-aware graph-attention model for anomaly detection in multivariate time series from mobile networks. C-MTAD-GAT combines graph attention with lightweight context embeddings, and uses a deterministic reconstruction head and multi-step forecaster to produce anomaly scores. Detection thresholds are calibrated without labels from validation residuals, keeping the pipeline fully unsupervised. On the public TELCO dataset, C-MTAD-GAT consistently outperforms MTAD-GAT and the Telco-specific DC-VAE, two state-of-the-art baselines, in both event-level and pointwise F1, while triggering substantially fewer alarms. C-MTAD-GAT is also deployed in the Core network of a national mobile operator, demonstrating its resilience in real industrial settings.
Sara Malacarne, Eirik Hoel-Høiseth, Erlend Aune +2
Telenor Research and Innovation, Norway · Norwegian University of Science and Technology (NTNU), Norway · Hance, Norway +2