KPI-Aware Multimodal Anomaly Detection for 5G and Open RAN Telemetry

Chiman Salavati; Liang Wu; Kelly Wan; Mayank Darbari; Liangjie Hong

cs.LGOct 18, 2026

KPI-Aware Multimodal Anomaly Detection for 5G and Open RAN Telemetry

Authors: Chiman Salavati, Liang Wu, Kelly Wan, Mayank Darbari, Liangjie Hong

Organizations: University of Connecticut, Storrs, Connecticut, USA · Nokia, Sunnyvale, California, USA

Abstract

Reliable anomaly detection is a deployment bottleneck for 5G/Open RAN observability and emerging self-optimizing 6G systems, where hundreds of heterogeneous KPIs, severe class imbalance, and strict alert budgets make purely numerical scores brittle. We present KAC, a deployment-oriented KPI-aware multimodal anomaly-detection framework that uses KPI-level residual-text alignment to turn compact operator-style summaries into a learnable feedback signal over full-KPI temporal evidence. This gives the detector broad numerical coverage like modern time-series models, while retaining the sparse KPI-specific reasoning that makes operator feedback sustainable in a future operator-facing workflow. Across public telecom telemetry, enterprise-scale Open RAN observability data, and a Nokia benchmark built from real 5G RAN production packet traces with realism-hardened injected anomalies, KAC achieves strong threshold-based detection performance while remaining competitive on threshold-free ranking metrics. On TelecomTS, at a fixed 2.5 percent false-positive-rate operating point, KAC achieves the highest recall among the evaluated residual-based methods while maintaining comparable precision; across the evaluated benchmarks, it remains robust under substantial class imbalance. KAC is integrated in pre-production shadow mode with Nokia's GKE-based KPI construction pipeline, where it continuously scores telemetry windows alongside an internal packet-level anomaly detector for operational evaluation.

Figures & tables

Fig. 1: Overview of KAC. A frozen forecasting backbone yields per-KPI residual and uncertainty features, while a compact KPI-aware text summary is encoded into token representations. Learnable KPI queries extract per-KPI text representations, and a shared projector produces matched per-KPI residual representations; the two views of each KPI are aligned by an uncertainty-weighted contrastive objective, while gated multimodal fusion produces the window-level anomaly prediction.

Supervised methods
	Scenario 1					Scenario 2
Method	Prec.	Rec.	F1	AUROC	AP	Prec.	Rec.	F1	AUROC	AP
QR-TAN (ctx=20)	.954 $\pm$ .025	.894 $\pm$ .018	.923 $\pm$ .007	.974 $\pm$ .007	.978 $\pm$ .005	.738 $\pm$ .092	.700 $\pm$ .000	.716 $\pm$ .042	.919 $\pm$ .026	.762 $\pm$ .035
Chronos-2 + LR	.916 $\pm$ .000	.887 $\pm$ .000	.901 $\pm$ .000	.967 $\pm$ .000	.970 $\pm$ .000	.643 $\pm$ .000	.900 $\pm$ .000	.750 $\pm$ .000	.913 $\pm$ .000	.842 $\pm$ .000
MOMENT + linear	.806 $\pm$ .026	.775 $\pm$ .034	.789 $\pm$ .013	.895 $\pm$ .009	.901 $\pm$ .010	.132 $\pm$ .022	.620 $\pm$ .130	.218 $\pm$ .038	.796 $\pm$ .016	.245 $\pm$ .027
Mantis + linear	.931 $\pm$ .000	.927 $\pm$ .000	.929 $\pm$ .000	.980 $\pm$ .000	.982 $\pm$ .000	.667 $\pm$ .000	1.00 $\pm$ .000	.800 $\pm$ .000	.995 $\pm$ .000	.926 $\pm$ .000

TABLE II: Experimental results on TelecomTS under balanced and imbalanced test settings.

Dataset	Variant	Precision	Recall	F1	AUROC	AP
TelecomTS	V1: Residual-only	0.943 $\pm$ 0.015	0.895 $\pm$ 0.016	0.918 $\pm$ 0.010	0.972 $\pm$ 0.004	0.976 $\pm$ 0.002
	V2: + Text fusion	0.967 $\pm$ 0.010	0.953 $\pm$ 0.011	0.960 $\pm$ 0.007	0.987 $\pm$ 0.004	0.988 $\pm$ 0.005
	V3: KAC (ours)	0.961 $\pm$ 0.016	0.960 $\pm$ 0.009	0.960 $\pm$ 0.004	0.988 $\pm$ 0.002	0.988 $\pm$ 0.003
SpotLight	V1: Residual-only	0.920 $\pm$ 0.008	0.953 $\pm$ 0.013	0.937 $\pm$ 0.007	0.975 $\pm$ 0.006	0.968 $\pm$ 0.009
	V2: + Text fusion	0.931 $\pm$ 0.012	0.951 $\pm$ 0.014	0.940 $\pm$ 0.010	0.974 $\pm$ 0.011	0.967 $\pm$ 0.022
	V3: KAC (ours)	0.939 $\pm$ 0.006	0.961 $\pm$ 0.011	0.950 $\pm$ 0.003	0.986 $\pm$ 0.005	0.984 $\pm$ 0.006

TABLE VIII: Component ablation on benchmarks. V1 removes text, V2 adds text fusion, and V3 adds KPI-level contrastive alignment.

Multimodal Anomaly Detection

Multimodal anomaly detection identifies unusual patterns by combining complementary signals such as images, depth, video, text, and sensor data.

See all 97 papers

DAST: A VLM-LLM Framework for Cross-Interface Anomaly Detection in O-RAN
Jun 4, 2026Francesco Spinelli, Esteban Municio, Pau Baguer +2Wireless Communications Open Radio Access Network
i2CAT Foundation · NEC Laboratories Europe · ICREA
Scalable Context-Aware Graph Attention for Unsupervised Anomaly Detection in Large-Scale Mobile Networks
May 1, 2026Sara Malacarne, Eirik Hoel-Høiseth, Erlend Aune +2Graph Attention Networks Reconstruction-Based Anomaly Detection
Telenor Research and Innovation, Norway · Norwegian University of Science and Technology (NTNU), Norway · Hance, Norway +2
Context-Aware Graph Attention for Unsupervised Telco Anomaly Detection
Apr 29, 2026Sara Malacarne, Eirik Hoel-Høiseth, Erlend Aune +2Graph Attention Networks Reconstruction-Based Anomaly Detection
Telenor Research and Innovation, Norway · Norwegian University of Science and Technology (NTNU), Norway · Hance, Norway +2

Jun 4, 2026J/K move · Enter open · S save

DAST: A VLM-LLM Framework for Cross-Interface Anomaly Detection in O-RAN

Francesco Spinelli, Esteban Municio, Pau Baguer, Gines Garcia-Aviles+1

i2CAT Foundation · NEC Laboratories Europe · ICREA

Wireless Communications Open Radio Access Network Multimodal Anomaly Detection Zero-Shot Anomaly Detection Time-Series Anomaly Detection Anomaly Detection

Open paper AskPDF arXiv

O-RAN enables a disaggregated baseband stack with programmable functions that communicate over standardized open interfaces. The same openness that enables multi-vendor composition also expands the attack surface across logically decoupled tiers that make up the compute continuum. Among these threats, Denial-of-Service and performance-degradation attacks, which account for the majority of catalogued O-RAN threats, are particularly difficult to detect. Traditional Time-Series Anomaly Detection (TSAD) methods fail in this new regime where labelled baselines are scarce, threats evolve faster than detectors can be retrained, and the high-dimensional multivariate telemetry overwhelms monolithic inference models. To address these challenges, we present DAST, a zero-shot multi-agent framework for cross-interface anomaly detection in O-RAN that chains a three-stage VLM

\rightarrow

LLM

\rightarrow

VLM pipeline. DAST converts multivariate KPI streams into visual representations, scores textual per-interface descriptions against O-RAN domain knowledge, and verifies suspects on high-resolution heatmaps to output the problematic interfaces, the anomalous time intervals, an indicative O-RAN WG11-aligned operational impact rating and the decision rationale. We evaluate DAST on real network traces collected from an O-RAN testbed under representative performance degradation scenarios, achieving 0.910 F1-Score and 0.843 Accuracy, outperforming state-of-the-art TSAD baselines.

Abstract

Multimodal Anomaly Detection

Explore similar work

DAST: A VLM-LLM Framework for Cross-Interface Anomaly Detection in O-RAN

Scalable Context-Aware Graph Attention for Unsupervised Anomaly Detection in Large-Scale Mobile Networks

Context-Aware Graph Attention for Unsupervised Telco Anomaly Detection