Rethinking Telemetry Design for Fine-Grained Anomaly Detection in 5G User Planes

2025-10-31

AI Summary

In 5G user-plane QoS anomaly detection, achieving fine-grained flow-level visibility while minimizing telemetry overhead remains challenging. To address this, we propose Histogram-enhanced Count-Min Sketch (HCMS), a lightweight telemetry scheme. HCMS integrates a queue-partitioning mechanism and collision-aware detectability theory to enable efficient, lossless compression and aggregation of critical distributional metrics—including latency tails and packet inter-arrival intervals—while preserving all anomalous signals. Evaluated on an Intel Tofino-based 5G testbed, HCMS achieves a 10% improvement in detection accuracy and reduces telemetry export bandwidth by one order of magnitude compared to selective postcard sampling. Notably, it establishes the first Pareto-optimal trade-off between accuracy and overhead at sub-flow granularity, enabling high-fidelity, low-cost QoS monitoring for 5G networks.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Planning, Routing, and Scheduling: Plan Execution and Monitoring
• Machine Learning: Hardware-aware ML

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for incomplete, noisy, or partially observed Web-related graphs

Abstract

Detecting QoS anomalies in 5G user planes requires fine-grained per-flow visibility, but existing telemetry approaches face a fundamental trade-off. Coarse per-class counters are lightweight but mask transient and per-flow anomalies, while per-packet telemetry postcards provide full visibility at prohibitive cost that grows linearly with line rate. Selective postcard schemes reduce overhead but miss anomalies that fall below configured thresholds or occur during brief intervals. We present Kestrel, a sketch-based telemetry system for 5G user planes that provides fine-grained visibility into key metric distributions such as latency tails and inter-arrival times at a fraction of the cost of per-packet postcards. Kestrel extends Count-Min Sketch with histogram-augmented buckets and per-queue partitioning, which compress per-packet measurements into compact summaries while preserving anomaly-relevant signals. We develop formal detectability guarantees that account for sketch collisions, yielding principled sizing rules and binning strategies that maximize anomaly separability. Our evaluations on a 5G testbed with Intel Tofino switches show that Kestrel achieves 10% better detection accuracy than existing selective postcard schemes while reducing export bandwidth by 10x.

Problem

• Detecting QoS anomalies in 5G user planes
• Overcoming telemetry cost-visibility trade-offs
• Providing fine-grained per-flow anomaly visibility

Innovation

• Sketch-based telemetry system for 5G user planes
• Histogram-augmented buckets with per-queue partitioning
• Formal detectability guarantees with principled sizing rules