Scalable Context-Aware Graph Attention for Unsupervised Anomaly Detection in Large-Scale Mobile Networks

2026-05-01

AI Summary

This work addresses the challenges of high annotation costs for high-dimensional heterogeneous KPI time series and the degradation of supervised methods under dynamically changing environments in large-scale mobile networks. To this end, we propose C-MTAD-GAT, a novel unsupervised anomaly detection framework that introduces context-aware graph attention mechanisms for the first time. Our approach jointly models temporal and feature-wise dependencies within a unified architecture, integrating lightweight static and dynamic context embeddings with a dual-head decoder—combining reconstruction and multi-step prediction—to produce fine-grained, element- and feature-level anomaly scores without requiring labeled data. Evaluated on the TELCO dataset, C-MTAD-GAT significantly outperforms GAT- and VAE-based baselines, achieving higher event-level alignment and point-level F1 scores while generating fewer alerts. The framework has been successfully deployed across nationwide radio access and core network control planes, receiving positive feedback from operational teams.

Abstract

Mobile network operators must monitor thousands of heterogeneous network elements across the radio access network and the packet core, each exposing high-dimensional KPI time series. The scale and cost of incident labelling make supervised approaches impractical, motivating unsupervised anomaly detection robust to context shifts and nonstationarity. We propose \textbf{C-MTAD-GAT} (\emph{Context-aware Multivariate Time-series Anomaly Detection with Graph Attention}), an anomaly detection framework designed to operate as a single shared model across large populations of network elements. The model combines temporal and feature-wise graph attention with lightweight static and dynamic context conditioning and a dual-head decoder for reconstruction and multi-step forecasting. It produces per-element, per-feature anomaly scores, converted to alerts via fully unsupervised thresholds calibrated from validation residuals. On the TELCO dataset released with DC-VAE \cite{garcia2023onemodel}, C-MTAD-GAT improves event-level affiliation and pointwise F1 while generating fewer alarms than prior graph-attention and VAE-based baselines. We then apply the same system to nation-scale radio access and evolved packet core control-plane counter data from a mobile network operator, where it is deployed. Operator feedback indicates the alerts are actionable and support daily monitoring, showing scalability across domains without relying on labelled incidents.

Problem

• unsupervised anomaly detection
• large-scale mobile networks
• context shifts
• nonstationarity
• heterogeneous network elements

Innovation

• Graph Attention
• Context-Aware
• Unsupervised Anomaly Detection
• Multivariate Time Series
• Scalable Monitoring