Adaptive Two-Stage Online Learning for Service-Affecting Failure Detection in Mobile Core Networks

# Adaptive Two-Stage Online Learning for Service-Affecting Failure Detection in Mobile Core Networks
Source: [https://arxiv.org/html/2607.18522](https://arxiv.org/html/2607.18522)
###### Abstract

Mobile network operators monitor aggregated traffic volumes to assess the operational health of core network infrastructure\. Reliable failure detection is challenging due to strong temporal structure, non\-stationarity, measurement artefacts, and extreme class imbalance, which limit static threshold\-based monitoring\.

This paper proposes a two\-stage online learning framework for traffic\-based failure detection in mobile core networks\. Stage I incrementally models normal traffic dynamics using lightweight regression with time\-aware features\. Stage II analyses prediction residuals together with contextual indicators to detect genuine service\-affecting network failures\. The framework operates fully online under a prequential evaluation protocol, enabling continuous adaptation with low computational overhead\.

Across linear and non\-linear models, the proposed two\-stage architecture achieves the best precision–recall trade\-off, attaining the highest recall, F1\-score, and AUC at acceptable false positive rates\. These results demonstrate the importance of explicit residual decomposition for reliable failure detection in streaming mobile core network data\.

## IIntroduction

Mobile network operators \(MNOs\) rely on continuous monitoring of aggregated traffic volumes to assess the health of their core networks\. The mobile core network \(MCN\) comprises the packet\-switched control and user\-plane infrastructure responsible for session management, mobility, authentication, policy enforcement, and routing of user traffic between the radio access network \(RAN\) and external data networks\. Traffic from multiple radio access technologies, access point names \(APNs\), and core network elements is aggregated per geographical region at fixed intervals, providing a scalable and technology\-agnostic view of system behaviour\.

Although aggregated traffic exhibits strong diurnal and weekly structure driven by human activity\[[16](https://arxiv.org/html/2607.18522#bib.bib9)\], it is inherently non\-stationary and subject to measurement artefacts such as counter overflows, partial capture,and delayed reporting\. These effects are not necessarily pervasive across all MNOs or deployments\. However, core network equipment commonly relies on incremental traffic counters with finite bit\-width, which can saturate or fail under sustained high load\. Service continuity is often maintained through redundancy or backup processing paths that remain transparent to subscribers, while counter information is lost or corrupted\. This results in abrupt apparent traffic drops that closely resemble genuine network failures, undermining static threshold\-based monitoring leading to high false alarm rates\.

Traditional threshold\-based systems remain widely used due to their simplicity, but they assume quasi\-stationary behaviour and require continuous manual tuning\. Predictable contextual effects such as weekends, holidays, and tariff changes frequently trigger false alarms, eroding trust in automated decision\-making systems\[[8](https://arxiv.org/html/2607.18522#bib.bib1),[4](https://arxiv.org/html/2607.18522#bib.bib2)\]\. As networks scale in complexity and load, these limitations increasingly constrain their operational usefulness\.

Prior work has explored statistical and learning\-based approaches to traffic anomaly detection, including residual analysis, change\-point detection, and deep learning models\[[2](https://arxiv.org/html/2607.18522#bib.bib3),[9](https://arxiv.org/html/2607.18522#bib.bib6),[10](https://arxiv.org/html/2607.18522#bib.bib7),[12](https://arxiv.org/html/2607.18522#bib.bib8)\]\. However, most approaches are trained offline and treat all deviations as a single anomaly class, conflating service\-impacting failures with benign measurement artefacts\. This limits robustness, interpretability, and operational trust in MCN environments\.

Network monitoring data is inherently generated as a data stream, motivating online learning approaches that adapt incrementally to evolving traffic patterns\[[14](https://arxiv.org/html/2607.18522#bib.bib4),[6](https://arxiv.org/html/2607.18522#bib.bib5)\]\. While recent work has explored online anomaly detection for networked systems\[[3](https://arxiv.org/html/2607.18522#bib.bib14),[13](https://arxiv.org/html/2607.18522#bib.bib13)\], most methods remain end\-to\-end and do not explicitly separate baseline traffic dynamics from failure detection\.

In contrast, this work proposes a two\-stage online learning architecture that decouples self\-supervised traffic baseline modelling from rare\-event failure detection\. By isolating predictable traffic dynamics before classification, the framework improves robustness under severe class imbalance, delayed labels, and measurement artefacts, while remaining computationally lightweight and operationally aligned\.

The proposed approach is intended to complement, rather than replace, existing core network failure detection systems\. Some failure modes may not manifest clearly in aggregated traffic and are therefore better captured by more granular monitoring tools\. Conversely, issues originating outside the mobile core network, such as failures in external service platforms, may still be reflected in aggregate traffic and can be detected by the proposed method\. Importantly, aggregated traffic is a primary revenue\-generating KPI for MNOs, and any service\-affecting disruption visible in this signal has direct commercial impact\. Even modest reductions in detection latency can therefore translate into meaningful operational and revenue benefits\.

The main contributions of this paper are:

- •A two\-stage online architecture separating baseline modelling and failure detection\.
- •Evaluation of time\-aware feature encodings under streaming constraints\.
- •Demonstration of strong performance and stability using lightweight online models on real operational MCN data\.

This work was carried out in collaboration with Vodacom Group Limited as part of an ongoing continuous improvement programme within the MCN performance management domain\.

## IIProblem Formulation

### II\-AOperational Interpretation of Traffic Anomalies

In aggregated MCN monitoring, deviations from expected traffic volumes may arise from fundamentally different causes\. In this work, we distinguish between two primary sources of anomalous behaviour: genuine network failures and measurement artefacts\.

A*network failure*corresponds to any condition under which the mobile network is unable to deliver normal service performance\. Such events may result from hardware or software faults, transmission failures, resource overload, or planned and unplanned maintenance, and are associated with real service impact experienced by subscribers\[[15](https://arxiv.org/html/2607.18522#bib.bib11)\]\.

A*measurement artefact*, by contrast, refers to a spurious deviation caused by errors in the collection, transmission, or aggregation of traffic counters\. Common sources include counter rollovers, partial or delayed reporting, and transient monitoring faults\. Although the underlying network may be operating normally, such artefacts can produce apparent traffic drops that closely resemble true failures, making them a major source of false alarms in traffic\-based monitoring systems\.

Distinguishing between these phenomena is critical, as they produce similar signatures in aggregated traffic data but require different operational responses\. The proposed framework is therefore designed to detect deviations from expected traffic dynamics while facilitating separation of genuine failures from benign measurement artefacts\.

Letyt∈ℝ≥0y\_\{t\}\\in\\mathbb\{R\}\_\{\\geq 0\}denote the observed downlink traffic volume for a given region during thett\-th 15\-minute interval, and letxtx\_\{t\}denote the associated vector of temporal and contextual features\. Observations arrive sequentially and form a time\-ordered data stream\{\(xt,yt\)\}t=1∞\\\{\(x\_\{t\},y\_\{t\}\)\\\}\_\{t=1\}^\{\\infty\}\.

The objective is to learn a model that estimates the expected, or*normal*, traffic dynamicsy^t=f​\(xt\)\\hat\{y\}\_\{t\}=f\(x\_\{t\}\)and to identify observations whose deviations from this expectation are inconsistent with normal operation\. Such deviations may arise from genuine network failures, benign measurement artefacts, or transient contextual effects\.

Unlike batch learning, the data generation process is inherently sequential: measurements must be processed in arrival order, and future observations are unavailable at training time\. Models are therefore trained and updated incrementally using online learning techniques, which more accurately reflect operational deployment conditions than offline training followed by static evaluation\[[14](https://arxiv.org/html/2607.18522#bib.bib4),[6](https://arxiv.org/html/2607.18522#bib.bib5)\]\.

An important practical consideration is data quality\. Missing, invalid, or corrupted measurements can bias learned baselines and degrade detection performance\. The proposed framework therefore supports selective learning, where model updates are restricted to observations whose quality can be assessed with confidence\.

### II\-BLimitations of Threshold\-Based Monitoring

Threshold\-based monitoring remains widely used in operational networks due to its simplicity and low computational cost\[[8](https://arxiv.org/html/2607.18522#bib.bib1),[4](https://arxiv.org/html/2607.18522#bib.bib2)\]\. Alarms are triggered when observed traffic exceeds predefined bounds, typically configured using historical averages or expert knowledge\.

Such approaches implicitly assume that acceptable traffic ranges are static or slowly varying, an assumption routinely violated in practice\. Mobile traffic exhibits strong diurnal and weekly cycles, calendar effects, and long\-term growth, causing fixed thresholds to generate false alarms during predictable low\-usage periods while missing genuine anomalies during peak demand\. Moreover, maintaining threshold\-based systems requires continuous manual tuning, which does not scale well across regions, technologies, and aggregation levels\.

### II\-CLearning\-Based Baseline Modelling

The approach proposed in this work replaces static thresholds with a learned, time\-adaptive baseline\. Rather than evaluating traffic against fixed limits, anomalies are assessed relative to model expectationsy^t\\hat\{y\}\_\{t\}that evolve over time, allowing the system to accommodate non\-stationarity, long\-term trends, and recurring temporal patterns without manual reconfiguration\.

Anomaly detection is formulated as a streaming prediction problem in which deviations betweenyty\_\{t\}andy^t\\hat\{y\}\_\{t\}define an anomaly score\. Continuous incremental learning enables automatic adaptation to changing traffic conditions and reduces reliance on heuristic rules, consistent with modern approaches to non\-stationary time\-series analysis\[[9](https://arxiv.org/html/2607.18522#bib.bib6),[12](https://arxiv.org/html/2607.18522#bib.bib8)\]\.

A central challenge is extreme class imbalance: normal operation and measurement artefacts occur frequently, while confirmed network failures are rare and labels are often delayed\. The proposed two\-stage architecture explicitly addresses this by decoupling self\-supervised baseline traffic modelling from failure classification\. Normal dynamics is learned from abundant streaming data, while failure detection operates on residuals and auxiliary indicators in a cost\-sensitive, semi\-supervised manner\. This design mitigates class imbalance, reduces dependence on scarce labels, and aligns the learning process with operational network workflows\.

## IIIDataset Description

### III\-AOverview

Figure[1](https://arxiv.org/html/2607.18522#S3.F1)illustrates a basic flow of user traffic through a mobile cellular network and the point at which measurements are collected for monitoring\. User traffic originates at the user equipment \(UE\), traverses the radio access network \(RAN\), and is routed through multiple core network elements before reaching external internet protocol \(IP\) networks\. Both uplink and downlink traffic follow this path in opposite directions\.

For operational monitoring, traffic counters are collected at individual core network elements and aggregated per geographical region at fixed 15\-minute intervals\. The total observed traffic volume for a region therefore represents the aggregate traffic routed through all reporting elements in that region during the interval\.

Traffic may traverse multiple core network elements within a region depending on routing, and the set of reporting elements can vary over time due to equipment failures, reconfigurations, or measurement artefacts\. As a result, aggregated traffic reflects both underlying user demand and the availability of the reporting infrastructure\. This coupling motivates a learning\-based monitoring approach that explicitly accounts for infrastructure dynamics when interpreting traffic deviations\.

![Refer to caption](https://arxiv.org/html/2607.18522v1/figures/core-network.png)Figure 1:Aggregated traffic flow in an MCN\. Traffic counters are collected per core network elementEEand aggregated per geographical regionRRat fixed 15\-minute intervals\.The data111To protect commercially sensitive information, the dataset was anonymised and rescaled in a manner that preserves relative trends and temporal behaviour but prevents recovery of absolute traffic values\.used in this study was collected during routine network performance monitoring and analysed as part of a continuous improvement initiative within Vodacom Group Limited’s core network performance management function\. The dataset consists of aggregated downlink traffic volume measurements with each observation corresponding to a region and time interval\.

Letyr,ty\_\{r,t\}denote the observed downlink traffic volume for regionrrat timett\. Traffic is obtained by aggregating counters across all network elementse∈Ee\\in Ethat successfully report during the interval:

yr,t=∑e=1Er,tye,r,t,y\_\{r,t\}=\\sum\_\{e=1\}^\{E\_\{r,t\}\}y\_\{e,r,t\},\(1\)whereEr,tE\_\{r,t\}denotes the number of reporting elements in regionrrat timett\. Variations inEr,tE\_\{r,t\}due to incomplete reporting or monitoring faults can induce apparent traffic drops even when the network is operating normally\.

The dataset is structured as a time\-ordered data stream, consistent with the operational setting in which measurements are generated continuously and processed in near real time, making it well suited for evaluating online learning methods\.

Ground\-truth network failure labels were obtained from operational incident and fault management records maintained by the MCN team\. A failure label was assigned to a region and time interval when a confirmed incident affecting service delivery was recorded and temporally aligned with the corresponding traffic measurement window\. Confirmation typically followed manual investigation and root cause analysis by network engineers\.

As a result, labels are subject to practical limitations, including delay, partial observability, and minor temporal misalignment between incident logs and traffic aggregation intervals\. The proposed framework explicitly accounts for this uncertainty by decoupling self\-supervised baseline learning from failure classification and supporting asynchronous incorporation of confirmed labels\.

### III\-BFeatures

For each 15\-minute interval, the following features are available:

- •Downlink traffic volume\(bytesDL\): total downlink traffic observed during the interval; the primary target variable\.
- •Number of network elements\(noElements\): number of core elements contributing counters during the interval\.
- •Number of access point names\(noAPNs\): number of APNs from which traffic was successfully recorded\.
- •Geographical region\(region\): categorical region identifier\.
- •Timestamp\(dateTime\): start time of the 15\-minute interval\.

### III\-CInfrastructure Effects on Traffic Measurements

Core network elements include routers, gateways, and virtualised network functions that collectively enable packet transport and service delivery\[[1](https://arxiv.org/html/2607.18522#bib.bib12)\]\.

At the time of data collection, two classes of elements were present\. Legacy elements were implemented as monolithic appliances and counted as a single reporting unit, while modern elements were virtualised using network function virtualisation \(NFV\), where a single logical function could comprise multiple virtual machines, each contributing a separate counter\.

As a result, missing statistics from a legacy element reduce the reported element count by one, whereas missing statistics from a virtualised function may reduce the count by several tens simultaneously\. In both cases, the loss of counters induces an apparent traffic drop even if the network remains operational\. The relationship between aggregated traffic volume andnoElementsis inherently non\-linear, as legacy elements contribute traffic in approximately proportional units, whereas virtualised functions may remove multiple counters simultaneously, producing disproportionate traffic deviations that do not reflect true service degradation\.

### III\-DAccess Point Names

An access point name \(APN\) defines how user traffic is routed from the mobile core to external networks\. Public APNs provide Internet access, while corporate APNs connect users to private enterprise networks\.

In the dataset, most elements served a small number of public APNs, which carried the majority of traffic volume\. A subset of elements supported hundreds of corporate APNs, which individually contributed relatively little traffic\. Consequently, missing statistics from public\-APN\-heavy elements produce large apparent traffic drops with minimal change innoAPNs, whereas missing corporate APN statistics lead to large drops innoAPNswith only minor traffic reduction\. This joint relationship is non\-linear, meaning similar changes in reporting counts can have very different traffic effects\.

### III\-EImplications for Anomaly Detection

Aggregated traffic drops may arise from either genuine service\-impacting failures or inconsistencies in the measurement process\. Because both produce similar signatures in traffic volume alone, reliable anomaly detection requires models that jointly consider traffic levels, infrastructure availability, and contextual features\.

This motivates the learning\-based approach adopted in this work, where traffic predictions are conditioned not only on temporal patterns but also on auxiliary indicators such asnoElementsandnoAPNs\. Incorporating this context enables more reliable separation of true network failures from benign measurement artefacts\.

## IVFeature Engineering

Aggregated mobile core traffic exhibits strong periodic structure and non\-stationarity driven by human activity, calendar effects, and long\-term growth\. Capturing these dynamics in an online setting requires feature representations that preserve temporal continuity while remaining computationally efficient and numerically stable\. We therefore evaluate a set of time\-aware feature representations that explicitly encode periodicity and are compatible with incremental learning, analysing the trade\-offs between expressivity, dimensionality, and generalisation under streaming constraints\. Because the dataset contains irregular missing observations, explicit lagged features are omitted\.

### IV\-ATemporal and Contextual Traffic Patterns

Operational traffic exhibits repeatable diurnal, weekly, and monthly patterns\. Usage typically increases at the start of billing cycles, peaks during evening hours, and reaches minima in the early morning\. Tariff structures and calendar effects, such as weekends, public holidays, and school holidays, introduce systematic but benign variations that differ across regions\.

Although predictable, these patterns can resemble network faults when interpreted using static thresholds\. We therefore incorporate explicit time\-aware features, including cyclic encodings of hour\-of\-day and day\-of\-week, calendar indicators, and trend variables, enabling models to distinguish contextual variation from abnormal behaviour\.

### IV\-BCategorical Time Encoding

A simple approach treats temporal variables as categorical and applies one\-hot encoding\. While this allows linear models to learn arbitrary non\-monotonic relationships and yields strong predictive performance, feature dimensionality scales poorly with temporal resolution and ignores the cyclic structure of time, increasing overfitting risk in streaming settings\.

### IV\-CTrigonometric Encoding

Trigonometric encoding represents periodic time variables using sine and cosine functions, ensuring that the cyclic nature of time is preserved\. This compact and numerically stable representation is well suited to online learning, but its global sinusoidal structure can underfit asymmetric or sharply varying traffic patterns\.

### IV\-DPeriodic Spline Encoding

Spline\-based encodings provide increased expressivity while enforcing smoothness\[[5](https://arxiv.org/html/2607.18522#bib.bib23)\]\. A periodic spline basis withKKcomponents allows models to focus on specific regions of the cycle while maintaining continuity\. This approach offers performance comparable to one\-hot encodings with fewer features and improved generalisation\.

### IV\-ECyclic Radial Basis Function Encoding

To encode periodic temporal variables in a smooth and locally adaptive manner, we employ cyclic Gaussian radial basis function \(RBF\) encodings\. Letxt∈\{0,…,P−1\}x\_\{t\}\\in\\\{0,\\ldots,P\-1\\\}denote the discrete position of a time index within a period of lengthPP\(e\.g\., the 15\-minute interval index within a day, whereP=96P=96\)\. A set ofKKRBF centres\{ck\}k=1K\\\{c\_\{k\}\\\}\_\{k=1\}^\{K\}is placed uniformly over the periodic domain\.

Cyclic distance between a time indexxtx\_\{t\}and a centreckc\_\{k\}is defined as:

dcyc​\(xt,ck\)=min⁡\(\|xt−ck\|,P−\|xt−ck\|\),d\_\{\\mathrm\{cyc\}\}\(x\_\{t\},c\_\{k\}\)=\\min\\bigl\(\|x\_\{t\}\-c\_\{k\}\|,\\;P\-\|x\_\{t\}\-c\_\{k\}\|\\bigr\),\(2\)which respects the wrap\-around structure of periodic time\.

Each basis function is computed using a Gaussian kernel:

ϕk​\(xt\)=exp⁡\(−dcyc​\(xt,ck\)22​σ2\),\\phi\_\{k\}\(x\_\{t\}\)=\\exp\\\!\\left\(\-\\frac\{d\_\{\\mathrm\{cyc\}\}\(x\_\{t\},c\_\{k\}\)^\{2\}\}\{2\\sigma^\{2\}\}\\right\),\(3\)whereσ\\sigmacontrols the width and smoothness of the encoding\. The resulting feature vectorϕ​\(xt\)∈ℝK\\boldsymbol\{\\phi\}\(x\_\{t\}\)\\in\\mathbb\{R\}^\{K\}provides a bounded, continuous representation of time that is well suited to incremental learning\.

### IV\-FCalendar and Trend Features

To capture long\-term drift and calendar effects, we include an ordinal date feature, a first\-day\-of\-month indicator, and a public holiday flag\. Unbounded features are standardised using running statistics, while bounded and binary features are left unscaled\.

## VTwo\-Stage Online Learning Architecture

Aggregated core network traffic is treated as a*reactive data stream*, where observations arrive sequentially and must be processed in real time\. At each time step, predictions are generated using information available up to timet−1t\-1, followed by incremental model updates once the true observation becomes available\. This*predict–then–update*protocol mirrors operational deployment and avoids batch retraining\.

The proposed framework follows a two\-stage online learning architecture\. Stage I incrementally learns a baseline model of normal traffic dynamics, while Stage II analyses deviations from this baseline, together with contextual indicators, to detect network failures while suppressing false alarms caused by benign variation and measurement artefacts\.

### V\-AStage I: Online Traffic Nowcasting

Letyty\_\{t\}denote the observed traffic volume and𝐱t\\mathbf\{x\}\_\{t\}the associated feature vector at timett\. Stage I predicts the expected trafficy^t=ft​\(𝐱t\)\\hat\{y\}\_\{t\}=f\_\{t\}\(\\mathbf\{x\}\_\{t\}\)and computes the residualet=yt−y^te\_\{t\}=y\_\{t\}\-\\hat\{y\}\_\{t\}\. Model updates occur strictly after prediction, following a prequential \(test–then–train\) protocol\. Models are selected for low computational cost, stability, and continuous online operation\.

### V\-BStage II: Online Anomaly Assessment

Stage II evaluates whether deviations from the learned baseline correspond to genuine network failures or benign measurement artefacts\. At each time step, Stage II receives the signed residualete\_\{t\}together with a contextual feature vector𝐳t\\mathbf\{z\}\_\{t\}comprising auxiliary indicators such asnoElementsandnoAPNs\. A binary classifiergt​\(⋅\)g\_\{t\}\(\\cdot\)produces a failure decisionc^t=gt​\(et,𝐳t\)\\hat\{c\}\_\{t\}=g\_\{t\}\(e\_\{t\},\\mathbf\{z\}\_\{t\}\), wherec^t∈\{0,1\}\\hat\{c\}\_\{t\}\\in\\\{0,1\\\}denotes normal operation or network failure, respectively\.

Rather than applying fixed thresholds, classification is performed relative to recent error statistics, improving robustness to gradual traffic evolution and extreme class imbalance\. The use of signed residuals preserves directional information, with negative values being more indicative of network failures\.

### V\-CDelayed and Sparse Labels

In operational settings, network failure labels are often delayed or unavailable due to manual investigation and root\-cause analysis workflows\. The proposed architecture accommodates this constraint by decoupling the learning stages\. Stage I operates fully self\-supervised after an initial bootstrapping phase, during which a small set of traffic observationsyt\(0\)y\_\{t\}^\{\(0\)\}corresponding to known measurement artefacts is identified and excluded from model updates\.

Stage II operates in a semi\-supervised manner and incorporates confirmed failure labels asynchronously when they become available\. A limited set of initial network failure labelsct\(0\)c\_\{t\}^\{\(0\)\}is used during bootstrapping, after which additional confirmed labelsct\+c\_\{t\}^\{\+\}are integrated over time as investigations conclude\.

Algorithm[V\-C](https://arxiv.org/html/2607.18522#S5.SS3)summarises the proposed framework, highlighting the decoupling between self\-supervised baseline learning and delayed, cost\-sensitive failure classification under a prequential evaluation protocol\.

Algorithm 1

0:Streaming observations

\{\(𝐱t,yt,𝐳t\)\}t=1∞\\\{\(\\mathbf\{x\}\_\{t\},y\_\{t\},\\mathbf\{z\}\_\{t\}\)\\\}\_\{t=1\}^\{\\infty\}
0:Initial baseline model

f0f\_\{0\}, failure classifier

g0g\_\{0\}
0:Warm\-up period

T0T\_\{0\}
1:Initialise Stage I model

f←f0f\\leftarrow f\_\{0\}
2:Initialise Stage II model

g←g0g\\leftarrow g\_\{0\}
3:Initialise running statistics

4:for

t=1,2,…t=1,2,\\ldotsdo

5:Receive features

𝐱t\\mathbf\{x\}\_\{t\}and contextual indicators

𝐳t\\mathbf\{z\}\_\{t\}
6:Predict baseline traffic

y^t←f​\(𝐱t\)\\hat\{y\}\_\{t\}\\leftarrow f\(\\mathbf\{x\}\_\{t\}\)
7:Observe true traffic

yty\_\{t\}
8:Compute residual

et←yt−y^te\_\{t\}\\leftarrow y\_\{t\}\-\\hat\{y\}\_\{t\}
9:Predict failure decision

c^t←g​\(et,𝐳t\)\\hat\{c\}\_\{t\}\\leftarrow g\(e\_\{t\},\\mathbf\{z\}\_\{t\}\)
10:if

t\>T0t\>T\_\{0\}and observation quality acceptablethen

11:Update baseline model

f←f​\(𝐱t,yt\)f\\leftarrow f\(\\mathbf\{x\}\_\{t\},y\_\{t\}\)
12:endif

13:ifconfirmed failure label

ct\+c\_\{t\}^\{\+\}becomes availablethen

14:Update classifier

g←g​\(et,𝐳t,ct\+\)g\\leftarrow g\(e\_\{t\},\\mathbf\{z\}\_\{t\},c\_\{t\}^\{\+\}\)
15:endif

16:endfor

### V\-DOnline Learning Implementation

All models are implemented using the*River*library\[[11](https://arxiv.org/html/2607.18522#bib.bib10)\], which supports incremental preprocessing, model updates, and prequential evaluation\. Deep neural network models are implemented using*deep\-river*\[[7](https://arxiv.org/html/2607.18522#bib.bib22)\], a Python library for online deep learning that integrates the River API with PyTorch\-based neural network architectures\.

Unbounded continuous features are standardised using running statistics maintained online, while bounded or binary features are left unscaled\. Model parameters are updated using stochastic gradient descent or Adam\-based incremental optimisers\.

### V\-EOperational Considerations

Unlike batch\-trained models that require periodic retraining, the proposed online architecture adapts continuously to gradual traffic evolution, seasonal effects, and concept drift\. This results in reduced operational overhead, low computational cost, and minimal manual intervention, making the approach well suited to large\-scale mobile network monitoring\. An overview of the two\-stage architecture is shown in Fig\.[2](https://arxiv.org/html/2607.18522#S5.F2)\.

From a computational perspective, all components of the proposed framework are lightweight\. Stage I employs an online linear regressor with 29 input features, while Stage II uses logistic regression with only three inputs\. Both models operate with constant memory and linear per\-sample update complexity in the number of features\. In practice, Stage I maintains fewer than 200 parameters per region, while Stage II introduces fewer than 10 additional parameters, making the overall approach suitable for large\-scale deployment across many regions with minimal computational overhead\.

![Refer to caption](https://arxiv.org/html/2607.18522v1/figures/architecture.png)Figure 2:Two\-stage online learning architecture for MCN traffic monitoring\. At each time steptt, Stage I predictsy^t\\hat\{y\}\_\{t\}from features𝐱t\\mathbf\{x\}\_\{t\}and computes the residualete\_\{t\}\. Stage II evaluates residuals and contextual indicators to produce a failure decisionc^t\\hat\{c\}\_\{t\}, incorporating delayed feedbackct\+\{c\}^\{\+\}\_\{t\}when available\.

## VIExperimental Results

This section evaluates the proposed two\-stage online learning framework under realistic streaming conditions\. Experiments focus on three aspects: \(i\) online traffic nowcasting accuracy, \(ii\) the impact of time\-aware feature representations, and \(iii\) failure detection performance for linear and non\-linear models under severe class imbalance and measurement artefacts\.

All models are evaluated using a prequential \(test–then–train\) protocol\. Unless stated otherwise, reported metrics are cumulative prequential values computed after a 30\-day warm\-up period\.

### VI\-AStage I: Online Traffic Nowcasting

We first assess the ability of online regression models to learn and maintain a baseline of normal traffic dynamics\. Accurate baseline modelling is a prerequisite for reliable anomaly detection and directly affects downstream failure detection performance\.

Table[I](https://arxiv.org/html/2607.18522#S6.T1)compares cumulative prequential prediction accuracy for different temporal encodings using a fixed online linear regression model\. One\-hot encodings of the 15\-minute interval serve as a high\-capacity baseline, while trigonometric, periodic spline, and cyclic RBF encodings provide increasingly compact and smooth representations of temporal structure\.

TABLE I:Impact of time\-aware feature representations on online prediction accuracy\.Encoding15\-minFeaturesTotalFeaturesMAPE \(%\)𝐑𝟐\\mathbf\{R^\{2\}\}One\-hot961426\.150\.97Trigonometric21113\.370\.89Periodic spline16 \(K=16K\{=\}16\)316\.210\.97Cyclic RBF12 \(K=12K\{=\}12\)294\.810\.98Cyclic RBF encodings achieve the best overall performance, delivering improved accuracy with substantially fewer features\. Periodic spline encodings capture asymmetric diurnal patterns with performance comparable to one\-hot representations, while trigonometric features underfit the data due to their global sinusoidal constraint\. For completeness, the total number of model features associated with each encoding is also reported, highlighting the efficiency gains of the cyclic representations\.

Selective learning in Stage I was implemented using a two\-phase approach\. Initially, a small set of known measurement artefacts was manually identified and excluded from model updates to establish a clean baseline\.

While accurate baseline modelling is necessary, it is not sufficient for operational network monitoring\. In the following experiment, we evaluate how prediction residuals produced by Stage I can be leveraged to distinguish genuine network failures from benign measurement artefacts under extreme class imbalance\.

### VI\-BStage II: Failure Detection Performance

Failure detection is evaluated under realistic operating conditions in which confirmed network failures are rare and measurement artefacts occur frequently\. Performance222Due to the extreme class imbalance inherent in MCN monitoring data, macro\-averaged precision, recall, and F1\-score are used as the primary evaluation metrics, as micro\- and weighted averages are dominated by normal operation and can obscure failure detection performance\.is assessed using precision, recall, F1\-score, false positive rate \(FPR\), and area under the curve \(AUC\)\.

TABLE II:Failure detection performance under extreme class imbalance\. All metrics are final cumulative prequential values obtained under a test–then–train evaluation protocol\.MethodPrecisionRecallF1FPRAUCThreshold\-based baselinesStatic threshold49\.3%40\.5%44\.2%20\.12%–Residual threshold51\.3%50\.8%50\.9%0\.64%–Linear modelsSingle\-model \(linear\)92\.6%61\.5%68\.0%0\.04%0\.77Two\-stage \(linear\)74\.0%82\.5%78\.0%0\.38%0\.86Non\-linear modelsSingle\-model \(NN\)55\.2%90\.9%57\.2%8\.28%0\.94Two\-stage \(NN\)63\.7%96\.6%70\.6%2\.71%0\.98

Table[II](https://arxiv.org/html/2607.18522#S6.T2)compares static thresholding, residual\-based thresholding, single\-model learning, and the proposed two\-stage online architecture\. The term single\-model denotes classifiers trained directly on traffic and contextual features, without explicit baseline modelling or residual extraction\.

Static thresholding proves unsuitable under non\-stationary traffic due to low precision, low recall, and high false positive rates, whereas residual\-based thresholding reduces false alarms but provides only limited improvements in recall and overall F1\-score\.

Single\-model learning achieves very high precision when linear classifiers are employed, but this conservative behaviour leads to reduced recall under extreme class imbalance\. Introducing non\-linear capacity via a feed\-forward neural network increases recall markedly; however, this comes at the cost of a sharply elevated false positive rate, demonstrating that model expressiveness alone does not resolve the ambiguity between genuine failures and measurement artefacts\.

In contrast, the two\-stage architecture consistently delivers a more favourable precision–recall trade\-off for both linear and non\-linear models\. By isolating predictable traffic dynamics in Stage I, the residual\-based representation simplifies the learning problem in Stage II, improving recall while constraining false alarms\. The linear two\-stage model achieves the highest F1\-score, while the two\-stage neural network attains the highest AUC, confirming that explicit baseline decomposition is critical for reliable failure detection under streaming class imbalance\. The modest increase in false positive rate for the two\-stage linear model reflects its higher sensitivity to partial or shorter\-duration failure events that the conservative single\-model detector suppresses, a trade\-off that yields substantially higher recall and overall F1\-score\.

Figure[3](https://arxiv.org/html/2607.18522#S6.F3)provides a qualitative illustration of online failure detection behaviour for the linear models, complementing the aggregate results in Table[II](https://arxiv.org/html/2607.18522#S6.T2)\. The upper panel shows observed and predicted downlink traffic with confirmed failure events and predicted detections overlaid, while the lower panels report the cumulative prequential evolution of precision, recall, F1\-score, and AUC\.

The single\-model linear detector exhibits strongly conservative behaviour\. Predicted failures occur infrequently and are tightly concentrated around the most severe traffic drops, resulting in high precision and a low false positive rate\. However, several confirmed failure intervals are missed or only partially detected, causing recall to plateau at a lower level and constraining the achievable F1\-score, as reflected in the metric trajectories\.

In contrast, the two\-stage linear model shows improved temporal alignment with confirmed failure events\. By operating on residuals produced by the Stage I traffic baseline, the detector responds more consistently throughout true failure periods while maintaining a similarly low false positive rate\. This leads to a sustained increase in recall with only a modest reduction in precision, yielding a higher and more stable F1\-score and improved AUC over time\.

The zoomed inset highlights a representative failure episode, where the two\-stage model generates contiguous detections aligned with the confirmed incident, while the single\-model detector triggers sporadically or not at all\. This visual evidence reinforces the quantitative findings and demonstrates that isolating predictable traffic dynamics in Stage I simplifies downstream classification, improving failure sensitivity without compromising operational robustness\.

![Refer to caption](https://arxiv.org/html/2607.18522v1/figures/online.png)Figure 3:Observed and predicted downlink traffic with confirmed and predicted failure events\. The upper panel shows traffic dynamics and detection timing, while the lower panels show the prequential evolution of model metrics\. The two\-stage model exhibits faster stabilisation and improved alignment with true failure events while suppressing spurious detections\.

## VIIConclusions and Future Work

This paper presented a two\-stage online learning framework for traffic\-based failure detection in MCNs\. By explicitly separating baseline traffic modelling from failure classification, the approach achieves reliable performance under non\-stationarity, extreme class imbalance, and imperfect telemetry\.

Experiments on real operational MCN data demonstrate that the two\-stage architecture outperforms static thresholds and single\-model detectors, delivering higher F1\-scores and AUC at low false positive rates\.

The framework was developed and evaluated in collaboration with Vodacom Group Limited, demonstrating its suitability for operational deployment\. Future work will explore adaptive model selection and extensions to multi\-resolution and cross\-region traffic dependencies\.

## References

- \[1\]3GPP\(2020\)System Architecture Evolution \(SAE\); Architecture description\.Note:3GPP TS 23\.401Release 16Cited by:[§III\-C](https://arxiv.org/html/2607.18522#S3.SS3.p1.1)\.
- \[2\]M\. Basseville and I\. Nikiforov\(1993\)Detection of Abrupt Changes: Theory and Application\.Prentice Hall\.Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p4.1)\.
- \[3\]J\. Burgueño, I\. de\-la\-Bandera, J\. Mendoza, D\. Palacios, C\. Morillas, and R\. Barco\(2020\)Online anomaly detection system for mobile networks\.Sensors20\(24\),pp\. 7232\.Note:doi:\\url10\.3390/s20247232Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p5.1)\.
- \[4\]V\. Chandola, A\. Banerjee, and V\. Kumar\(2009\)Anomaly Detection: A Survey\.ACM Computing Surveys41\(3\),pp\. 1–58\.Note:doi:\\url10\.1145/1541880\.1541882Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p3.1),[§II\-B](https://arxiv.org/html/2607.18522#S2.SS2.p1.1)\.
- \[5\]P\. H\. Eilers and B\. D\. Marx\(1996\)Flexible smoothing with B\-splines and penalties\.Statistical science11\(2\),pp\. 89–121\.Note:doi:\\url0\.1214/ss/1038425655External Links:[Link](https://doi.org/10.1214/ss/1038425655)Cited by:[§IV\-D](https://arxiv.org/html/2607.18522#S4.SS4.p1.1)\.
- \[6\]J\. Gama, I\. Žliobaitė, A\. Bifet, M\. Pechenizkiy, and A\. Bouchachia\(2014\)A survey on concept drift adaptation\.ACM computing surveys \(CSUR\)46\(4\),pp\. 1–37\.Note:doi:\\url10\.1145/2523813Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p5.1),[§II\-A](https://arxiv.org/html/2607.18522#S2.SS1.p7.1)\.
- \[7\]C\. Kulbach, L\. Cazzonelli, H\. Ngo, M\. Halford, and S\. M\. Mastelini\(2025\)DeepRiver: a deep learning library for data streams\.Journal of Open Source Software10\(105\),pp\. 7226\.Note:doi:\\url10\.21105/joss\.07226External Links:[Link](https://doi.org/10.21105/joss.07226)Cited by:[§V\-D](https://arxiv.org/html/2607.18522#S5.SS4.p1.1)\.
- \[8\]A\. Lakhina, M\. Crovella, and C\. Diot\(2006\)Characterization of Network\-Wide Traffic Anomalies in IP Backbone Networks\.IEEE/ACM Transactions on Networking14\(6\),pp\. 1212–1223\.Note:doi:\\url10\.1145/1028788\.1028813Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p3.1),[§II\-B](https://arxiv.org/html/2607.18522#S2.SS2.p1.1)\.
- \[9\]N\. Laptev, S\. Amizadeh, and I\. Flint\(2015\)Generic and Scalable Framework for Automated Time\-Series Anomaly Detection\.InProceedings of the 21st ACM SIGKDD Conference,pp\. 1939–1947\.Note:doi:\\url10\.1145/2783258\.2788611Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p4.1),[§II\-C](https://arxiv.org/html/2607.18522#S2.SS3.p2.2)\.
- \[10\]P\. Malhotra, L\. Vig, G\. Shroff, and P\. Agarwal\(2015\)Long short term memory networks for anomaly detection in time series\.Proceedings of the European Symposium on Artificial Neural Networks\.Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p4.1)\.
- \[11\]J\. Montiel, M\. Halford, S\. M\. Mastelini, G\. Bolmier, R\. Sourty, R\. Vaysse, A\. Zouitine, H\. M\. Gomes, J\. Read, T\. Abdessalem,et al\.\(2021\)River: machine learning for streaming data in Python\.Cited by:[§V\-D](https://arxiv.org/html/2607.18522#S5.SS4.p1.1)\.
- \[12\]H\. Ren, B\. Xu, Y\. Wang, C\. Yi, C\. Huang, X\. Kou, and Y\. Xing\(2019\)Time\-Series Anomaly Detection Service at Microsoft\.Proceedings of KDD\.Note:doi:\\url10\.1145/3292500\.3330680Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p4.1),[§II\-C](https://arxiv.org/html/2607.18522#S2.SS3.p2.2)\.
- \[13\]A\. Shahraki, M\. Abbasi, A\. Taherkordi, and A\. D\. Jurcut\(2022\)A comparative study on online machine learning techniques for network traffic streams analysis\.Computer Networks207,pp\. 108836\.Note:doi:\\url10\.1016/j\.comnet\.2022\.108836Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p5.1)\.
- \[14\]S\. Shalev\-Shwartz\(2012\)Online Learning and Online Convex Optimization\.Foundations and Trends in Machine Learning\.Note:doi:\\url10\.1561/2200000018Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p5.1),[§II\-A](https://arxiv.org/html/2607.18522#S2.SS1.p7.1)\.
- \[15\]J\. P\. G\. Sterbenz, D\. Hutchison, E\. K\. Çetinkaya, A\. Jabbar, J\. P\. Rohrer, M\. Schöllner, and P\. Smith\(2010\)Resilience and survivability in communication networks: Strategies, principles, and survey of disciplines\.Computer Networks54\(8\),pp\. 1245–1265\.Note:doi:\\url10\.1016/j\.comnet\.2010\.03\.005Cited by:[§II\-A](https://arxiv.org/html/2607.18522#S2.SS1.p2.1)\.
- \[16\]F\. Xu, Y\. Li, H\. Wang, P\. Zhang, and D\. Jin\(2016\)Understanding mobile traffic patterns of large scale cellular towers in urban environment\.IEEE/ACM transactions on networking25\(2\),pp\. 1147–1161\.Note:doi:\\url10\.1145/2815675\.2815680Cited by:[§I](https://arxiv.org/html/2607.18522#S1.p2.1)\.