Adaptive Two-Stage Online Learning for Service-Affecting Failure Detection in Mobile Core Networks

Mobile network operators (MNOs) struggle to monitor core network health because aggregated traffic data is non-stationary, noisy, and prone to measurement artifacts like counter rollovers. Traditional threshold-based systems often trigger false alarms during predictable traffic fluctuations. To address this, the authors propose a two-stage online learning architecture. Stage I uses lightweight, time-aware regression to model normal traffic dynamics, incorporating cyclic features (e.g., time-of-day, day-of-week) to handle periodic patterns. Stage II then analyzes the residuals—the difference between predicted and actual traffic—alongside contextual indicators to classify whether a deviation represents a genuine service-affecting failure or a benign measurement error.

By decoupling baseline modeling from failure detection, the framework effectively mitigates the impact of extreme class imbalance, where normal traffic and artifacts are common but genuine failures are rare. The study demonstrates that this two-stage approach outperforms end-to-end models in precision-recall trade-offs. It achieves higher F1-scores and AUC values while maintaining low computational overhead, making it suitable for real-time, streaming mobile core network environments.

Reliable failure detection is critical for maintaining service continuity and revenue in mobile networks. By explicitly separating baseline traffic dynamics from failure classification, this method reduces the high false-positive rates that plague current operational systems. This allows network engineers to focus on genuine incidents, reducing detection latency and improving operational efficiency without requiring manual, static threshold tuning.