Network anomaly detection from RAN KPIs

Three ways to see it

1. 1

   A RAN, the Radio Access Network, is the layer of cell towers, antennas, and baseband units that touches the customer's phone. Every minute it produces dozens of KPIs per sector: Drop Call Rate, Call Setup Success Rate, Handover Success Rate, RRC Connection Setup Rate, PRB utilisation, Reference Signal Received Power, throughput, latency. A typical Pakistani operator like Telenor has roughly 12,000 sites; multiplied by three sectors per site and dozens of KPIs, the NOC drowns in numbers. Static thresholds are a survival mechanism, but they are also the reason real problems get missed.

2. 2

   Way one to think about the problem: the city is not one place. A sector in Tariq Road has a busy hour at lunchtime when offices empty into food courts. A sector in Bahria Town Phase 8 has a busy hour at 9 PM when families are home. A sector along the Hyderabad motorway has a busy hour that moves with traffic. A single threshold cannot serve all three. Anomaly detection learns each sector's own pattern over time and flags deviations from that personal baseline.

3. 3

   Way two: rural is not urban. A Zong sector in Cholistan with 30 active users at peak does not behave like a Lahore Liberty sector with 3,000. Drop Call Rate of 5 percent on the rural sector might be 2 dropped calls; on the urban sector it is 150. The same percentage hides very different customer impact. Modern anomaly models combine relative deviation, absolute volume, and customer-tier weighting so a rural outage is not lost in noise and an urban surge does not trigger a thousand alerts.

The why-tree

Try this with Claude

AI-edge prompt: 'I have hourly RAN KPIs for 200 LTE sectors over 30 days: DCR, CSSR, HoSR, PRB-DL, RSRP. Suggest a baseline model that handles weekday/weekend seasonality and Pakistani public holidays, with a per-sector deviation score. Recommend the simplest model I can deploy on a single GPU node and the three failure modes I should watch for in the first month.' Compare the answer to what your vendor proposed in their last RFP.