Mobile Network Troubleshooting

Anomaly Detection for Telecommunication Networks Learn More


TLC Base Stations and network components acquire real-time and statistical measurements for troubleshooting analysis, typically called Key Performance Indicators (KPIs).

Big Data

Hundreds of thousands of Base Stations collect hourly data (e.g., number of dropped calls)

Dynamic System

The physical network changes continuously and depends on users' habits

Complex Rules

Available KPIs are complex to process due to multiple factors, including users' behavior, seasonality, and network structure


Malfunctions and denials of service cause direct financial losses in pay-per-use business models, requiring early detection of anomalies

EVoKE Approach

EVoKE is an adaptive anomaly detection system.
Operators feedback (i.e., marking an event as false-positive) is exploited to improve results quality

Domain Rules

Based on predefined configurations defined by domain experts, and weighted with respect to the dynamic knowledge base

Operators Feedback

Domain experts evaluate results and provide a correctness mark with respect to their experience

Machine Learning

Feedback is traced and exploited through AI & Learning-By-Example (LBE) techniques

EVoKE Flow

The logical flow is designed to be efficient and simple.
Main challenges concern big-data I/O, implementation of map-reduce pattern, false-positive minimization, self-maintenance and rules adaptability



This stage evaluates RAW data for detecting low-level events. The mayor challenge is to recognize events with low-complexity algorithms and methodologies.
Implementations are optimized for speed in order to parse Gigabytes of data in seconds

First and second order statistics are a very standard metric and algorithms can typically be optimized for speed. EVoKe come with configurable detectors with static, dynamic, and adaptive thresholds

In time-series, trends are typically relevant for long-term analysis and for data normalization. Auto-Correlation and Cross-Correlation are used for validation and inference analysis

EVoKE comes with a set of discrete transforms presets, such as FFT and Wavelets. In particular, Haar wavelet is typically exploited in various ways such as noise reduction, trend evaluation, ramp and step patterns detection



This second stage evaluates detected events for finding anomalies

Aggregation rules are used to link related events and provide a multi-scale view of the anomalies to operators. Some standard dimensions are time, geo-spatial, network clustering, technology

Classification has a crucial role in EVoKE, several methodologies are used. The flow is hierarchical and can be recursive, thus classifier can even exploit information extracted by previous iterations

EVoKe supports multiple ranking metrics which are aggregated in a global ranking index in terms of numerical and literal value. This information is crucial as anomalies are evaluated by operators in order or priority


EVoKE Usage

EVoKE analysis is defined by a hierarchical schema defining all aspects of the flow


EVoKE Daemon tool can launch template jobs on particular time patterns. This work-mode is useful for periodic long-time analysis


Most components and algorithms of the EVoKE suite are designed and optimized to work online

Lazy Real-time

It's a two-step analysis: the first one is done in real-time and designed to be efficient; the second analysis, designed to refine previous results, is executed as soon as infrastructure resources are available


This is the typical on-demand mode, it is used to design and test new analysis, and evaluate some particular time period and network cluster

Key Features

EVoKE is effective, easy to install, use, and maintain


EVoKE architecture has been implemented as a flexible and extendible framework, written in C# with optimized API and lambda support


EVoKE can analyze dozen of thousand BTS in few seconds


EVoKE embeds static domain rules as well as machine learning techniques for exploiting operators feedback


EVoKE cooperates with 3rd-party software in order to integrate control and outputs in the same operators' software

Using Evoke: Our Industrial Testimonial

EVoKE is installed at the VODAFONE OMNITEL N.V. data-warehouse

Join the research community for testing and developing it