Mobile Network Troubleshooting

anomaly detection for TLC networks Learn More


TLC Base stations and network components acquire real-time and statistical measurements for troubleshooting analysis, typically called Key Performance Indicators (KPIs).

Big Data

Hundred of thousands base-stations collects hourly data (e.g. number of dropped calls). Moreover TLC experts define their own KPIs and aggregated views.

Dynamic System

The physical network is continuously changing in terms of hardware. And network usage depends on users habits: in time and space (i.e. weekend, holidays).

Complex Rules

Available Indicators (KPIs) are very complex processes exposing many high-dimensional relations with users behavior, seasonality, and cross-correlation related to TLC network structure (i.e. hangover).


In pay-per-use business model, malfunctions and denial of services typically imply a direct loss of money. Anomalies must be early-detected or predicted.

EVoKE approach

EVoKE is an adaptive anomaly detection system.
Operators feedback (i.e. marking an event as false-positive) is exploited to improve results quality.

Domain Rules

based on predefined configurations defined by domain experts, and weighted with respect to the dynamic knowledge base.

Operators Feedback

domain experts evaluate results and provide a correctness mark with respect to their experience.

Machine Learning

feedback is traced and exploited through Learning-By-Example (LBE) techniques. Wrong detections are over-weighted with respect to correct ones.

EVoKE Flow

The logical flow is designed to be efficient and simple.
Main challenges concern big-data I/O, implementation of map-reduce pattern, false-positive minimization, self-maintenance and rules adaptability.



This stage evaluates RAW data for detecting low-level events. The mayor challenge is to recognize events with low-complexity algorithms and methodologies.
Implementations are optimized for speed in order to parse Gigabytes of data in seconds.

First and second order statistics are a very standard metric and algorithms can typically be optimized for speed. EVoKe come with configurable detectors with static, dynamic, and adaptive thresholds.

In time-series, trends are typically relevant for long-term analysis and for data normalization. Auto-Correlation and Cross-Correlation are used for validation and inference analysis.

EVoKE comes with a set of discrete transforms presets, such as FFT and Wavelets. In particular, Haar wavelet is typically exploited in various ways such as noise reduction, trend evaluation, ramp and step patterns detection.



This second stage evaluates detected events for finding anomalies.

Aggregation rules are used to link related events and provide a multi-scale ("zoomable") view of the anomalies to operators. Some standard dimensions are time, geo-spatial, network clustering, technology.

Classification has a crucial role in EVoKE, several methodologies are used. The flow is hierarchical and can be recursive, thus classifier can even exploit information extracted by previous iterations.

EVoKe supports multiple ranking metrics which are aggregated in a global ranking index in terms of numerical and literal value. This information is crucial as anomalies are evaluated by operators in order or priority.


EVoKE Usage

EVoKE analysis is defined by a hierarchical schema defining all aspects of the flow.


EVoKE Daemon tool can launch template jobs on particular time patterns. This work-mode is useful for periodic long-time analysis.


Most components and algorithms of the EVoKE suite are designed and optimized to work online. Their typical bottleneck is the access to RAW (or KPI) data that depends on infrastructure.

Lazy Real-time

It's a two-step analysis: the first one is done in real-time and designed to be efficient; the second analysis, designed to refine previous results, is executed as soon as infrastructure resources are available.


This is the typical on-demand mode, it is used to design and test new analysis, and evaluate some particular time period and network cluster.

Key Features

Key features that make EVoKE: effective, easy to install, use and maintain.


EVoKE architecture has been implemented as a flexible and extendible framework, written in C# with optimized API and lambda support.


EVoKE can analyze dozen of thousand BTS in few seconds.


EVoKE embeds static domain rules as well as machine learning techniques for exploiting operators feedback.


EVoKE cooperates with 3rd-party software in order to integrate control and outputs in the same operators' software.

Using EVoKE

EVoKE is actually installed at the VODAFONE OMNITEL N.V. data-warehouse