Topology-aware self-supervised multivariate KPI anomaly detection and root cause node localization for network operations

Abstract

Multivariate key performance indicator (KPI) streams collected in network operations contain rich evidence for anomaly diagnosis, but practical deployment remains difficult because fault labels are scarce, KPI dependencies are strong across time and metrics, and fault effects propagate through network topology. This paper proposes a topology-aware self-supervised framework for multivariate KPI anomaly detection and root cause node localization in network operations. The framework learns normal behavior from predominantly unlabeled KPI windows by combining masked reconstruction, one-step prediction, and topology-regularized representation learning. It then produces KPI-level, node-level, and system-level anomaly scores, and ranks candidate root cause nodes by combining normalized local anomaly evidence with consistency under a directed multi-hop propagation prior. To improve transparency, the framework also reports residual-based KPI contribution scores and a compact topology-level explanation subgraph. These residual shares are descriptive diagnostic evidence rather than causal or model-gradient feature attributions and do not constitute fault-type classification. Experiments on a Mininet-based testbed with three topology scales and six fault categories yield a five-seed F1-score of 0.9235 ± 0.0037 and an A@1 of 0.7613 ± 0.0163. The mean F1-score is 0.43 percentage points higher than that of DCdetector, although the paired difference is not statistically significant. Under the controlled KPI-plus-topology observability budget, A@1 is 5.47 percentage points higher than that of the restricted-input Nezha adaptation (Holm-adjusted \(p=0.013\) ); this comparison does not represent Nezha operating with its native multimodal inputs. External validation on the public Train-Ticket benchmark yields an F1-score of 0.846 and an A@1 of 0.742. Ablation results show that directed propagation improves A@1 by 1.6 percentage points over static undirected proximity, while five-seed results indicate stable optimization. On an NVIDIA RTX 3090, the complete online detection and RCA path requires 12.4 ms in the 48-node setting.