Telecom alarm generator reveals exact fault causes for better troubleshooting
Every Alarm Has a Cause: An Open Generator of Telecom Alarm Storms with Exact Root Causes, Bound to NORIA-O, RFC 8632 and TMF642
Networking and Internet ArchitectureArtificial Intelligence
Summary
Telecom companies face problems when multiple alarms occur at once, but they can’t share real data because it’s confidential. The authors created a tool that generates realistic alarm data with exact root causes, based on real network layouts. Their tool follows official telecom standards and lets researchers test and compare methods for finding the real cause of alarms. They show a simple rule and advanced models working well with this generated data and on real alarms too.
What this means in practice
- •For telecom network operators: Use the generator to test and improve tools that identify the cause of alarm storms in telecom networks without exposing confidential data.
- •For network monitoring software developers: Evaluate and benchmark alarm root-cause analysis algorithms on realistic, standard-compliant telecom alarm data generated on real network topologies.
Authors
Madhulatha Mandarapu, Sandeep Kunkunuru
Abstract
Alarm root-cause analysis is studied on data that cannot be shared. Operator logs are confidential, so what the field publishes is a causal graph between alarm types rather than per-incident causes, a fixed scenario set, gated, or never released. Two recent benchmarks carry per-incident root causes at scale; neither states a download location or a licence. We give a generator rather than a dataset. It runs on real backbone topologies from the Internet Topology Zoo and records the exact root cause and the propagation path of every alarm -- a by-product of generation, not a labelling pass. Every emitted field binds to a term in NORIA-O, RFC 8632, RFC 8345 or TMF642, and an unknown term fails the run. We ship fixed configurations, splits, a scorer and nine baselines. A one-line rule -- rank the device that raised the earliest critical alarm -- takes top-1 at 0.650 against 0.575 for our own temporal method, and wins 13 of 15 runs over three backbones and five seeds. An LLM given the same view reaches 0.600, the same model allowed to query the graph 0.625, and the rule wins on real operator alarms too, at 0.773: a property of alarm streams, not of our generator. One fault class separates the table: when a site loses power its PoP reports nothing, so every method that ranks alarmed devices scores 0.000 or near it, while the two that walk the topology to a silent candidate take 1.000 and 0.833.