Graph-Based Anomaly Detection in LTE Networks: Effects of Temporal Aggregation and Window Alignment

Abstract

A common but underexplored decision in network anomaly detection is how to aggregate time series data before feeding it into a model. This paper studies that decision directly and argues that temporal aggregation is not a neutral preprocessing step: the choice of window size and boundary placement changes which periods receive elevated anomaly scores, how severe those periods appear, and which parts of network performance are implicated. The study evaluates a spatiotemporal Graph Convolutional Network and Gated Recurrent Unit model using one month of real-world LTE operational data from a large telecommunications operator at four time window sizes: 15 minutes, 1 hour, 2 hours, and 3 hours. Coarser windows produce broader, less precisely timed responses to the same anomalous periods, which can distort how severe a fault or anomaly appears. Finer windows produce sharper signals and can indicate the part of an hour during which a fault was active, at the cost of longer training time. Shifting the window boundary by one or two hours changes how severe the same event appears by around 12% in this dataset, which could affect how urgently the operator responds to it. Weather observations are included as node features and are found to reduce anomaly scores at ${15}$-minute resolution only, because the fine-grained timing relationship between weather conditions and network behavior is lost when data is averaged over longer periods. The findings suggest that operators should choose window sizes based on their monitoring goals, using finer resolutions for detailed fault investigation and coarser ones for long-term trend monitoring, and that running multiple shifted configurations in parallel provides a more reliable view than any single fixed setting.