Generative AI for Anomaly Diagnosis in 5G NR Scheduling Logs

Abstract

Fifth-Generation New Radio (5G NR) base stations produce detailed scheduling logs that record per-slot decisions, channel measurements, and Hybrid Automatic Repeat Request (HARQ) feedback at sub-millisecond granularity. Diagnosing anomalies in these logs currently requires domain experts to spend approximately one hour of manual inspection per file, and no standardised tooling exists for automated Root Cause Analysis (RCA).

This thesis presents an end-to-end automated diagnostic system whose main contribution is the integration of statistical anomaly detection, correlation-based root-cause differentiation, and Generative Artificial Intelligence (GenAI) explanation into a single pipeline for 5G NR scheduling logs. Raw binary traces are parsed into a relational database, where statistical and Machine Learning (ML) methods detect anomalies at both the individual-record and temporal levels. A correlation-based module differentiates root causes that exhibit similar signatures,
a rule engine maps findings to verified diagnostic patterns, and a GenAI agent powered by a Large Language Model (LLM) synthesises the collected evidence into readable diagnostic reports. A feedback mechanism allows engineers to confirm or correct diagnoses, accumulating a case store for future reference.

The system was evaluated as a proof-of-concept on 11 scheduling logs covering multiple distinct anomaly scenarios in a controlled laboratory environment. Compared with unassisted manual diagnosis, the system correctly classified all observed anomaly patterns, identified two engineer-confirmed failures, and uncovered subtle events that conventional threshold-based alarms missed. Diagnosis time dropped from approximately one hour to a few minutes per log. Although the evaluation is confined to a laboratory setting with a small sample size, the results confirm that combining ML-based detection with LLM-driven explanation is viable for operational 5G log analysis.

Popular Abstract

Every time you stream a video, make a call, or scroll through social media on your phone, you are connected to a mobile base station, a tower with antennas that sends and receives radio signals. Inside the base station, a computer makes thousands of decisions every second: which users to serve, how fast to send their data, and how to react when signal conditions change. A new decision is made roughly every half-millisecond. These decisions are all recorded in log files. A single file covering a few minutes of operation can contain hundreds of thousands of entries. When something goes wrong, such as a user’s video freezing or speeds dropping without explanation,
an engineer opens the log and manually traces the chain of events that led to the failure. In practice this means searching hundreds of thousands of lines for a handful of relevant ones, guided mostly by experience and intuition. It typically takes about an hour per file.

This thesis develops a system that automates that process in three stages. First, the raw log data is parsed and organised into a structured format that can be queried efficiently, turning dense binary records into clean, searchable tables. Second, statistical methods and machine learning are applied to detect unusual patterns. Some methods flag individual values far outside the normal range. Others detect clusters of small anomalies occurring together within a short time window, events that look harmless alone but collectively indicate a real problem. A
Bayesian Network checks whether relationships between measurements still hold: for instance, if signal quality is reported as excellent but data transmissions keep failing, something is wrong even though no single number looks abnormal by itself. Third, once the system knows what is unusual and when it happened, a large language model, the same type of technology behind tools like ChatGPT, writes a diagnosis in plain language. It combines the statistical evidence with knowledge of how 5G systems behave and produces an explanation of what went wrong, why, and what the engineer might do about it.

The system was tested on eleven base-station logs from a controlled lab environment. It correctly identified all known problems, including subtle ones such as a brief one-second reconfiguration event or a momentary connection loss with a single user, that standard monitoring tools would never flag because they fall
below alarm thresholds. In two cases where experienced engineers had already confirmed the root cause, the system reached the same conclusion and provided more specific quantitative detail than the engineers had noted.
The full analysis, from raw data to written diagnosis, completed in a few minutes, compared to roughly one hour of manual work. Engineers can then spend their time verifying and fixing rather than searching.

• author: Li, Hongyan
• supervisor: Johan Thunberg
• organization: Department of Electrical and Information Technology
• course: EITM02 20261
• year: 2026
• type: H2 - Master's Degree (Two Years)
• subject: Technology and Engineering
• report number: LU/LTH-EIT 2026-1134
• language: English
• id: 9234784
• date added to LUP: 2026-06-10 10:57:41
• date last changed: 2026-06-10 10:57:41