DG
D. Ghergut
info
Please Note
<p>This page displays the records of the person named above and is not linked to a unique person identifier. This record may need to be merged to a profile.</p>
1 records found
1
Multi-Modal Correlation of Observability Signals in Cloud-Native 5G Core Networks
What Each Modality Reveals About Faults — and What It Misses
Bachelor thesis
(2026)
-
D. Ghergut, S.M.B.S. Samarakoon Mudiyanselage, Nitinder Mohan, Jérémie Decouchant
Cloud-native 5G Core networks emit metrics, logs, and distributed traces, yet faults are typically diagnosed within a single modality. We show that the relationships between these modalities carry fault information that single-signal analysis misses, and we use them to characterize faults in a containerized Open5GS testbed. Our method computes the change in Spearman rank correlation between cross-modal signal pairs, from a pre-fault baseline to the fault window, yielding a coupling-change metric ∆|ρ|. Across 22 operational fault scenarios over seven independent deployments, and 6 security scenarios over three, the analysis surfaces reproducible coupling signatures and, more importantly, modality blindspots that follow the 5G interface architecture: because distributed tracing instruments only the Service-Based Interface, N2 interface partitions and N4/PFCP session faults are trace-blind and characterizable only through metrics-logs coupling, whereas a valid-request NRF flood produces no error logs. No single modality covers every fault type. We treat classification as an analytical instrument rather than a goal: cross-modal coupling features are deliberately weaker classifiers than raw per-signal features, and a SHAP analysis shows the two views rely on different modality pairs, consistent with the coupling view’s value being characterization rather than accuracy. The security-fault results are preliminary, owing to the small, low-variance dataset. The contribution is a reproducible, architecture-grounded map of which modality reveals, and which is blind to, each fault.
...
Cloud-native 5G Core networks emit metrics, logs, and distributed traces, yet faults are typically diagnosed within a single modality. We show that the relationships between these modalities carry fault information that single-signal analysis misses, and we use them to characterize faults in a containerized Open5GS testbed. Our method computes the change in Spearman rank correlation between cross-modal signal pairs, from a pre-fault baseline to the fault window, yielding a coupling-change metric ∆|ρ|. Across 22 operational fault scenarios over seven independent deployments, and 6 security scenarios over three, the analysis surfaces reproducible coupling signatures and, more importantly, modality blindspots that follow the 5G interface architecture: because distributed tracing instruments only the Service-Based Interface, N2 interface partitions and N4/PFCP session faults are trace-blind and characterizable only through metrics-logs coupling, whereas a valid-request NRF flood produces no error logs. No single modality covers every fault type. We treat classification as an analytical instrument rather than a goal: cross-modal coupling features are deliberately weaker classifiers than raw per-signal features, and a SHAP analysis shows the two views rely on different modality pairs, consistent with the coupling view’s value being characterization rather than accuracy. The security-fault results are preliminary, owing to the small, low-variance dataset. The contribution is a reproducible, architecture-grounded map of which modality reveals, and which is blind to, each fault.