The Big Picture
A zero-shot pipeline that chains visual and language models detects cross-interface performance faults in open cellular networks with a 0.91 F1 score and produces machine-readable incident reports without any labeled training data.
ON THIS PAGE
The Evidence
DAST uses three cooperating agents: a visual model that reads stacked time-series plots, a language model grounded with network knowledge to score suspicious signals, and a second visual pass to pinpoint exact intervals. The system runs without retraining or labeled datasets and outputs affected interfaces, precise time windows, impact ratings, and a reasoning trace. Tested on an open-source cellular testbed under injected latency and packet-loss scenarios, DAST reached an aggregated F1 of 0.910 and outperformed common unsupervised detectors and recent single-model baselines. By reasoning over aligned multi-channel plots and using explicit network knowledge, it catches cascade effects that per-interface detectors miss. LLM-as-Judge Pattern
Data Highlights
1Aggregated F1-score of 0.910 on the experimental testbed, outperforming unsupervised multivariate detectors and recent LLM/VLM baselines.
2Designed to analyze windows of approximately 200 seconds (non-real-time), aligning with slower control loops rather than sub-second mitigation.
3LLM suspect scoring uses a high-confidence threshold (>0.9) to trigger targeted high-resolution visual verification.
What This Means
Network engineers and SREs who need reliable cross-interface observability will get machine-readable incident reports and localized intervals to speed triage. AI engineers and teams building monitoring agents can use the multi-agent pattern to avoid costly labeled datasets and keep detection behavior updatable via a knowledge artifact instead of retraining. Model Context Protocol (MCP) Pattern
Not sure where to start?Get personalized recommendations
Key Figures
Fig 1: Figure 1 : DAST architecture. KPI streams from the four O-RAN interfaces are rendered into stacked line plots (Stage 1) and described in text by VLM-1. An O-RAN-grounded LLM (Stage 2) scores per-interface descriptions against expected behaviour. A second VLM (Stage 3) verifies high-scoring suspects on per-metric heatmaps and emits time intervals plus a WG11-aligned impact rating.
Fig 2: Figure 2 : O-RAN testbed used for DAST evaluation.
Fig 3: Figure 3 : Per-interface confusion matrices for DAST (E2, F1-c, F1-u, A1, and the non-anomalous baseline).
Fig 4: Figure 4 : By leveraging O-RAN domain knowledge, DAST is able to realize that latency in F1-u is the actual anomaly, rather than sporadic packet loss in F1-u, which is actually the consequence.
Ready to evaluate your AI agents?
Learn how ReputAgent helps teams build trustworthy AI through systematic evaluation.
Learn MoreConsiderations
Evaluation used a single open-source stack and a limited set of injected degradation patterns, so performance on heterogeneous multi-vendor deployments is not yet proven. The pipeline is intended for non-real-time diagnosis (hundreds of seconds), so it can't be used for sub-second automated mitigation. Detection quality depends on the underlying vision/language models and the accuracy of the supplied network knowledge, and it may require compute resources and guardrails against model hallucination. Coordination Deadlock
Methodology & More
DAST organizes detection into three focused steps that mirror how a human operator inspects telemetry. First, a visual model ingests stacked, temporally aligned plots of multiple interface metrics and produces a textual profile describing each series' visible behavior. Second, a language model that has access to explicit network-domain knowledge (roles of interfaces, expected traffic patterns, protocol constraints) scores those textual profiles to decide which metrics are most suspicious. Third, for high-confidence suspects the system retrieves high-resolution heatmaps and runs a second visual verification to localize the anomalous time intervals and produce an impact rating and a chain-of-thought rationale. The approach is fully zero-shot: no labeled examples or fine-tuning are required, and the domain knowledge artifact is editable as specs evolve. Reflection Pattern The framework was run on an experimental cellular testbed where latency and packet loss were injected on interfaces such as the user and control planes and the RIC interfaces. DAST produced machine-readable problem reports including exact start/end times, involved interfaces, and low/medium/high impact tags, achieving an aggregated F1 of 0.910 and outperforming state-of-the-art unsupervised detectors and recent single-model LLM/VLM baselines. Practically, the method suggests an observability primitive operators can maintain by updating a knowledge base rather than collecting and labeling traces every time a vendor or deployment changes. Next steps include validating across multi-vendor RANs and closing the loop so outputs can drive automated root-cause actions or policy changes. Consensus-Based Decision Pattern Defense in Depth Pattern
Avoid common pitfallsLearn what failures to watch for
Credibility Assessment:
Mixed modest h-indexes (2–11) including one mid-level researcher; no affiliations listed but some recognizable authors — reasonable credibility.