Rethinking Telemetry Design for Fine-Grained Anomaly Detection in 5G User Planes

TL;DR

Kestrel is a sketch-based telemetry system for 5G user planes that offers fine-grained anomaly detection with significantly reduced bandwidth and improved accuracy over existing methods.

Contribution

We introduce Kestrel, a novel sketch-based telemetry system that enhances anomaly detection in 5G networks by combining histogram-augmented sketches with formal guarantees.

Findings

Kestrel achieves 10% better detection accuracy than existing schemes.

Reduces export bandwidth by 10x compared to per-packet postcards.

Provides formal detectability guarantees for anomaly signals.

Abstract

Detecting QoS anomalies in 5G user planes requires fine-grained per-flow visibility, but existing telemetry approaches face a fundamental trade-off. Coarse per-class counters are lightweight but mask transient and per-flow anomalies, while per-packet telemetry postcards provide full visibility at prohibitive cost that grows linearly with line rate. Selective postcard schemes reduce overhead but miss anomalies that fall below configured thresholds or occur during brief intervals. We present Kestrel, a sketch-based telemetry system for 5G user planes that provides fine-grained visibility into key metric distributions such as latency tails and inter-arrival times at a fraction of the cost of per-packet postcards. Kestrel extends Count-Min Sketch with histogram-augmented buckets and per-queue partitioning, which compress per-packet measurements into compact summaries while preserving anomaly-relevant signals. We develop formal detectability guarantees that account for sketch collisions, yielding principled sizing rules and binning strategies that maximize anomaly separability. Our evaluations on a 5G testbed with Intel Tofino switches show that Kestrel achieves 10% better detection accuracy than existing selective postcard schemes while reducing export bandwidth by 10x.