MSADM: Large Language Model (LLM) Assisted End-to-End Network Health Management Based on Multi-Scale Semanticization

Network device and system health management is the foundation of modern network operations and maintenance. Traditional health management methods, relying on expert identification or simple rule-based algorithms, struggle to cope with the heterogeneous networks (HNs) environment. Moreover, current state-of-the-art distributed fault diagnosis methods, which utilize specific machine learning techniques, lack multi-scale adaptivity for heterogeneous device information, resulting in unsatisfactory diagnostic accuracy for HNs. In this paper, we develop an LLM-assisted end-to-end intelligent network health management framework. The framework first proposes a multi-scale data scaling method based on unsupervised learning to address the multi-scale data problem in HNs. Secondly, we combine the semantic rule tree with the attention mechanism to propose a Multi-Scale Semanticized Anomaly Detection Model (MSADM) that generates network semantic information while detecting anomalies. Finally, we embed a chain-of-thought-based large-scale language model downstream to adaptively analyze the fault diagnosis results and create an analysis report containing detailed fault information and optimization strategies. We compare our scheme with other fault diagnosis models and demonstrate that it performs well on several metrics of network fault diagnosis.

💡 Research Summary

The paper introduces MSADM (Multi‑Scale Semanticized Anomaly Detection Model), an end‑to‑end framework for network health management in heterogeneous networks (HNs). Traditional health‑management approaches—expert‑driven rule systems or simple threshold‑based detection—struggle with the diverse scales of key performance indicators (KPIs) across devices such as 5G base stations, vehicular units, and drones. Existing machine‑learning‑based anomaly detectors also lack the adaptability needed for these multi‑scale data, leading to sub‑optimal accuracy.

MSADM addresses this gap through four tightly coupled components. First, a rule‑based multi‑scale normalization module converts raw KPI time‑series into a unified set of semantic state codes (“low”, “medium”, “high”). This is achieved by extracting four statistical features (mean, variance, jitter, and trend quantified by the count of significant extrema) over sliding windows, then applying unsupervised clustering to map each feature vector to a discrete state. A dynamic rule library, continuously updated from historical normal data, ensures that new devices can be incorporated with minimal manual effort.

Second, the normalized state lists feed a dedicated anomaly‑detection and fault‑diagnosis model. The model employs a dual‑attention architecture: temporal attention captures long‑range dependencies within each KPI’s time series, while channel attention learns cross‑KPI relationships across nodes. This design enables precise detection of subtle anomalies and classification of fault types (e.g., software bugs, malicious traffic attacks) even when the underlying data exhibit heterogeneous scales.

Third, the framework introduces “network semanticization”. A domain‑expert‑crafted semantic rule tree translates the discrete state codes and diagnosis results into structured natural‑language sentences (e.g., “Node A shows high packet loss and medium latency, likely caused by an expired TLS certificate”). This textual representation bridges the gap between numeric data and large language models (LLMs), providing them with an intuitive view of the network condition.

Finally, the semanticized descriptions and diagnostic labels are combined into a prompt for an LLM equipped with chain‑of‑thought reasoning. The LLM reasons step‑by‑step about root causes, impact, and remediation, generating a comprehensive report that includes actionable mitigation scripts (e.g., “increase bandwidth for Node B by 100 Mbps and rebalance traffic”).

Experimental evaluation uses real‑world datasets from 5G base stations, vehicular networks, and drone communication links, totaling over a petabyte of KPI measurements. Compared with state‑of‑the‑art detectors such as TranAD and DCDETECTOR, MSADM achieves an average anomaly‑detection accuracy of 97.09 % (versus ~88 % for TranAD) and a fault‑diagnosis accuracy of 89.42 % (versus ~67 %). Ablation studies show that removing the multi‑scale normalization drops performance by 5–10 percentage points, confirming its critical role. Human‑expert assessments of the generated reports reveal a 1.8‑fold improvement in readability and a significant increase in practical usefulness when the semantic rule tree is employed versus feeding raw data directly to the LLM.

The authors acknowledge limitations: the initial unsupervised clustering incurs non‑trivial computational cost, real‑time deployment requires further model compression, and reliance on external LLM services raises privacy concerns. Future work will explore online clustering for streaming data, edge‑optimized attention models, and privacy‑preserving local LLMs. Overall, MSADM demonstrates that combining multi‑scale data normalization, semantic rule‑based textualization, and LLM‑driven reasoning can substantially advance automated health management for complex, heterogeneous network environments.