AI-driven Infrastructure Log Analysis Transitioning from Reactive Monitoring to Proactive Mitigation in 5G Cloud Native Cores

Abstract

Cloud-native 5G core networks decompose monolithic network functions into hundreds of containerised microservices orchestrated by Kubernetes, producing thousands of infrastructure events per test run. Identifying genuine anomalies among this volume is difficult because the same warning event can be benign or critical depending on its sequential context, because labelled failure data is scarce, and because traditional threshold-based monitoring cannot capture the temporal dependencies that define healthy system behaviour. This thesis addresses that problem by proposing and evaluating a self-supervised, situation-aware log analysis system that learns normal Kubernetes infrastructure event patterns and detects deviations without labelled failure data. The approach formulates anomaly detection as a nextevent prediction task. A deep learning model is trained to predict the next event type in a pod’s lifecycle sequence, and events whose actual reason has low predicted probability receive high anomaly scores. Two architectures are compared, a Transformer encoder and a Long Short-Term Memory (LSTM) network, using learned categorical embeddings of structured event metadata rather than free-text message embeddings. This removes the data leakage identified in an earlier prototype. A rule-based post-processing layer then uses Kubernetes domain knowledge to separate startup noise from genuine operational issues, classify pod-level situations, and rank infrastructure problems by severity. The system is trained on 86,873 events from 36 test runs that span stability, robustness and chaos engineering experiments. It is evaluated on held-out test data as well as on 5 completely unseen test suites. Both architectures reach approximately 86% next-event prediction accuracy (86.6% Transformer, 86.1% LSTM), substantially above a 72.9% bigram baseline, and generalise to unseen failure modes at 89.3% accuracy. An end-to-end evaluation against 6 fault-injection scenarios, including 2 blind cases collected after the system was finalised, shows that the tool correctly identifies the primary affected components in every case. From an industrial perspective, the prototype enables Ericsson to automate post-test infrastructure triage that is currently performed manually, reducing the number of events requiring human attention by 60–76% and surfacing the most critical issues within seconds of test completion