Machine Learning for Anomaly Detection in RNP Network Operations#

Guilherme Branco Ladvocat (RNP)

• Why: A realistic template for ML adoption in network operations by a team with no data scientists — increasingly the default situation, and a useful counterweight to the ESnet approach.
• What: RNP (Brazilian NREN, ~1800 connected sites, MPLS-TE full-mesh between PoPs) applied ML anomaly detection to interface metrics, ping loss/latency, netflow, and syslog categorization (standard vs. rare message groups). The deliberately pragmatic choice: Elastic's ELSER v2, an out-of-domain model requiring no fine-tuning, running inside the Elastic observability stack they already stood up in 2024 — avoiding "reinventing the wheel" and the need for ML expertise.
• How: Baseline learning on telemetry time series flags deviations where static thresholds fail (interface delay, utilization, netflow anomalies, latency); dashboards group anomalies so the algorithm does the first pass of analysis and engineers interpret. The observability journey started in 2018 with push-model, high-resolution telemetry.
• Where applicable: RNP-specific stack (Elastic), but the incremental, no-data-scientist adoption path is broadly replicable. The stated limitations are honest and important: the model doesn't reason about values, root-cause analysis isn't achieved by a single anomaly-detection job, and engineers still have to interpret the output.