DAST: A VLM-LLM Framework for Cross-Interface Anomaly Detection in O-RAN

2026-06-06 · Source: cs.AI updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cloud Computing & IT Infrastructure, Data Science & Analytics · Depth: Expert, extended

Summary

DAST is a zero-shot multi-agent framework designed for cross-interface anomaly detection in Open RAN (O-RAN) environments. It addresses critical challenges in 6G networks, such as scarce labeled baselines, rapidly evolving threats, and high-dimensional telemetry that overwhelm traditional Time-Series Anomaly Detection (TSAD) methods. DAST employs a three-stage VLM \u2192 LLM \u2192 VLM pipeline, converting multivariate KPI streams into visual representations, scoring textual per-interface descriptions against O-RAN domain knowledge, and verifying suspicious activities on high-resolution heatmaps. The framework outputs problematic interfaces, anomalous time intervals, an O-RAN WG11-aligned operational impact rating, and a decision rationale. Evaluated on real O-RAN testbed traces, DAST achieved a 0.910 F1-Score and 0.843 Accuracy, significantly outperforming existing TSAD baselines.

Key takeaway

For MLOps Engineers deploying anomaly detection in O-RAN, traditional Time-Series Anomaly Detection (TSAD) methods are insufficient due to evolving threats and scarce labeled data. You should consider implementing zero-shot, multi-agent VLM-LLM frameworks like DAST, which integrate O-RAN domain knowledge. This approach provides robust cross-interface anomaly detection, reduces false alarms, and offers actionable insights for SRE-style troubleshooting, making your network more resilient against performance degradation attacks.

Key insights

Multi-agent VLM-LLM reasoning, grounded in O-RAN domain knowledge, effectively detects complex cross-interface anomalies in disaggregated networks.

Principles

• O-RAN disaggregation expands attack surfaces.
• Traditional TSAD struggles with evolving threats.
• Domain knowledge enhances zero-shot detection.

Method

DAST profiles KPI plots with a VLM, scores textual descriptions against O-RAN domain knowledge using an LLM, then a second VLM verifies suspects on heatmaps for precise anomaly localization.

In practice

• Visualize KPI streams for VLM input.
• Integrate O-RAN specifications as domain knowledge.
• Decompose detection tasks across specialized agents.

Topics

• O-RAN
• Anomaly Detection
• Vision Language Models
• Large Language Models
• Network Security
• 6G Networks

Best for: Research Scientist, AI Scientist, Machine Learning Engineer, MLOps Engineer

Related on AIssential

• DAST: A VLM-LLM Framework for Cross-Interface Anomaly Detection in O-RAN — DAST employs a VLM-LLM-VLM pipeline for zero-shot cross-interface anomaly detection in O-RAN, outperforming traditional TSAD methods.
• POIROT: Interrogating Agents for Failure Detection in Multi-Agent Systems — POIROT enables LLM-MAS to self-diagnose failures by repurposing internal agents, outperforming external evaluators.
• EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems — EventADL provides open-box anomaly detection and root cause localization for cloud event data, leveraging semantic and frequency patterns.
• AnomalyAgent: Training-Free Agentic Models for Zero-/Few-Shot Anomaly Detection — AnomalyAgent uses training-free agentic MLLMs for advanced zero-shot and few-shot anomaly detection, surpassing VLM limitations.
• Token-Efficient Change Detection in LLM APIs — B3IT enables cost-effective, black-box LLM change detection using specific "Border Inputs" that yield multiple top output tokens.
• CRAFTIIF: Cross-Resolution Analytic Four-Type Interpretable Isolation Forest for Multivariate Time Series Anomaly Detection — CRAFTIIF offers interpretable, unsupervised MTSAD by structurally separating anomaly types using wavelet features and dedicated Isolation Forests.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.AI updates on arXiv.org.