PhD candidate Niloy Saha, Research Professor Noura Limam, Postdoctoral Researcher Yang Xiao, and University Professor Raouf Boutaba have received the Best Paper Award at NOMS 2026, the 39^th IEEE/IFIP Network Operations and Management Symposium, held May 18–22 in Rome, Italy.

Their paper, Rethinking Telemetry Design for Fine-Grained Anomaly Detection in 5G User Planes, introduces a sketch-based telemetry system called Kestrel that was empirically shown to detect quality-of-service anomalies in 5G user planes with 10 per cent greater accuracy than existing selective telemetry schemes while reducing export bandwidth by a factor of 10.

Left to right: Research Professor Noura Limam, PhD candidate Niloy Saha, and Raouf Boutaba, University Professor and Director of the Cheriton School of Computer Science. Inset portrait: Postdoctoral Researcher Yang Xiao

About this research

Modern 5G networks support a wide range of applications with strict quality-of-service requirements. For instance, data-intensive services such as 4K video streaming require high data rates, whereas applications like remote surgery demand ultra-reliable, low-latency connectivity to ensure consistent performance and responsive feedback.

For network operators, ensuring such service quality requires fine-grained real-time visibility into the 5G user plane, where app traffic is forwarded. However, existing approaches face a fundamental trade-off. Coarse, per-class counters are lightweight but hide transient and flow-specific anomalies. In contrast, detailed telemetry at the packet level provides complete visibility but incurs prohibitive costs that grow linearly with the line rate.

The research team’s award-winning paper introduces Kestrel, a sketch-based telemetry system designed to bridge this gap.

Kestrel provides fine-grained visibility into key metric distributions, such as latency tails and inter-arrival times, at a fraction of the cost of per-packet telemetry. To keep the system lightweight enough to run on production switch hardware, the researchers designed Kestrel around a compact probabilistic data structure based on the Count-Min Sketch, tracking distributions rather than volumes through histogram-augmented buckets and per-queue partitioning. Because sketches inevitably introduce collisions that can mask the signals being measured, the team paired this design with a formal detectability framework, deriving the sizing rules and binning strategies needed to keep anomalies visible and maximize their separability. This allows operators to detect subtle anomalies, including congestion, microbursts, resource contention, and policy violations, that are often hidden from conventional monitoring systems.

The researchers implemented Kestrel on Intel Tofino switches and evaluated it on a realistic 5G testbed. Their experiments showed that Kestrel detected anomalies with 10 per cent higher accuracy than existing selective telemetry schemes while reducing telemetry overhead by a factor of 10. Importantly, the system can detect transient events with sub-second responsiveness while maintaining predictable hardware resource usage, demonstrating that anomaly-driven telemetry design is both practical and effective for next-generation mobile networks.

While the work focuses on hardware-accelerated user plane functions, the next phase of the research will extend these principles to software data planes, enabling lightweight, anomaly-aware monitoring for heterogeneous 5G deployments.

To learn more about the award-winning research on which this article is based, please see Niloy Saha, Noura Limam, Yang Xiao, Raouf Boutaba. Rethinking Telemetry Design for Fine-Grained Anomaly Detection in 5G User Planes. IEEE/IFIP Network Operations and Management Symposium (NOMS 2026). Rome, Italy. May 18–22, 2026.