In some embodiments, attributes of the session (e.g. relating to the call and/or subscriber) are used to label issues accordingly. These can be considered as “dimensions” for aggregating incidents (soft drops). Some exemplary dimensions of incidents for monitoring new terminal devices or software introductions/updates can include the identity of the terminal vendor, the terminal model and software version (which can be acquired from the International Mobile Equipment Identity (IMEI) and User-Agent fields). For monitoring serving network elements (NEs), some example dimensions can be a cell/site identifier, an IP address of the serving Core Network (CN) and IP Multimedia Subsystem (IMS) nodes. Radio-related issues might be tied to specific frequency bands. Interworking/cross-domain issues may be discoverable by a combination of such dimensions.

In embodiments, an anomaly detection module can learn by statistical or machine learning methods the normal patterns (e.g. timely behaviour) of the network for specific metrics such as failure (soft drop) rates, grouped by combinations of different network, subscriber, service or terminal dimensions, such as terminal models of the same vendor, software versions, or different network elements, or subscriber subscription type. The anomaly detection module can learn the normal behaviour using a ‘soft drop rate’ as the “target variable” of the machine learning or statistical analysis as a function of time, using the dimensions of incidents (soft drops) as “features” (according to the generally standard machine learning terminology).