Context-conditioned anomaly detection and dual-graph sparse root-cause localisation for urban rail communication bearer networks

Urban rail communication bearer networks carry heterogeneous operational services over shared devices, ports and links. Their normal key performance indicator (KPI) patterns vary with traffic demand, service composition, active routing, maintenance activities and protection switching. Consequently, legitimate operating changes may resemble network faults, while correlated downstream symptoms may obscure the actual initiating entity. This paper proposes a two-stage framework comprising context-conditioned anomaly detection and dual-graph sparse root-cause localisation. Service, device, port and link entities are represented by type-specific KPI encoders, time-varying active service paths and two directed graphs describing load propagation and fault impact. In the detection stage, a masked graph-temporal predictor estimates each entity's context-dependent normal KPI distribution without accessing the target entity's current KPI values. Scenario-wise empirical calibration then converts heterogeneous predictive deviations into comparable anomaly significance. In the localisation stage, the calibrated entity--time anomaly field is modelled as the lagged response to sparse non-negative demand-side and resource-side sources. Topology-constrained group-sparse inversion ranks the initiating entities and distinguishes the two source sides. Affected services are subsequently confirmed using the inferred propagation region, active service paths and observed service-quality anomalies. Evaluation was conducted on an isolated, trace-driven platform reproducing one anonymised line-level operational bearer network with 152 entities. The main test comprised 102 controlled single-source anomaly events in five categories and eight held-out normal scheduled service bursts. The proposed method achieved an event-level anomaly-detection F1-score of 89.3% and a Top-1 root-cause localisation accuracy of 85.3%. These results support the framework under controlled within-network conditions, while generalisation to other lines, equipment environments and concurrent incidents remains to be established.