1 Introduction

Modern networked systems generate massive volumes of telemetry data from servers, applications, microservices, and communication interfaces [1,2]. As digital infrastructures continue to grow in scale and complexity, ensuring high system reliability and uninterrupted service delivery has become a fundamental requirement across domains such as cloud computing, telecommunications, banking, and healthcare [3]. To maintain service quality, organizations rely on monitoring systems that track key performance indicators (KPIs) like CPU usage, latency, packet throughput, and error rates. However, traditional monitoring solutions often struggle to detect and prioritize critical failures in real time, leading to delayed responses, cascading outages, and significant business losses [4]. This challenge is intensified by the emergence of distributed architectures, dynamic workloads, and multi-layer dependencies, which render conventional threshold-based monitoring ineffective [5].

While anomaly detection has been extensively studied for identifying abnormal system behavior [6,7], it does not fully address the operational needs of real-world network management. Most existing approaches treat anomaly detection as a binary decision problem flagging whether a point or segment is anomalous without explicitly modeling operational severity, contextual relevance, or business impact. As a result, monitoring teams are overwhelmed by high alert volumes, including redundant, low-priority, or false-positive events, a phenomenon commonly described as alert fatigue. The lack of intelligent alert prioritization slows the escalation of critical issues and reduces Network Operations Center efficiency, motivating context-aware alert ranking and triage. Although AIOps platforms have improved noise reduction and detection, recent surveys note open gaps in aligning anomaly signals with service risk and business impact particularly for predictive escalation workflows [8].

In this study, business impact refers to the operational and service-level consequences of failure events, including service disruption severity, failure duration, and functional criticality of affected components. Business impact is measured through a composite Business Impact Score (BIS), which aggregates anomaly severity, estimated downtime, and service criticality into an impact-aware escalation signal. This formulation enables alert prioritization based not only on detection confidence but also on expected operational risk.

This research addresses the gap between anomaly detection and actionable alert intelligence by proposing a framework that not only predicts failure events but also determines their escalation priority based on real-time severity and business impact. The primary objective of this study is to develop a predictive alert escalation model capable of learning both degradation patterns in time-series KPIs and contextual risk indicators derived from operational metadata. The motivation of this work is driven by the practical need to support proactive operations, enabling intelligent decision automation in IT service management (ITSM) systems.

The significance of this research lies in its ability to move beyond anomaly detection and introduce meaningful escalation intelligence. Instead of treating all anomalies equally, the proposed model analyzes their potential business implications before generating alert priorities. This contributes to minimizing operational downtime, improving response efficiency, and aligning predictive analytics with real-world service management needs. The contributions of this work can be summarized as follows:

• A novel dual-stream architecture that integrates temporal failure pattern learning with auxiliary severity reasoning, achieving a precision of 0.94, recall of 0.92, F1-score of 0.93, PR-AUC of 0.95, and ROC-AUC of 0.94 on the combined multivariate KPI dataset.
• A business impact scoring mechanism for alert prioritization and escalation awareness, attaining an Impact-Weighted F1 (IW-F1) of 0.85 and BIS accuracy of 0.88. Based on a cost-aware escalation analysis that emphasizes earlier detection of high-severity events, the framework demonstrates a potential operational cost reduction of up to 31.6% relative to baseline alerting strategies, under consistent evaluation assumptions.
• A comprehensive evaluation on real KPI datasets and the AI4I_2020 predictive maintenance dataset, demonstrating consistent gains over LSTM, GRU, CNN-LSTM, and BiLSTM-VAE baselines in both predictive metrics and impact-aware alert escalation.

The proposed framework employs a bidirectional temporal encoder to extract failure patterns from multivariate KPI sequences, and an auxiliary severity encoder to incorporate business and operational context. These two information streams are fused using an attention-based mechanism, and escalation labels are generated using a business impact-aware classification layer. The model is trained and validated using both univariate and combined multivariate datasets to demonstrate robustness and generalization.

The cross-domain relevance between telemetry data and business context is achieved through feature-level alignment between the two streams. Temporal KPI features capture system behavior and degradation dynamics, while structured operational features from the AI4I_2020 dataset encode severity, failure modes, and contextual risk indicators. These heterogeneous features are mapped into a shared latent space through separate encoders and fused using an attention mechanism, enabling the model to associate technical anomalies with their potential operational and business consequences.

The remainder of this paper is organized as follows. The related work section 2 reviews contributions in anomaly detection, predictive maintenance, and incident escalation. The methodology section 3 presents the architecture and algorithmic details of the proposed framework. The results section 4 reports experimental findings and performance comparisons. Section 5 is followed by a discussion of insights, limitations, and practical implications. Finally, in section 6 the paper concludes with future research directions.

2 Related work

Research in predictive analytics for IT operations has evolved across several parallel directions, primarily covering anomaly detection, predictive maintenance, alert correlation, and intelligent incident escalation [9]. Traditional approaches to anomaly detection have focused on statistical thresholding and rule-based systems. These methods rely on predefined limits to detect abnormal behavior in time-series metrics such as CPU utilization, memory load, and network throughput. While threshold-based systems are simple to implement, they generate excessive false alarms due to their inability to adapt to seasonal trends, dynamic environments, and multi-metric dependencies [10]. Statistical baselines lack contextual awareness and produce a high operational overhead by overwhelming engineers with alerts of equal priority.

Machine learning-based anomaly detection made significant progress by using unsupervised models such as clustering, distance-based outlier detection, and density estimation. These techniques improved detection by learning normal patterns from historical data rather than relying on static thresholds. However, traditional machine learning methods face difficulties with high-dimensional, multivariate, and streaming data common in modern network and cloud infrastructures, which demand online and adaptive detection. They also pose challenges for interpretability in complex failure scenarios, where operators must distinguish transient fluctuations from genuine service degradation; recent work on explainable time-series anomaly detection underscores this gap and proposes methods to make decisions more transparent [11]. Broad surveys further highlight these limitations and motivate deep, context-aware approaches for time-series anomaly detection in operational settings.

Deep learning approaches have demonstrated strong performance in temporal anomaly detection [12]. Recurrent architectures such as LSTM and GRU model long-term dependencies in metric sequences and improve sequence modeling over classical baselines [13]. Encoder–decoder architectures and variational autoencoders detect anomalies by reconstructing normal sequences and flagging deviations [14,15]. Temporal convolutional networks have also been investigated for long-range temporal modeling with reduced computational complexity [16]. Hybrid models that combine CNNs and RNNs capture both local and global anomaly contexts, and have been applied in monitoring and predictive maintenance settings [17]. These methods effectively detect anomalies; however, they generally treat all anomalies equally, without incorporating business impact, service priority, or operational criticality, which contributes to alert fatigue and suboptimal triage in operations.

Parallel research in predictive maintenance has focused on estimating remaining useful life (RUL), early failure detection, and risk scoring from sensor data in industrial settings [18,19]. These frameworks have been developed and benchmarked primarily for equipment and process assets (e.g., rotating machinery, production lines, aircraft subsystems), making many assumptions about degradation physics, sensing, and duty cycles that are domain-specific [20,21]. As a result, direct transfer to IT infrastructure monitoring is limited: predictive-maintenance pipelines do not address triage, prioritization, or escalation of alerts in complex service ecosystems. Recent surveys and systems work in IT operations underscore the need for intelligent alert correlation and incident management beyond anomaly detection, and show that unmanaged alert volume leads to alert fatigue and delayed response. Moreover, large-scale and multi-tenant environments pose additional constraints on response time and resource allocation that require explicit escalation policies and optimization, which classic PdM formulations do not cover [22].

Alert correlation has emerged as another direction to reduce alert noise by grouping related alerts. Correlation engines analyze temporal proximity and causal relations among alerts to suppress redundancy and surface representative incidents [23]. Graph-based methods further model dependencies among services and alerts, enabling relation-aware grouping and root-cause reasoning on dependency or causality graphs [24,25]. While effective at reducing alert volume, such techniques typically stop short of escalation prediction and rarely incorporate business-critical context for prioritization. Moreover, they often require explicit configuration or accurate dependency models; maintaining these in fast-evolving, cloud-native microservice environments is difficult and costly.

Incident escalation prediction remains relatively unexplored within AIOps and IT service management. Most operational workflows still follow ITIL-style impact urgency rules and service-level agreements rather than predictive escalation policies [26]. A small number of studies examine escalation learning as a classification task in ticketing contexts for example, predicting whether customer or support tickets will escalate [27,28] but these efforts treat escalation separately from upstream anomaly detection. Survey evidence further indicates the research landscape is fragmented, with piecemeal solutions and no unified architecture that jointly links detection and escalation. Finally, existing approaches rarely incorporate explicit business impact into the decision to escalate; recent works on alert prioritization underscore the broader need for risk- and context-aware triage rather than static mappings. In practice, widely adopted IT service management (ITSM) platforms such as ServiceNow and commercial AIOps tools rely primarily on predefined impact–urgency matrices and rule-based workflows for escalation, rather than learned predictive models, highlighting the lack of data-driven escalation intelligence in current operational systems.

Recent AIOps work integrates machine learning into alert and incident workflows, but most deployed solutions remain detection-centric [29]. In practice, anomaly detection drives alert generation while downstream decision steps such as escalation policy selection are under-specified or handled outside the learning pipeline [30]. This gap limits actionability: operations teams still face alert fatigue and must prioritize alerts manually or with ad-hoc rules. Research on context-aware prioritization exists (reinforcement-learning based triage), but it targets SOC/security settings rather than service reliability for IT operations [31,32]. As a result, current AIOps rarely connect detection outputs to escalation choices that weigh business impact or operational cost, despite long-standing ITIL goals of aligning operations with business requirements. Methodologically, the proposed framework differs by embedding escalation awareness directly into the learning objective rather than treating escalation as an external policy decision. Architecturally, the separation of temporal and severity encoders allows heterogeneous data sources to be modeled appropriately, while attention-based fusion enables dynamic weighting of technical degradation and business context—capabilities not present in existing single-stream or detection-centric architectures.

In contrast to these studies, the proposed approach explicitly unifies anomaly detection and escalation reasoning within a single learning framework. Existing anomaly detection models focus on identifying abnormal behavior but do not determine whether an event warrants escalation, nor do they incorporate business impact or operational risk into the prediction pipeline. Ticket-based escalation models, on the other hand, operate downstream of monitoring systems and are disconnected from real-time telemetry. Architecturally, our dual-stream design differs from prior work by jointly learning temporal degradation patterns from KPI time-series data and contextual severity signals from structured operational features, which are fused through an attention mechanism and translated into impact-aware escalation decisions via a Business Impact Scoring (BIS) layer. This integrated design enables predictive escalation aligned with operational urgency, rather than post hoc alert handling or static rule-based prioritization.

3 Methodology

This section presents the proposed Dual-Stream Predictive Alert Escalation Framework, which integrates temporal failure pattern learning with business impact-aware severity scoring. The framework consists of four major stages: (1) KPI time-series modeling via a temporal encoder, (2) auxiliary severity modeling using structured risk indicators, (3) alert escalation fusion through a dual-stream architecture, and (4) impact-aware decision inference. An overview of the architecture is shown in Fig 1.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 1. Dual-Stream Predictive Alert Escalation Framework: Neural network architecture combining temporal KPI analysis with business impact assessment for automated alert classification.

https://doi.org/10.1371/journal.pone.0350676.g001

From an operational perspective, the proposed framework models alert escalation as an automated decision step that assigns an escalation level to each monitoring window based on both technical degradation and business risk. The model outputs an escalation label corresponding to Normal, Warning, and Critical states, which can be directly mapped to standard NOC or ITSM response actions such as continued monitoring, operator investigation, or immediate escalation. The Business Impact Score (BIS) serves as an impact-aware adjustment that prioritizes alerts not only by anomaly severity but also by expected operational cost, enabling earlier handling of high-risk events.

Regarding alert correlation, prioritization, and escalation, the proposed model is designed to complement existing alert correlation and suppression mechanisms rather than replace them. Alert correlation can be applied upstream to group and deduplicate raw alerts, reducing noise, while the proposed framework operates downstream by performing impact-aware prioritization and escalation prediction on the remaining alerts. No assumption is made that correlation is already solved; instead, the model adds a learning-based escalation layer that integrates temporal KPI behavior with auxiliary severity context to improve escalation quality within existing ITSM workflows.

For clarity and ease of reference, Table 1 summarizes the mathematical symbols and notation used throughout this section.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Summary of mathematical notation used in the Methodology section.

https://doi.org/10.1371/journal.pone.0350676.t001

3.1 Data preprocessing

The proposed framework utilizes two categories of datasets: (i) multivariate time-series Key Performance Indicator (KPI) logs from a network management environment (cpu4.csv, server_res_eth1out_curve_6.csv, server_res_eth1out_curve_61.csv) and (ii) an auxiliary structured failure severity dataset (AI4I_2020.csv). These datasets were processed to enable dual-stream learning for failure pattern extraction and business impact-aware alert escalation. The preprocessing pipeline consists of cleaning, normalization, temporal segmentation, anomaly labeling, and dataset partitioning as described below.

3.1.1 Missing value imputation.

Due to real-world logging frequency fluctuations, missing values were observed in the KPI data streams. To preserve temporal continuity, we applied a hybrid imputation strategy combining forward fill and deep learning-based temporal interpolation using a Temporal Autoencoder (TAE). For each KPI sequence x(t):

(1)

where k is the look-back window. The temporal autoencoder learns latent temporal dependencies to restore missing values.

3.1.2 Noise reduction using denoising autoencoder.

Raw KPI signals exhibit high-frequency noise due to metric collection jitter. A Denoising Autoencoder (DAE) was trained to reconstruct denoised signals:

(2)

where is the noise-corrupted input. The reconstruction minimized:

(3)

The output was used for downstream modeling.

3.1.3 Normalization.

To stabilize training and remove scale differences between CPU utilization and network throughput metrics, we applied Z-score normalization:

(4)

where and denote mean and standard deviation estimated from the training set to prevent data leakage.

3.1.4 Temporal segmentation.

To enable predictive modeling, each KPI time series was segmented using a sliding window approach.

(5)

where L = 64 represents the sequence length, and a stride s = 8 was used for overlapping window sampling to enhance training diversity.

3.1.5 Anomaly-aware alert label generation.

Since the KPI datasets lack ground-truth alert escalation labels, weak supervision was used to derive anomaly-driven alert scores. Statistical anomaly scores were computed using the median absolute deviation (MAD):

(6)

An alert label y(t) was generated as:

(7)

The thresholds and were selected empirically as 2.5 and 4.0 respectively.

3.1.6 Auxiliary feature integration.

The AI4I dataset provided severity-relevant failure indicators. The failure label and operational attributes were modeled as structured embeddings using a multilayer perceptron:

(8)

This auxiliary representation was later fused with temporal features.

3.1.7 Train-validation-test split.

The preprocessed dataset was partitioned chronologically to prevent temporal leakage as follows:

(9)

Sequences were split by timestamp to maintain causal consistency.

3.1.8 Class imbalance handling.

To address anomaly sparsity, we applied a focal loss weighting strategy during training:

(10)

where and improved minority alert sensitivity.

3.2 Proposed methodology

3.2.1 Problem formulation.

Let denote a multivariate KPI time series with m metrics sampled over time t. Each windowed subsequence of length L is represented as:

(11)

The objective is to learn an alert escalation function that maps KPI behavior to an escalation severity level :

(12)

where encodes business risk attributes. The framework minimizes the expected escalation error:

(13)

3.2.2 Temporal failure pattern encoder.

The KPI sequences exhibit temporal dependencies and seasonality. We employ a bidirectional LSTM encoder to extract latent temporal patterns:

(14)

where is the encoded fault representation. Additionally, anomaly reconstruction is learned using a Variational Autoencoder (VAE) objective:

(15)

where q(z|x) is the variational posterior and controls latent regularization. High reconstruction error indicates potential system degradation.

3.2.3 Auxiliary severity encoder.

To incorporate failure semantics from operational metadata, structured features from the AI4I dataset are encoded as:

(16)

where v is the auxiliary feature vector and is the ReLU activation. The auxiliary loss is optimized using:

(17)

with C severity classes.

3.2.4 Dual-stream feature fusion.

Outputs from both streams are combined using an attention-based fusion mechanism:

(18)(19)

where f is the fused escalation feature and is a weighting hyperparameter.

3.2.5 Business impact scoring layer.

A Business Impact Score (BIS) is computed to prioritize escalation based on risk cost:

(20)

where S is anomaly severity, D is failure duration, and F is functional criticality weight. The escalation probability is then obtained:

(21)

3.2.6 Architectural details.

The proposed Dual-Stream Predictive Alert Escalation Network consists of two learning branches: (1) a Temporal Failure Pattern Encoder for multivariate KPI sequence modeling, and (2) an Auxiliary Severity Encoder for business risk context learning. The learned representations are fused using a trainable attention mechanism to generate an escalation-aware risk score. Table 2 summarizes the layer configuration, trainable parameters, and output dimensions for each module in the network.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Network architecture configuration for the proposed dual-stream escalation framework.

https://doi.org/10.1371/journal.pone.0350676.t002

The temporal encoder uses a two-layer Bidirectional LSTM stack to capture long-range dependencies in KPI failure patterns. Latent regularization is achieved using a Variational Autoencoder (VAE) bottleneck, enabling robust reconstruction of degradations under noisy telemetry inputs. The auxiliary encoder compresses structured severity indicators from operational logs into a compact embedding . Attention fusion dynamically assigns weights to temporal and auxiliary features as:

(22)(23)

where represents learned relevance weights and controls auxiliary stream influence.

This hybrid architecture allows the model to jointly optimize temporal anomaly detection and business-aware escalation reasoning, making it suitable for proactive network operations.

3.3 Training and implementation details

This subsection describes the learning objectives, optimization strategy, hyperparameter configuration, and implementation setup used for training the proposed dual-stream predictive alert escalation framework.

3.3.1 Loss function design.

The overall training objective combines three components: temporal reconstruction loss from the Variational Autoencoder (VAE), auxiliary classification loss from the auxiliary severity encoder, and escalation prediction loss from the final fusion network. The total loss is defined as:

(24)

where , and are weighting coefficients.

3.3.2 Optimization strategy.

The model parameters were optimized using the Adam optimizer due to its adaptive learning capability:

(25)

where is the learning rate, and , are the first and second moment estimates.

3.3.3 Regularization and dropout.

To prevent overfitting, we employed L₂ weight regularization along with dropout layers in both streams:

(26)

and a dropout probability of p = 0.3 was applied to fully connected layers.

3.3.4 Hyperparameter configuration.

The key hyperparameters were empirically selected based on validation performance. Table 3 summarizes the configuration.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Hyperparameter configuration.

https://doi.org/10.1371/journal.pone.0350676.t003

3.3.5 Computational complexity.

The computational complexity of the temporal encoder dominates the forward pass, approximately:

(27)

where T is the sequence length and h is the LSTM hidden size. The overall framework has linear complexity in time and is suitable for real-time inference in network monitoring.

3.3.6 Implementation environment.

All experiments were implemented in Python using the PyTorch deep learning framework. Training was conducted on an NVIDIA GPU environment with CUDA acceleration. Table 4 summarizes the key implementation details.

Download:

• PNG
  larger image
• TIFF
  original image

Table 4. Implementation environment.

https://doi.org/10.1371/journal.pone.0350676.t004

4 Results

This section presents a comprehensive performance evaluation of the proposed Dual-Stream Predictive Alert Escalation Framework on individual KPI datasets (cpu4, server_res_eth1out_curve_6, server_res_eth1out_curve_61) and the combined multivariate setting. Additional comparisons with baseline models demonstrate the superiority of the proposed approach in alert escalation accuracy, robustness, and impact-aware decision making.

4.2 Quantitative evaluation results

To assess the effectiveness of the proposed Dual-Stream Predictive Alert Escalation Framework, we conducted a series of quantitative experiments using the selected datasets. The evaluation considers multiple performance metrics, including accuracy, precision, recall, F1-score, lead time, escalation hit rate, and business impact score. Each table below presents results under different configurations, model comparisons, or dataset partitions. The best performing model in each comparison is highlighted in bold.

The baseline models included in the experimental evaluation were selected to represent widely adopted and complementary modeling paradigms commonly used in time-series anomaly detection and failure prediction tasks. Recurrent neural network models such as LSTM and GRU are established baselines for sequential KPI modeling due to their ability to capture temporal dependencies. The CNN-LSTM architecture is included to represent hybrid spatial–temporal models that combine local pattern extraction with long-term sequence learning. Tree-based models such as XGBoost and Random Forest are included as strong non-sequential baselines that operate on engineered statistical features and are widely used in operational monitoring systems. GRU-Attention is included to evaluate the impact of explicit attention mechanisms on recurrent architectures. Collectively, these models provide a balanced comparison across classical machine learning, recurrent deep learning, hybrid architectures, and attention-enhanced sequence models, ensuring a fair and comprehensive baseline evaluation.

4.2.1 Dataset-specific performance summary.

Table 5 presents a comprehensive overview of the datasets used in our experiments. The evaluation involves both time-series and structured datasets, each serving a distinct purpose in the proposed dual-stream framework. The cpu4, server_res_eth1out_curve_6, and server_res_eth1out_curve_61 datasets contain 12,480 univariate KPI samples each, and are used for learning degradation patterns and detecting failure signatures in different network conditions. The AI4I 2020 dataset (denoted as AI4I_2020 in Table 5) provides 10,000 structured samples with seven features and supports the modeling of auxiliary severity information. Additionally, we constructed a Combined KPI Dataset by merging three univariate series into a multivariate KPI sequence, enabling the end-to-end training and testing of the proposed alert escalation system. This diverse dataset configuration allows the model to learn both temporal degradation dynamics and structured business impact factors effectively.

Download:

• PNG
  larger image
• TIFF
  original image

Table 5. Summary of datasets used for evaluation.

https://doi.org/10.1371/journal.pone.0350676.t005

The role of each dataset, summarized in Table 5, each dataset serves a distinct and complementary purpose in the experimental evaluation. The cpu4 dataset represents compute resource utilization and is used to evaluate the model’s ability to detect processor-related degradation patterns, with results reported in Section 4.1.2. The server_res_eth1out_curve_6 dataset captures network interface output behavior and is evaluated separately in Section 4.1.3 to assess robustness under network-related anomalies. The server_res_eth1out_curve_61 dataset reflects a distinct Network Traffic Degradation (used in combined KPI) pattern and is included as the third KPI stream used to construct the combined multivariate KPI dataset. The AI4I 2020 dataset provides structured failure severity and operational context features, which are used exclusively by the Auxiliary Severity (input to severity encoder) encoder and are not evaluated as a standalone time-series dataset. The combined multivariate KPI dataset in Section 4.1.4 is formed by integrating the three KPI time-series streams (cpu4, server_res_eth1out_curve_6, and server_res_eth1out_curve_61) to enable end-to-end evaluation of alert escalation in a multivariate setting.

4.2.2 Results on CPU KPI dataset.

As shown in Table 6, the proposed Dual-Stream model significantly outperforms baseline models on the cpu4 dataset across all evaluation metrics. Traditional models like LSTM and GRU demonstrate moderate performance, while hybrid models such as CNN-LSTM and BiLSTM-VAE show marked improvements in capturing temporal patterns and reducing false positives. However, the Dual-Stream architecture achieves the highest scores, with a precision of 0.92, recall of 0.90, and F1-score of 0.91. Furthermore, it registers superior ROC-AUC and PR-AUC values of 0.94 and 0.93 respectively, indicating strong discrimination ability and reliability in rare-event detection. These results validate the effectiveness of combining temporal degradation embeddings with auxiliary severity features for accurate and impact-aware failure prediction.

Download:

• PNG
  larger image
• TIFF
  original image

Table 6. Performance comparison on cpu4 dataset.

https://doi.org/10.1371/journal.pone.0350676.t006

4.2.3 Results on network KPI dataset.

Table 7 presents the model evaluation on the server_res_eth1out_curve_6 dataset, which captures univariate network resource utilization metrics under potential degradation conditions. Similar to the CPU dataset, the proposed Dual-Stream framework consistently outperforms the baseline architectures across all listed metrics. While CNN-LSTM and BiLSTM-VAE demonstrate strong results due to their hybrid temporal modeling capacity, the proposed model shows improved robustness with a precision of 0.91 and recall of 0.89, resulting in an F1-score of 0.90. The model also exhibits high ROC-AUC and PR-AUC values of 0.93 and 0.91 respectively, highlighting its ability to maintain high detection reliability under noisy network KPI scenarios. These findings emphasize the model’s capability to generalize across different failure modalities in network environments.

Download:

• PNG
  larger image
• TIFF
  original image

Table 7. Performance comparison on server_res_eth1out_curve_6 dataset.

https://doi.org/10.1371/journal.pone.0350676.t007

4.2.4 Combined multivariate KPI dataset.

Table 8 evaluates the models on the multivariate dataset formed by integrating multiple KPI time-series streams, simulating a realistic escalation detection setting. Traditional ensemble models such as XGBoost and Random Forest demonstrate moderate performance, achieving F1-scores of 0.80 and 0.81 respectively. GRU-Attention and BiLSTM-VAE further improve results by modeling sequential dependencies and latent structures. However, the proposed Dual-Stream architecture achieves superior metrics with a precision of 0.94 and recall of 0.92, resulting in an F1-score and Macro-F1 of 0.93. Notably, the model attains the highest PR-AUC of 0.95, indicating strong robustness under class imbalance. These results demonstrate the effectiveness of fusing temporal degradation patterns with business-critical severity signals in a multivariate context.

Download:

• PNG
  larger image
• TIFF
  original image

Table 8. Performance on combined KPI dataset.

https://doi.org/10.1371/journal.pone.0350676.t008

4.2.5 Impact-aware evaluation.

Table 9 presents a comprehensive evaluation of the proposed framework under business-centric performance metrics. The Impact-Weighted F1 Score (IW-F1) measures the ability of each model to detect critical events while emphasizing their operational severity. Business Impact Score (BIS) Accuracy reflects the framework’s ability to match escalation predictions with business-prioritized severity classes. Cost Savings quantifies the potential operational efficiency gained by proactive mitigation. Lastly, Kendall’s assesses the ordinal agreement between predicted and actual severity rankings. Compared to baseline models, the proposed dual-stream approach achieves the highest IW-F1 (0.85) and BIS Accuracy (0.88), leading to 31.6% estimated cost savings and a strong ordinal correlation (), demonstrating its alignment with impact-aware operational priorities. The TCN baseline in Table 9 refers to a Temporal Convolutional Network, which employs causal and dilated convolutions to model long-range temporal dependencies in time-series data. TCN is included as a representative convolution-based sequence modeling approach that has demonstrated strong performance in time-series forecasting and anomaly detection, providing a non-recurrent alternative for comparison with recurrent and hybrid models.

Download:

• PNG
  larger image
• TIFF
  original image

Table 9. Impact-aware escalation evaluation with additional convolutional and recurrent baselines.

https://doi.org/10.1371/journal.pone.0350676.t009

4.2.6 Ablation study.

Table 10 presents an ablation study to assess the contribution of each major component of the proposed framework on the combined KPI dataset. Removing the auxiliary stream results in a noticeable drop in both IW-F1 and PR-AUC, indicating the value of structured severity cues. In this ablation setting, removing the auxiliary stream specifically refers to disabling the auxiliary severity encoder and excluding all severity-related structured features derived from the AI4I_2020 dataset, while keeping the temporal KPI encoder and fusion pipeline unchanged. Excluding the attention fusion mechanism further reduces performance, confirming its role in effectively merging temporal and auxiliary embeddings. Omitting the BIS layer significantly impacts the IW-F1 score, highlighting its importance in business impact alignment. The temporal stream alone performs moderately well, demonstrating the baseline predictive power of sequence modeling. However, the full model consistently outperforms all variants across F1-Score (0.93), IW-F1 (0.85), and PR-AUC (0.95), proving the synergistic benefit of all architectural components.

Download:

• PNG
  larger image
• TIFF
  original image

Table 10. Ablation study on combined KPI dataset.

https://doi.org/10.1371/journal.pone.0350676.t010

4.2.7 Comparison with baselines.

Table 11 compares the proposed Dual-Stream Predictive Alert Escalation Framework against traditional escalation baselines. Threshold-based alerting and statistical MAD detection yield lower scores, with IW-F1 values of 0.52 and 0.57 respectively, indicating limited effectiveness in handling impact-aware prioritization. Isolation Forest offers marginal improvement but still underperforms in both recall and impact-weighted metrics. The autoencoder baseline achieves reasonable performance across all metrics, showing the benefit of reconstruction-based anomaly detection. However, the proposed method achieves the highest scores across all evaluation metrics Macro-F1 of 0.93 and IW-F1 of 0.85 demonstrating its superior capability in accurately detecting and prioritizing escalation events.

Download:

• PNG
  larger image
• TIFF
  original image

Table 11. Comparison with escalation baselines.

https://doi.org/10.1371/journal.pone.0350676.t011

4.2.8 Comparison with state-of-the-art methods.

To further contextualize the performance of the proposed Dual-Stream Predictive Alert Escalation Framework, we compare it with representative state-of-the-art methods reported in the literature that address time-series anomaly detection, failure prediction, and impact-aware alerting. Since the datasets used in this study are publicly available, this comparison highlights differences in modeling paradigms, learning objectives, and evaluation focus, providing qualitative and reported-metric insights into the advantages of the proposed approach (Table 12).

Download:

• PNG
  larger image
• TIFF
  original image

Table 12. Qualitative comparison of the proposed method with representative classical and recent state-of-the-art approaches reported in the literature.

https://doi.org/10.1371/journal.pone.0350676.t012

Unlike existing approaches that primarily focus on anomaly detection or failure prediction in isolation, the proposed method uniquely integrates temporal degradation modeling with auxiliary severity context and business impact scoring, enabling proactive and impact-aware alert escalation rather than post hoc anomaly reporting.

4.3 Visual evaluation of model performance

This subsection provides a visual interpretation of the quantitative results presented earlier, focusing on confusion matrices, metric comparisons, lead time gains, and training dynamics to support qualitative understanding rather than introducing new performance claims.

All reported results are obtained using publicly available empirical datasets and a fixed chronological 70%/15%/15% train–validation–test split to ensure reproducibility. Performance metrics are computed on the held-out test sets without post hoc tuning. Since the datasets and evaluation protocol are deterministic and widely used in anomaly detection benchmarks, we report point estimates consistent with prior work rather than confidence intervals. Instead of classical statistical significance testing, robustness is assessed through consistent performance gains across multiple datasets, baseline models, and complementary evaluation criteria, including cost-sensitive and severity-aware metrics such as IW-F1, BIS Accuracy, lead time gain, and estimated cost savings. These metrics explicitly reflect optimized and impact-aware operational objectives rather than purely accuracy-driven performance.

4.3.1 Classification performance and metric comparison on the combined KPI dataset.

Figs 2 and 3 summarizes the performance of the proposed Dual-Stream framework on the combined KPI dataset. The confusion matrix in Fig 2 shows strong discriminative capability across all escalation classes. The model maintains minimal misclassification between critical and normal events, which is essential for accurate prioritization in real-world alert systems. The matrix also reflects balanced performance across intermediate escalation levels, indicating robustness under varying severity conditions. The comparative results in Fig 3 highlight the performance of the baseline models and the proposed Dual-Stream framework across three core evaluation metrics: F1-score, PR-AUC, and ROC-AUC. The proposed model consistently achieves higher values for all metrics, indicating both strong predictive accuracy and robust ranking capability. This consistent outperformance supports the model’s effectiveness in detecting and prioritizing escalation cases within complex KPI time-series environments.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Illustrative class-balanced confusion matrix for the combined KPI dataset.

https://doi.org/10.1371/journal.pone.0350676.g002

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Comparison of F1-score, PR-AUC, and ROC-AUC for various models.

https://doi.org/10.1371/journal.pone.0350676.g003

Fig 2 is constructed as a class-balanced illustrative confusion matrix to visualize the discriminative behavior of the proposed model across escalation categories. While the figure displays a reduced and balanced set of representative instances for clarity, all quantitative evaluation metrics reported in Tables 8 and 9 are computed using the full combined KPI test set obtained from the chronological 70%/15%/15% split (1,872 test samples). The confusion matrix is therefore intended for qualitative illustration rather than as a direct representation of raw test-set counts.

4.3.2 Lead time gain over baseline methods.

Fig 4 presents the comparative analysis of lead time in failure detection between baseline models and the proposed Dual-Stream model. The figure highlights the significant advantage of the proposed method in providing earlier alerts across various critical escalation cases. This lead time improvement is essential for enabling proactive mitigation actions, reducing downtime, and improving overall system reliability.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Lead time comparison between baseline and proposed model.

https://doi.org/10.1371/journal.pone.0350676.g004

4.3.3 Training dynamics: Loss, accuracy, and F1-score curves.

Figs 5, 6 and 7 summarize the training behavior of the proposed Dual-Stream framework over 50 epochs. The loss curves in Fig 5 show a consistent decrease in both training and validation loss during the early epochs, followed by stabilization, which indicates good generalization without overfitting. The accuracy curves in Fig 6 reveal a steady increase in training accuracy with validation accuracy following a similar trend, suggesting that the model captures relevant patterns from the data. The F1-score curves in Fig 7 remain consistently high for both the training and validation sets across epochs, indicating a stable balance between precision and recall without performance degradation.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 5. Training and validation loss curves.

https://doi.org/10.1371/journal.pone.0350676.g005

Download:

• PNG
  larger image
• TIFF
  original image

Fig 6. Training and validation accuracy curves.

https://doi.org/10.1371/journal.pone.0350676.g006

Download:

• PNG
  larger image
• TIFF
  original image

Fig 7. Training and validation F1-score curves.

https://doi.org/10.1371/journal.pone.0350676.g007

5 Discussion

The experimental results demonstrate the effectiveness and novelty of the proposed Dual-Stream Predictive Alert Escalation Framework, which integrates temporal failure pattern learning with business impact-aware severity modeling. Unlike conventional anomaly detection approaches that focus solely on signal irregularities or statistical deviations, the proposed method introduces a hybrid architecture that fuses multivariate KPI representations with auxiliary business impact information. This design enables the model not only to detect anomalous behavior in network telemetry data but also to assess the operational relevance of each detected anomaly. The integration of a Business Impact Scoring (BIS) mechanism allows the framework to prioritize high-risk alerts, addressing a critical gap in existing predictive maintenance and network monitoring systems that often generate excessive low-priority alarms.

The quantitative evaluation highlights that the proposed framework consistently outperforms traditional models such as LSTM, GRU, Isolation Forest, and threshold-based alerting. The improvements are evident across key performance metrics, including F1-score, PR-AUC, and ROC-AUC, indicating better detection capability under imbalanced data conditions. More importantly, impact-aware metrics such as IW-F1 and Kendall’s further demonstrate the model’s ability to align predictions with escalation priorities. The ablation study confirms that each component of the architecture contributes to overall performance gains. The temporal encoder supports robust feature extraction from sequential patterns, while the auxiliary severity encoder improves impact reasoning. The attention-based fusion module effectively combines contextual and temporal cues, enhancing discriminative capability. The BIS layer further refines the output by integrating operational risk relevance, making the model suitable for real-world deployment in service management and network operations centers.

The visualization results support the quantitative findings. The confusion matrix indicates strong class separation and accurate escalation-level identification, reducing the likelihood of false negatives for critical alerts. The bar chart comparison verifies that the model consistently performs better than benchmark architectures, while the lead time gain analysis shows its ability to predict failures earlier than baseline methods. This proactive capability holds significant operational implications, as earlier detection can support faster triage and mitigation, which may reduce service disruption. We therefore interpret the reported cost savings as an estimated indicator derived from the BIS-aligned evaluation setting, rather than as a validated real-world financial outcome. The training curves further validate the model’s convergence behavior and stability, with no signs of overfitting or significant variance between training and validation metrics.

Despite its strengths, the proposed framework exhibits several limitations that warrant further investigation. First, the model relies on historical time-series and structured metadata, which may limit its adaptability to unseen system configurations or emerging network behaviors. Second, the BIS weighting mechanism, although effective, currently uses predefined weights, which may not fully capture dynamic business priorities or evolving service-level objectives. Third, the framework assumes consistent sampling rates and synchronized KPI sources, which may not always be practical in heterogeneous monitoring environments. Additionally, although the model generalizes well to the tested datasets, its performance under large-scale, high-frequency streaming environments requires further scalability evaluation.

Future work is divided into near-term extensions and long-term goals to support practical implementation decisions. As near-term extensions, we plan to (i) validate the BIS weighting strategy under multiple predefined business-priority settings (sensitivity analysis) to reduce dependence on a single weight configuration, and (ii) evaluate robustness under different time splits and operating regimes to strengthen empirical reliability within the same public datasets. As longer-term goals, we aim to (i) integrate online learning and incremental retraining for evolving telemetry patterns, (ii) explore reinforcement learning to adapt BIS weights from operational feedback, and (iii) incorporate graph-based modeling to capture service dependencies for improved escalation reasoning. Finally, deploying the framework in a streaming pipeline (e.g., Kafka or Spark Streaming) is positioned as a long-term systems objective that requires access to production telemetry and operational constraints beyond the current experimental scope.

Overall, the proposed framework advances the state of predictive anomaly detection by introducing escalation reasoning and impact awareness, bridging the gap between detection accuracy and operational relevance. The ability to combine predictive analytics with business-aligned prioritization makes the approach a scalable and practical solution for intelligent network operations and AIOps platforms.

6 Conclusions

This paper presented a Dual-Stream Predictive Alert Escalation Framework that integrates failure pattern learning with business impact-aware prioritization to address the limitations of conventional anomaly detection models used in network monitoring systems. Unlike traditional signal-based methods that detect anomalies without considering operational relevance, the proposed architecture incorporates a temporal failure encoder and an auxiliary severity encoder to simultaneously model degradation behavior and business-critical severity indicators. A fusion mechanism supported by attention weighting and a Business Impact Scoring (BIS) layer ensures that alert escalation decisions are both context-aware and aligned with practical service management priorities. From a real-world operational perspective, the framework is designed to support Network Operations Centers and IT Service Management workflows by reducing alert overload and enabling earlier, risk-aware escalation of critical incidents, thereby improving response efficiency and supporting proactive mitigation before service-level violations occur. Experimental results on multiple KPI datasets, including univariate and multivariate network telemetry signals, demonstrated superior predictive accuracy, robustness under class imbalance, and effective alert prioritization compared to baseline and state-of-the-art techniques, with measurable lead time gains that reduce the risk of cascading failures. Nevertheless, the framework has several limitations, including reliance on publicly available datasets with assumed sampling consistency, the use of static BIS weighting that may not reflect dynamically changing business priorities, and the absence of empirical validation under high-frequency streaming conditions. The novelty of this work lies in its unified treatment of temporal anomaly detection and business impact-aware escalation within a single learning architecture, explicitly bridging the gap between detection accuracy and operational decision-making that is not addressed by existing anomaly detection or predictive maintenance approaches. Future work will focus on practical extensions, including sensitivity analysis of BIS weights under different operational policies, adaptive impact weighting using reinforcement learning, and integration with real-time streaming telemetry platforms to support scalable deployment in production environments.