As 4G and 5G networks become the backbone of urban infrastructure, the granular mobile trafic data they generate ofers a high-resolution lens into collective human mobility dynamics. This paper investigates the hypothesis that service-specific mobile trafic can serve as a reliable proxy for human mobility and urban behavior. We model the problem as a Time Series Anomaly Detection (TSAD) task by proposing an unsupervised framework that employs a reconstruction-based representation model to establish a baseline urban activity. Our pipeline identifies significant deviations in social media app usage (e.g., Twitter, Instagram, YouTube) as spatio-temporal anomalies. These anomalies are subsequently clustered to filter noise and reveal coherent patterns corresponding to real-world events. We validate our framework using the NetMob 2023 dataset across the Paris metropolitan area. Our preliminary results demonstrate that this approach efectively captures a diverse spectrum of mobility events, including political protests, sporting matches, and disasters. These findings suggest that service-specific trafic data is a powerful, non-intrusive indicator of urban mobility flows and social disruptions.
The evolution of 4G and 5G networks has fundamentally transformed the digital footprint of urban
populations. As mobile applications become deeply embedded in daily routines, they generate massive
volumes of service-specific mobile trafic data, i.e., granular records of upload and download activities
across gaming, social networking, and messaging platforms. While mobile operators primarily collect
this data through passive measurement probes for network optimization, these traces ofer a
highresolution, implicit lens through which to observe human dynamics. This paper presents a preliminary
study examining the hypothesis that service-specific mobile trafic can serve as a reliable proxy for
human mobility and collective behavior within urban spaces. Traditionally, urban event detection has
been treated as a search for unusual patterns in city life, often relying on Call Detail Records (CDRs) [
In this work, we propose an unsupervised framework designed to demonstrate the feasibility of using
big data, such as app-specific trafic, as a proxy for urban mobility through this TSAD lens. Our pipeline
identifies spatio-temporal anomalies in social media app usage, which we represent as geolocated
multivariate time series. The methodology employs a reconstruction-based representation step to learn
baseline urban behaviors. By calculating reconstruction error, the model identifies significant deviations
from expected activity as potential anomalies. These detected points are then clustered spatially to
iflter out localized noise and reveal coherent patterns that correspond to meaningful events, i.e., human
movements. To evaluate our approach, we apply the framework to real-world data from the NetMob
2023 dataset [
The paper is organized as follows. Section 2 reviews the related work. Section 3 introduces our methodology. Section 4 describes the experimental setup and dataset and presents the results. Finally, Section 5 concludes the paper and discusses limitations and future directions.
As introduced in the previous section, in order to demonstrate that mobile trafic data can serve as a proxy
for human mobility, we identify urban events by formulating the problem as a TSAD task. TSAD plays
a central role in domains such as finance, healthcare, and cybersecurity, where identifying anomalous
temporal patterns is critical to anticipating failures or responding to disruptive events. In the context of
mobility data science, this modeling allows us to interpret significant deviations in time series (such as
GPS trajectories or CDR records) as a signature of human behavior. In recent years, deep learning models
have received considerable attention in TSAD, as they can capture complex temporal dependencies
and subtle deviations that traditional methods often fail to detect. Approaches span from predictive
modeling, where the model forecasts the expected sequence and anomalies are identified as deviations,
to reconstruction-based strategies, where models attempt to reconstruct normal patterns and anomalies
emerge from reconstruction errors [
Our work builds upon these foundations but distinguishes itself by leveraging service-specific mobile trafic data to provide a richer, finer-grained view of urban dynamics than traditional CDRs or signalingonly datasets. By adopting a transformer-based autoencoder, we go beyond previous statistical models to capture both temporal dependencies and inter-feature correlations. Crucially, as a preliminary study to validate our intuition, our framework introduces a structured analysis phase that aggregates anomalies spatially, enabling the robust identification of meaningful urban events and demonstrating that mobile trafic efectively mirrors the movement and activity of the city’s inhabitants.
Training
Inference Reconstruction-based
representation (attention-based s2s model)
Anomaly detection (OC-SVM on MSEs)
Geolocated mobile traffic data
Cross-validation strategy
Spatial aggregation and noise detection
Event detection
In this section, we describe the proposed methodology, which serves as a framework to evaluate the feasibility of using mobile trafic as a proxy for urban mobility. We first provide an overview of the pipeline’s stages and then detail how each phase is instantiated to identify urban events through the lens of anomaly detection.
We propose the processing pipeline illustrated in Figure 1. This framework is designed to demonstrate that service-specific mobile trafic can mirror urban dynamics by formulating the detection of urban events as a TSAD problem applied to a regular grid-partitioned city.
As represented in Figure 1, the methodology begins by transforming raw mobile trafic into normalized, service-specific time series, segmented into fixed-length windows (e.g., daily 24-hour sequences) for each tile, i.e., a cell of the regular grid. These tiles are linked to administrative districts, providing spatial context. In a cross-validation strategy (second step), we split the administrative districts into several folds of training and validation sets with a held-out strategy. On the training set, a reconstructionbased model is then trained to learn regular patterns of multivariate activity. At test time, sequences from held-out districts are reconstructed, and deviations — measured by reconstruction error — signal potential anomalies. At the end of the cross-validation process, tiles that are accounted as anomalies in a suficient number of folds are subsequently spatially aggregated to highlight coherent and contiguous urban events (third step). In the following, we motivate the diferent steps and provide a possible implementation of them.
Mobile trafic time series data. We rely on service-specific mobile trafic data, which provides the temporal evolution of application-level network usage within the city. The study area is first tessellated into non-overlapping regular tiles, i.e., a grid. For each tile, we analyze the relative multivariate time series representing the trafic volume associated with diferent mobile services or applications. These time series are spatially anchored to their respective tiles, thus linking trafic dynamics to specific urban areas. Prior to subsequent steps, the data undergo basic preprocessing, including temporal segmentation into fixed-length windows (e.g., 24-hour slots) and normalization.
Cross-validation strategy. We design this step of our methodology around a cross-validation framework based on a held-out split of administrative districts. The districts of the city are divided into several folds, each including distinct districts used alternately for training and validation. More details about this methodology are provided in Section 4.
Reconstruction-based representation. Within each training fold, a reconstruction-based model is trained to reproduce the input time series, thereby learning the regular temporal dynamics of multivariate activity in an unsupervised manner. By minimizing reconstruction loss, the model captures typical patterns and interdependencies among variables, enabling it to generate coherent multivariate sequences that reflect normal behavior. Consequently, when the reconstruction error is high, this indicates that the observed sequence deviates from the learned normal patterns, implicitly signaling the presence of an anomaly. Following this idea, at test time, sequences from the held-out districts are reconstructed, and deviations — quantified through reconstruction error — signal potential anomalies. Moreover, the learned latent representation provides an informative embedding of the time series that can be leveraged for other downstream tasks, such as clustering or similarity analysis. Anomaly detection. The anomaly detection stage uses the reconstruction model’s output to flag anomalies in new, unseen data. After training the reconstruction model, we apply it to test time series – data from tiles belonging to districts held out of training – to obtain reconstructed estimates. For each sequence, the reconstruction error, computed as the discrepancy between the observed and reconstructed multivariate time series, serves as an anomaly score. An anomaly detector (such as a one-class classifier or a thresholding method) is then employed to decide if the reconstruction error of the current multivariate time series is significantly higher than what is expected under normal conditions. This should ensure that anomalies are identified without any information from the test set leaking into the model training. Details on the design of our cross-validation scheme will be provided below. Therefore, anomalies, corresponding to potential events, are identified as instances where the reconstruction significantly diverges from the input signal.
Spatial aggregation and noise reduction. A single significant urban event may trigger anomalies at multiple adjacent locations. We therefore aggregate individual anomalous observations into clusters that correspond to real-world events. Thus, if multiple neighboring locations are flagged as anomalous, we group them into a single cluster.
The end result of the pipeline is a set of detected events, each characterized by spatial contiguity, indicating where the mobile trafic deviated significantly from normal. This general methodology ensures a clear separation between learning normal behavior (training phase) and detecting anomalous events (testing phase), with robust spatial cross-validation to prevent overfitting or data leaks.
In the next section, we provide a detailed description of the implementation of each step of this proposed framework.
We instantiate the above general pipeline with specific modeling choices tailored to the characteristics of our mobile trafic data. In our implementation, an attention-based sequence-to-sequence model is used for the reconstruction-based representation learning stage, a One-Class Support Vector Machine (OC-SVM) serves as the anomaly detector, and a custom polygon-based clustering method groups anomalies spatially to identify events.
We begin by preprocessing the mobile network trafic dataset to extract normalized time series of daily trafic volumes, aggregated into hourly intervals for each tile across the urban area. Each tile is associated with an administrative district, following the oficial municipal partitioning of the city. We adopt a district-based cross-validation strategy: in each fold, held-out districts are reserved for testing, so that each appears at least times in the test set. This spatial partitioning ensures clear separation between training and test data, enabling robust generalization to unseen urban areas.
For the reconstruction-based representation phase, we adopt an attention-based sequence-tosequence model that takes a time series segment as input and attempts to reconstruct it at the output. As illustrated in Figure 2, the model consists of an encoder and a decoder, both built with Transformer layers leveraging multi-head self-attention. The encoder receives the sequence = [x1, . . . , x ] for a batch of districts along with positional encodings that indicate the temporal order of the sequence. Through stacked self-attention layers, the encoder produces a set of latent representations = [h1, . . . , h] capturing the salient patterns in the input sequence, where represents the dimension of the embeddings.
The decoder then takes and learns to produce an output sequence ˆ = [xˆ1, . . . , xˆ ] of the same length, ideally reproducing the original input .
We train the model by minimizing a reconstruction loss between and ˆ. In particular, we adopted the Mean Squared Error (MSE) averaged over batch size , sequence length , and number of services : =
1 × × =1 =1 =1 ∑︁ ∑︁ ∑︁ (︁ ,, −
︁) 2 ˆ,, where ,, represented the original value at time step for service in batch sample , and ˆ,, was the corresponding reconstruction. This formulation encouraged accurate reproduction of the multivariate time series by penalizing large deviations in the reconstruction.
After training the model on the training set, we proceed to the anomaly detection phase, which is carried out exclusively on test data. For each input sequence in the test set, the trained model produces a reconstruction, and the corresponding reconstruction error is computed as the Mean Squared Error (MSE) between the original and reconstructed sequences. These errors serve as indicators of deviations from normal behavior, with unusually high values suggesting the presence of anomalous patterns. To distinguish anomalous from regular sequences, we employ a One-Class Support Vector Machine (OC-SVM) [22], trained on the distribution of reconstruction errors observed in the training set. The OC-SVM learns a decision boundary that tightly encloses the majority of training samples and flags outliers in the test set as potential anomalies, thereby enabling unsupervised event detection without requiring labeled examples. This training–testing procedure, coupling reconstruction and anomaly detection, is repeated over all cross-validation folds. As each time series appears in the test folds the same number of times, we count how often it is classified as anomalous across folds. Time series identified as anomalous in a suficient number of folds are then considered robust anomalies and passed to the subsequent analysis stage.
The final step is to interpret tile-related anomalies in the context of real-world events. Isolated anomalies might be false alarms or minor fluctuations, whereas when multiple anomalies occur in proximity, they likely correspond to a significant event. We therefore perform clustering on the detected anomalous sequences, aggregating adjacent tiles into contiguous clusters and discarding when isolated.
In particular, to identify spatially coherent events, we apply a polygon-based clustering method to daily anomalies. For each day, we construct an undirected graph whose nodes represent anomalous tiles and whose edges connect tiles sharing a polygon boundary (excluding vertex-only adjacency). Connected components of this graph correspond to contiguous anomaly clusters. Clusters with fewer than a threshold number of contiguous tiles are labeled as noise.
This combination of temporal consistency and spatial aggregation provides a reliable characterization of anomalies, enabling the distinction between significant large-scale events and smaller fluctuations while supporting their interpretation in terms of spatial difusion and temporal evolution.
In this section, we describe the experimental evaluation of the proposed methodology. We first introduce the dataset and the preprocessing steps, and outline the experimental setup used to train and validate the model under a spatial cross-validation scheme. Finally, we present and discuss the results, illustrating how the detected anomalies correspond to real-world urban events observed during the study period.
We base our experiments on the NetMob 2023 dataset [
Input data were normalized and then segmented into fixed-length multivariate sequences of 24 timestamps, corresponding to one day of trafic for each tile. This enables the model to learn temporal patterns within each service as well as interactions between services over time. Feeding the reconstruction-based model with sequences of 24 timestamps across all four services per tile allows it to jointly model these dynamics and to detect deviations from normal behavior.
The reconstruction-based model was trained using the AdamW optimizer with a learning rate of 1 × 10− 4 and weight decay of 1 × 10− 5. Training was conducted for up to 50 epochs, with early stopping based on the validation loss to prevent overfitting. Gradient clipping with a maximum norm of 1.0 was applied to stabilize training and avoid exploding gradients.
Since we operate in a fully unsupervised setting, the design of the validation strategy is critical to avoid data leakage between the training and test sets. To ensure spatial consistency and avoid random sampling, we implemented the district-based cross-validation scheme described in Section 3, assigning each tile to its corresponding district. The 20 districts of Paris served as partition units, with four districts assigned to the test set and the remaining sixteen to the training set in each fold. A subset of 15 folds was generated (using a fixed random seed), ensuring that each district appeared in the test set at least three times. Moreover, this cross-validation design mitigates the efect of potential anomalies present in the training data. Since each fold is trained on a diferent subset of districts, occasional anomalous patterns in the training set are unlikely to systematically bias the model, thus enhancing robustness in a fully unsupervised setting.
After training, anomaly detection was carried out on the reconstruction errors (MSEs) produced by the reconstruction-based model. To classify errors, we employed an OC-SVM, setting the parameter to 0.01, controlling the upper bound on the fraction of anomalies and the lower bound on the fraction of support vectors.
The outputs from all cross-validation folds were aggregated, where each tile was assigned a daily anomaly score over the 77-day period. A tile could therefore be flagged as anomalous in 0, 1, 2, or 3 folds on a given day, depending on its level of consensus across models. A conservative threshold of 3 was adopted to define robust anomalies, though less stringent thresholds are also possible.
As described above, to identify spatially coherent events, we applied a polygon-based clustering method to the daily anomalies described above.
Clusters with less than five contiguous tiles were labeled as noise, removing spurious detected anomalies with limited spatial difusion.
(a) Test set with only central districts (b) Test set with both central and peripheral districts
We begin by analyzing the embeddings across cross-validation folds. To assess whether the composition of testing districts (central, peripheral, or mixed) influences the learned representations, we visualize them using t-Distributed Stochastic Neighbor Embedding (t-SNE), a dimensionality-reduction technique. Concretely, we project the high-dimensional reconstruction-error vectors into two dimensions; t-SNE preserves local neighborhoods and reveals cluster structure, yielding a clear separation between normal and anomalous sequences [23]. Comparing t-SNE plots across cross-validation folds shows an influence of spatial context (Figure 4): when only central districts form the test set, anomalous MSEs form a single compact group clearly separated from normal samples; when peripheral districts are included, anomalous MSEs split into two groups at opposite extremes of the embedding, indicating heterogeneous behaviors by location.
Now, we analyze notable events within the observation period by leveraging the scores obtained from the combination of district-based cross-validation and spatial clustering described above. Daily anomalies are first identified via cross-validation consensus and then aggregated spatially into contiguous clusters, distinguishing spatially contiguous clusters from sporadic noise. After clustering anomalous daily time series, we identify noisy ones by reducing the number of initial anomalous clusters by 69.32%.
We begin by examining the anomalies and reference the DBUE dataset introduced by [
(b) Paris marathon (14/04) (c) Notre-Dame fire (15/04) (d) Roland Garros (27/05)
Overall, our model is particularly efective in detecting large-scale protests (e.g., the Yellow Vests) and prolonged events with broad urban impact. Notice that many of these events are not reported in the DBUE dataset, which primarily catalogs shorter occurrences such as concerts or localized gatherings. For instance, major Yellow Vests demonstrations between mid-March and late April 2019, as well as institutional events such as the presidential press conference concluding the National Grand Debate, 1https://www.france24.com/en/ 2https://www.elysee.fr/en/ are not documented in the DBUE dataset despite their impact on the city. As summarized in Table 1, the events identified by our approach span a diverse range of typologies: large collective movements (e.g., protests and demonstrations), exceptional disruptions (e.g., the Notre-Dame cathedral fire), and long-lasting festivals (e.g., the Roland-Garros), often occurring in areas that usually display low or regular trafic activity.
Event name Yellow Vests protests Climate march EcoTrail Paris 2019
Dates 16/03/2019 16/03/2019 16/03/2019 Inauguration Ceremony of the Newly appointed 21/03/2019 Paris Police Prefect Yellow Vests protests Yellow Vests protests Yellow Vests protests Paris Marathon Notre-Dame fire 23/03/2019 06/04/2019 13/04/2019 14/04/2019 15–16/04/2019 Yellow Vests protests
20/04/2019 Yellow Vests protests May Day protests 27/04/2019 01/05/2019 VivaTech inauguration 16/05/2019 Roland-Garros 26–31/05/2019
Day(s) Saturday Saturday Saturday Thursday Saturday Saturday Saturday Sunday Mon–Tue Saturday Thursday Saturday Wednesday Thursday Saturday Sun–Fri
Source(s) France 24 France 24
Ministère de l’Intérieur4 France 24 France 24 France 24 France 24 France 24 France 24 Elysée France 24 France 24 France 24
Roland-Garros
DBUE
Yes Yes Yes Yes Yes Yes
In what follows, we focus on four key events within the observation period: the Yellow Vest protests (particularly the one that occurred on 23 March) [24, 25], the Paris Marathon (14 April), the Notre-Dame ifre (15 April), and the Roland Garros tennis tournament (25 May–9 June). These events were selected both for their significance during the NetMob dataset timeframe and for the model’s ability to capture their dynamics, despite their heterogeneous nature.
For instance, during the Paris Marathon, the reconstruction-based model identifies anomalous geolocated time series in the areas corresponding to the race’s starting and finishing points (Avenue Champs-Élysées and Avenue Foch), in the left-top of Figure 5b. In contrast, during the Yellow Vest protests, anomalies appear around key demonstration sites, overlapping with the main locations of gatherings and disruptions, such as Place Denfert-Rochereau and Montmartre, which served as the starting and ending points of the March 23 protest, as well as along major central streets where clashes occurred, notably Boulevard de Strasbourg, as shown in Figure 5a.
As for the Notre-Dame fire, although the event itself was localized to a specific site, its impact resonated far beyond the immediate area. On that day, anomalous mobile trafic was detected almost uniformly across the entire Paris metropolitan area, reflecting the widespread attention and disruption associated with the event, as we observed in Figure 5c.
For the Roland Garros tennis event (26 May-9 June; our analysis covers 26–31 May), anomalous clusters were mapped across all 20 Paris districts. Interestingly, a characteristic cluster was detected on each day within the 26–31 May period, as well as on 25 May, one day before the oficial start of the tournament, corresponding to the Roland Garros Kids’ Day. During the analyzed event days, the district where the event was held, i.e., district 16, which generally does not show anomalous dynamics, exhibited a single localized cluster precisely in the area of the Roland Garros Stadium, as shown in the left-bottom corner of Figure 5d.
In conclusion, the fact that our findings match events in the DBUE dataset, particularly those involving significant population movement, demonstrates the reliability of our intuition. Furthermore, the fact that some anomalies not listed in DBUE were successfully verified by news sources as major protests and gatherings reinforces this finding. This preliminary study confirms that service-specific mobile trafic data is indeed an efective proxy for capturing and understanding human mobility dynamics in the urban space.
In this paper, we propose a preliminary approach to demonstrate that mobile trafic data can serve as a good proxy for human mobility. We model the problem as a TSAD task by introducing an unsupervised methodology for detecting events that occur in an urban environment from the analysis of anomalies in specific-service mobile trafic data.
The proposed methodology employs a transformer-based autoencoder as the reconstruction model to learn compact representations of temporal dynamics, capturing complex nonlinear dependencies across services and locations. The reconstruction errors are then evaluated using an OC-SVM to isolate anomalous time series in a fully unsupervised manner. Finally, a spatial clustering algorithm aggregates anomalies and filters out noise, revealing coherent spatial patterns. By leveraging daily trafic volumes of four major platforms (Twitter, YouTube, Instagram, Facebook), the methodology identifies localized anomaly clusters across Paris’s central districts over 77 days (March–May 2019).
We demonstrated that our approach, operating at daily temporal resolution on social media trafic
volumes, is able to capture anomalies that correspond to long and movement events, but also events
that have a big resonance even if they occurred in a specific place, demonstrating that with this dataset
and our methodology we are able to uncover additional events with respect to other works like [
Finally, our study confirms the importance of exploiting multi-platform digital traces to capture the dynamics of disruptive urban events. In particular, our pipeline uses trafic volumes from four major platforms (Twitter, Facebook, YouTube, Instagram). Among these, Twitter and Facebook stand out as the most relevant sources in relation to prior research. Indeed, [26] developed an atlas multi-plateforme of the Yellow Vests movement, demonstrating how Facebook groups and Twitter interactions provided a privileged observation post to map the heterogeneity and dynamics of claims. This convergence with our findings supports the idea that combining cross-platform signals can enhance the robustness of urban anomaly detection.
Future work will focus on refining and automating the labeling and identification of detected anomalies to reduce manual intervention and improve scalability. We also plan to explore alternative modeling and detection strategies, for instance, experimenting with diferent reconstruction architectures or anomaly scoring mechanisms, to assess whether these adjustments can improve sensitivity to shorter, less pervasive, or semantically diferent types of events compared to those identified in this study.
To conclude, our results demonstrate that multivariate time series anomaly detection on social media trafic can uncover both event-driven anomalies and systematic spatiotemporal patterns in urban dynamics. This positions our pipeline as a complementary tool to high-resolution network signaling analysis and text-based social media event detection, ofering new perspectives for monitoring urban events and their efects on collective behavior.
During the preparation of this work, the author(s) used GPT-5 in order to: Grammar and spelling check. After using these tool(s)/service(s), the author(s) reviewed and edited the content as needed and take(s) full responsibility for the publication’s content.
The NetMob 2023 dataset has been made available by Orange within the framework of the NetMob
2023 Challenge [
URL: https://shs.hal.science/halshs-03832223. doi:10.1057/s41253-022-00187-9. [25] M. D. Sudda, E. Reungoat, Understanding the French Yellow Vests Movement through the lens of mixed methods, French Politics 20 (2022) 303–317. URL: https://shs.hal.science/halshs-03808821. doi:10.1057/s41253-022-00188-8. [26] P. Ramaciotti Morales, J.-P. Cointet, B. Benbouzid, D. Cardon, C. Froio, O. F. Metin, B. Ooghe, G. Plique, Atlas multi-plateforme d’un mouvement social : le cas des Gilets jaunes, 2021. URL: https://hal.science/hal-03700086.