The disclosure relates to technology for identifying a root cause of anomalous behavior in a communications network. A key quality indicator (KQI) indicative of a performance level associated with a source is received in the communication network. The KQI includes a performance measurement value to identify a performance level of the source having the anomalous behavior. An improved KQI indicativeof a level of degradation is calculated based on the anomalous behavior at the source by recovering the KQI to a historical value. Sources of the anomalous behavior are clustered into subsets according to the level of degradation based on the calculated KQI improvement. A global or partial degradation type of the root cause source in the subset having a severe level of degradation is determined using hypothesis testing, and a confidence value is provided for the accepted degradation type.