To meet the stringent 5G radio access network (RAN) service requirements, layers one and two need to be processed in essentially real time. Thus, prompt anomaly detection is important to prevent negative impacts on customer experience, which is critical for mobile networks to meet the stringent service requirements. However, monitoring networks for anomalies is difficult due at least to (1) the resource constrained edge deployments in which the vRAN resides, (2) the variety of anomaly types and fault locations making anomalies difficult to detect, and (3) the low frequency of anomalies leading to unbalanced data sets for training, among others. The present application addresses these issues by decoupling anomaly detection at the infrastructure layer (servers, NICs, switches, etc.) from anomaly detection at the VNF layer (L1, high-DU, CU). This enables different techniques for identifying anomalies and for reducing the monitoring overhead that is tailored to each layer.