Abstract: Methods identifying inbound call traffic anomalies in a telecommunications system are provided. The method includes receiving expected values for data related to the telecommunications system, the data being associated with call detail records; for each metric in the received data, determining if an observed value is outside defined upper and lower thresholds; selecting a set of residuals based on an aggregation of data in the call detail records if the observed value is outside the defined upper and lower thresholds; computing an anomaly score based the selected set of residuals; determining if multiple, serial anomalous alerting windows are needed to create an alert if the computed anomaly score is greater than a minimum anomaly score; and declaring that the data supports an anomaly in the inbound call traffic if it is determined that multiple, serial anomalous alerting windows are not needed to create an alert.