Abstract: Exemplary systems and methods are directed to anomaly detection on a mobile communication network. A computing device receives data samples formatted from at least an endpoint and/or an interface on the mobile network. The computing device uses an encoder to build a data model of the mobile network data using data included in one or more data fields of each received data sample. The data model including datasets that meet at least one of a security or performance specification. A set of detectors is generated from the data model by performing a negative selection to select one or more datasets that do not match data that meets the security or performance specification, as well as genetic algorithm operations if anomalous data is available. Data is extracted from the received data samples and compared to the set of detectors to determine whether the mobile network data includes an anomaly.