Survivability Models for Networks

Most people think of survival analysis as something belonging to medicine, epidemiology, or actuarial tables, the maths that tells us how long a patient is likely to live, or how a treatment affects their chances day-by-day. But the techniques that transformed clinical research are just as powerful in digital infrastructure.

In MNOC, we’ve been exploring survivability scoring as a next step beyond point-wise scoring — a way of estimating not only how healthy something looks right now, but how long it’s likely to stay that way. In other words, MTBF reimagined through the lens of modern machine learning.

And it turns out the medical lineage of survival analysis fits telecommunications surprisingly well.

A Quick Look Back: Why Survival Analysis Exists at All

The roots go back to the 17th century, when the first mortality tables were constructed to understand lifespan patterns. Over centuries, the field evolved into a sophisticated mathematical discipline. Landmark innovations such as:

• The Kaplan–Meier estimator for modelling survival curves, including incomplete (censored) data

• The Cox proportional hazards model for identifying factors that increase or decrease risk

• Hazard functions that show instantaneous likelihood of failure

…became the backbone of modern medical research.

But the key innovation wasn’t statistical elegance — it was the ability to reason about systems where you don’t observe every failure, where the experiment ends before the subject does, and where the clocks keep ticking even when the data doesn’t.

This is exactly what we face in complex networks.

Why Survival Analysis Maps so Naturally to Telecoms and IT

Networks behave just like biological systems: they degrade, adapt, recover, and occasionally fail in unpredictable ways.

They produce timestamped observations with censoring everywhere:

• A transceiver that hasn’t failed yet

• An incident that’s still ongoing

• A user who is still active

• A container that hasn’t hit resource limits

Traditional regression can’t incorporate these “not yet” states: survival models were built for this kind of messy reality.

This is why survivability scoring is such an attractive complement to MNOC’s existing scoring approach: where point-wise scoring shows current health, survival models show future resilience.

Use Case 1: Hardware Lifespan and Predictive Maintenance

Transceivers, SSDs, optics, radio units, power supplies, all components experience time-dependent wear.

Survival analysis lets you:

• Model expected remaining life under different temperatures or loads

• Estimate hazard curves (e.g., bathtub curves for optics)

• Predict failure probability over the next day/week/month

• Trigger proactive replacements before a fault becomes visible

Combine this with MNOC scoring and you get a powerful capability: shared survivability awareness across operator + vendor ecosystems.

Use Case 2: Service Lifecycle and User Behaviour

SaaS teams already use survival analysis for churn modelling. now, IT teams can do the same:

• Time until user churn

• Time between logins

• Time until a customer adopts a feature

• Time until an SME’s ticket rate spikes

In MNOC terms, this becomes service survivability: not “will a user churn?” but “when does customer experience start to drift from healthy to unhealthy?”

Use Case 3: Incident Management and Operational Maturity

Incidents have a lifecycle. Survival models help teams understand:

• Time to incident resolution

• Probability of recurrence within X hours

• Time until next outage for a given domain

• Hazard rate of breaches against SLAs

In an MNOC context, these become operational survivability scores — a way of communicating risk in a clear, vendor-neutral form.

Use Case 4: DevOps and CI/CD Reliability

Builds and deployments behave like biological experiments:

• Time until a build fails

• Probability a service survives integration tests

• Time between successful deployments

• Time to first outage after new code hits production

Survival analysis gives DevOps teams a way to reason about reliability across thousands of noisy test runs. Add MNOC scoring on top and you have a shared language for building health that works across teams, tooling, and vendors.

Use Case 5: Cybersecurity Risk and Exploitation Windows

Every unpatched vulnerability has a “survival clock”:

• Time until exploitation

• Time until an intrusion is detected

• Survival curve of an undetected attacker

• Hazard curves for repeated attack attempts

This leads to risk-aware hardening, not just patching by severity score.

Use Case 6: Software Reliability & MTBF 2.0

Software doesn’t “wear out”, but its runtime behaviours often do:

• Time to memory leak saturation

• Time to crash after deployment

• Time to bug discovery or reintroduction

• MTBF modelling for microservices

Survival models let us express MTBF as a probability distribution, not a single average. This is where MNOC scoring can evolve into probabilistic health prediction.

Use Case 7: Cloud Capacity & Resource Exhaustion

Cloud components live and die in cycles:

• Time to CPU saturation

• Time until autoscaling triggers

• Lifespan of ephemeral containers and pods

• Time until serverless cold starts

Survivability curves become a natural part of capacity planning and SRE work.

Why MNOC Scoring + Survivability Modelling Matters

Survival analysis brings something unique to MNOC:

1. It handles censored data naturally

Most network events are “not yet happened” states.

2. It produces hazard curves

Instead of “this looks bad”, you get: “risk spikes in the next 3 hours unless something changes.”

3. It supports shared awareness across organisations

Vendors, alt-nets, MSPs and ISPs can all share survivability curves without sharing raw telemetry.

4. It changes the conversation from reactive to predictive

MNOC starts to function more like a clinical monitoring system:
Spot changes early, intervene early, prevent failures before they appear in logs.

Survivability Scoring: A Natural Next Step

Survival analysis takes MNOC from health monitoring to future-state prediction. It’s exactly what the telecom ecosystem needs: a way to quantify resilience, not just detect faults.

Borrowing tools from medicine and microbiology, enables us to  gain a powerful framework to answer a simple question:

“Given what we know right now, how long will this part of the network stay healthy?”

In the coming months, we’ll be experimenting with survivability scoring inside MNOC: combining hazard-based models, reliability curves, and machine-learning-based predictions to help operators, and the wider ecosystem, see trouble before it arrives.