An apparatus for discovering and diagnosing network anomalies, the apparatus comprising: a communication interface configured to receive key performance indicator, KPI, data and alarm data; and a processor operably connected to the communication interface, the processor is configured to: extract features based on samples obtained by discretizing the KPI data and the alarm data, generate a set of rules based on the features, wherein a portion of the samples that satisfy the rules correspond to anomalies, identify a sample as a normal sample or an anomaly sample, in response to identifying the sample as the anomaly sample, identify one or more rules that are satisfied by the sample, derive KPIs that are linked to symptoms and root causes for the one or more rules that are satisfied by the sample identified as the anomaly sample, derive a root cause explanation for an anomaly included in the sample identified as the anomaly sample based on KPIs that are linked to the symptoms and root causes of the anomaly; and perform a corrective action to resolve the anomaly based on the one or more rules, wherein the processor is further configured to: receive, via the communication interface, an indication of an alarm from an eNB; in response to receiving the indication, identify a set of the KPI data from the eNB that is received between a start of the alarm until the alarm is cleared; determine whether a key quality indicator, KQI, anomaly is associated with the alarm; and when the KQI anomaly is associated with the alarm, identify the set of the KPI data and the alarm as a root cause for the KQI anomaly. a communication interface configured to receive key performance indicator, KPI, data and alarm data; and a processor operably connected to the communication interface, the processor is configured to: extract features based on samples obtained by discretizing the KPI data and the alarm data, generate a set of rules based on the features, wherein a portion of the samples that satisfy the rules correspond to anomalies, identify a sample as a normal sample or an anomaly sample, in response to identifying the sample as the anomaly sample, identify one or more rules that are satisfied by the sample, derive KPIs that are linked to symptoms and root causes for the one or more rules that are satisfied by the sample identified as the anomaly sample, derive a root cause explanation for an anomaly included in the sample identified as the anomaly sample based on KPIs that are linked to the symptoms and root causes of the anomaly; and perform a corrective action to resolve the anomaly based on the one or more rules, wherein the processor is further configured to: receive, via the communication interface, an indication of an alarm from an eNB; in response to receiving the indication, identify a set of the KPI data from the eNB that is received between a start of the alarm until the alarm is cleared; determine whether a key quality indicator, KQI, anomaly is associated with the alarm; and when the KQI anomaly is associated with the alarm, identify the set of the KPI data and the alarm as a root cause for the KQI anomaly. extract features based on samples obtained by discretizing the KPI data and the alarm data, generate a set of rules based on the features, wherein a portion of the samples that satisfy the rules correspond to anomalies, identify a sample as a normal sample or an anomaly sample, in response to identifying the sample as the anomaly sample, identify one or more rules that are satisfied by the sample, derive KPIs that are linked to symptoms and root causes for the one or more rules that are satisfied by the sample identified as the anomaly sample, derive a root cause explanation for an anomaly included in the sample identified as the anomaly sample based on KPIs that are linked to the symptoms and root causes of the anomaly; and perform a corrective action to resolve the anomaly based on the one or more rules, wherein the processor is further configured to: receive, via the communication interface, an indication of an alarm from an eNB; in response to receiving the indication, identify a set of the KPI data from the eNB that is received between a start of the alarm until the alarm is cleared; determine whether a key quality indicator, KQI, anomaly is associated with the alarm; and when the KQI anomaly is associated with the alarm, identify the set of the KPI data and the alarm as a root cause for the KQI anomaly. receive, via the communication interface, an indication of an alarm from an eNB; in response to receiving the indication, identify a set of the KPI data from the eNB that is received between a start of the alarm until the alarm is cleared; determine whether a key quality indicator, KQI, anomaly is associated with the alarm; and when the KQI anomaly is associated with the alarm, identify the set of the KPI data and the alarm as a root cause for the KQI anomaly.