A computer program implemented method for detecting anomalies in a mobile network, the method comprising: i) collecting a time series data input based on performance metrics obtained for a plurality of network elements of the mobile network; ii) defining a similarity metric as a multi-dimensional vector of performance-related metrics by calculating the squared euclidean distance between network elements using the performance metrics obtained for the network elements; iii) detecting clusters of network elements that have the same value of the similarity metric by applying the Louvain algorithm; the method characterized by further comprising: iv) obtaining a first list of network elements from the clusters with anomalies at a same timeframe, each network element of the first list having a value of the similarity metric in the timeframe which differs from the average value of the similarity metrics of the clusters to which the network element belongs in a number N of times the standard deviation for the used performance metric calculated for all the network elements of the same cluster, N being a tunable threshold parameter, N > 0; v) identifying a parent network element which is the nearest network element to all the network elements of the first list by using a topology graph; vi) obtaining a second list of network elements which comprises the first list of network elements and, if at least one parent parent network element is identified, further comprises the identified parent network element; vii) checking the second list against a ticketing or alarm system to check whether any open ticket or active alarm is associated with any network element of the second list and all the network elements for which any ticket or alarm is active are dropped out from the the second list to obtain a third list of of network elements; viii) repeating steps iv)-vi) for different timeframes and obtaining a fourth list of network elements comprising the network elements that have the same value of the similarity metric for each timeframe and the time series metrics. i) collecting a time series data input based on performance metrics obtained for a plurality of network elements of the mobile network; ii) defining a similarity metric as a multi-dimensional vector of performance-related metrics by calculating the squared euclidean distance between network elements using the performance metrics obtained for the network elements; iii) detecting clusters of network elements that have the same value of the similarity metric by applying the Louvain algorithm; iv) obtaining a first list of network elements from the clusters with anomalies at a same timeframe, each network element of the first list having a value of the similarity metric in the timeframe which differs from the average value of the similarity metrics of the clusters to which the network element belongs in a number N of times the standard deviation for the used performance metric calculated for all the network elements of the same cluster, N being a tunable threshold parameter, N > 0; v) identifying a parent network element which is the nearest network element to all the network elements of the first list by using a topology graph; vi) obtaining a second list of network elements which comprises the first list of network elements and, if at least one parent parent network element is identified, further comprises the identified parent network element; vii) checking the second list against a ticketing or alarm system to check whether any open ticket or active alarm is associated with any network element of the second list and all the network elements for which any ticket or alarm is active are dropped out from the the second list to obtain a third list of of network elements; viii) repeating steps iv)-vi) for different timeframes and obtaining a fourth list of network elements comprising the network elements that have the same value of the similarity metric for each timeframe and the time series metrics.