A device may be configured to determine a current state of each of multiple operator network devices that provide a service via an operator network. The device may determine an allowable event at an operator network device based on the current state of the operator network device and model information that models behavior of the operator network device for the service. The device may monitor events at the operator network devices during a session. The device may detect that an allowable event for the operator network device does not occur during the session. The device may determine that a fault occurred at the operator network device during the session based on the allowable event not being detected at the operator network device. The device may provide fault information that indicates the fault occurred at the operator network device.