Cooperative Anomaly Detection With Transfer Learning-Based Hidden Markov Model in Virtualized Network Slicing

Wang, Weili; Chen, Qianbin; He, Xiaoqiang; Tang, Lun

doi:10.1109/lcomm.2019.2923913

Cited by 17 publications

(8 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Furthermore, the presence of an anomaly physical node in a network may result in the degradation of a network slice's performance while exposing sensitive data to intruders/attackers. As a solution, a cooperative anomaly detection mechanism using a hybrid hidden Markov-transfer learning model is presented in [138]. Table VI highlights AI/ML-based security solutions for network slicing.…”

Section: Security Solutions and Servicesmentioning

confidence: 99%

A Survey on Network Slicing Security: Attacks, Challenges, Solutions and Research Directions

De Alwis,

Porambage,

Dev

et al. 2024

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

The dawn of softwarized networks enables Network Slicing (NS) as an important technology towards allocating endto-end logical networks to facilitate diverse requirements of emerging applications in fifth-generation (5G) mobile networks. However, the emergence of NS also exposes novel security and privacy challenges, primarily related to aspects such as NS life-cycle security, inter-slice security, intra-slice security, slice broker security, zero-touch network and management security, and blockchain security. Hence, enhancing NS security, privacy, and trust has become a key research area toward realizing the true capabilities of 5G. This paper presents a comprehensive and up-to-date survey on NS security. The paper articulates a taxonomy for NS security and privacy, laying the structure for the survey. Accordingly, the paper presents key attack scenarios specific to NS-enabled networks. Furthermore, the paper explores NS security threats, challenges, and issues while elaborating on NS security solutions available in the literature. In addition, NS trust and privacy aspects, along with possible solutions, are explained. The paper also highlights future research directions in NS security and privacy. It is envisaged that this survey will concentrate on existing research work, highlight research gaps and shed light on future research, development, and standardization work to realize secure NS in 5G and beyond mobile communication networks.

show abstract

Section: Security Solutions and Servicesmentioning

confidence: 99%

A Survey on Network Slicing Security: Attacks, Challenges, Solutions and Research Directions

De Alwis,

Porambage,

Dev

et al. 2024

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

show abstract

“…For instance, time series anomaly detection (Wen and Keyes 2019), detecting dangerous aircraft test flight actions (Xiong et al 2018), hyperspectral image anomaly detection (Li, Wu, and Du 2017), or video anomaly detection (Bansod and Nandedkar 2019;Liu et al 2020). Some authors focus on instance-transfer for anomaly detection Davis 2017, 2020), others on feature-based transfer (Kumagai, Iwata, and Fujiwara 2019;Yamaguchi, Koizumi, and Harada 2019), or model-based transfer (Wang et al 2019;Idé, Phan, and Kalagnanam 2017;Du et al 2013). The goal is almost always to improve a target model using source domain label information, i.e., deriving better estimates for the anomaly scores.…”

Section: Related Workmentioning

confidence: 99%

Transferring the Contamination Factor between Anomaly Detection Domains by Shape Similarity

Perini

Vercruyssen

Davis

2022

AAAI

View full text Add to dashboard Cite

Anomaly detection attempts to find examples in a dataset that do not conform to the expected behavior. Algorithms for this task assign an anomaly score to each example representing its degree of anomalousness. Setting a threshold on the anomaly scores enables converting these scores into a discrete prediction for each example. Setting an appropriate threshold is challenging in practice since anomaly detection is often treated as an unsupervised problem. A common approach is to set the threshold based on the dataset's contamination factor, i.e., the proportion of anomalous examples in the data. While the contamination factor may be known based on domain knowledge, it is often necessary to estimate it by labeling data. However, many anomaly detection problems involve monitoring multiple related, yet slightly different entities (e.g., a fleet of machines). Then, estimating the contamination factor for each dataset separately by labeling data would be extremely time-consuming. Therefore, this paper introduces a method for transferring the known contamination factor from one dataset (the source domain) to a related dataset where it is unknown (the target domain). Our approach does not require labeled target data and is based on modeling the shape of the distribution of the anomaly scores in both domains. We theoretically analyze how our method behaves when the (biased) target domain anomaly score distribution converges to its true one. Empirically, our method outperforms several baselines on real-world datasets.

show abstract

“…Authors in [16] proposed using TL in HMM for capturing anomalous states of nodes at the physical substrate in a network slicing scenarios, based on observations from the virtual nodes. The BW algorithm, was modified to transfer knowledge between two physical nodes.…”

Section: Related Workmentioning

confidence: 99%

“…One intuitive approach would be to transfer more knowledge when the source is closely related to the target, and transfer less knowledge otherwise. To this end, the authors in [16] propose using a rate, ζ = 1/t, inversely to the time instance, t, where t corresponds to a parameter learning iteration. Thus, a modified λ new can be obtained using:…”

Section: Knowledge Exchange Casesmentioning

confidence: 99%

Learning to Learn Sequential Network Attacks Using Hidden Markov Models

2020

View full text Add to dashboard Cite

The global surge of cyber-attacks in the form of sequential network attacks has propelled the need for robust intrusion detection and prediction systems. Such attacks are difficult to reveal using current intrusion detection systems, since each individual attack phase may appear benign when examined outside of its context. In addition, there are challenges in building supervised learning models for such attacks, since there are limited labelled datasets available. Hence, there is a need for updating already built models to specific operational environments and for addressing the concept drift. Hidden Markov models (HMMs) is a popular framework for sequential modelling, however, in addition to the above challenges, the model parameters are difficult to optimise. This paper proposes a transfer learning (TL) approach that exploits already learned knowledge, gained from a labelled source dataset, and adapts it on a different, unlabelled target dataset. The datasets may be from a different but related domain. Five unsupervised HMM techniques are developed utilising a TL approach and evaluated against conventional machine learning approaches. Baum-Welch (BW), Viterbi training, gradient descent, differential evolution (DE) and simulated annealing, are deployed for the detection of attack stages in the network traffic, as well as, forecasting both the next most probable attack stage and its method of manifestation. Specifically, for the prediction of the three next most likely states and observations, TL with DE achieved a maximum accuracy improvement of 48.3%, and 27.4%, respectively. Finally, the actual detection prediction for the three next most probable states and methods of manifestation reaches 78.9% and 96.3% using TL with BW and DE, respectively. INDEX TERMS transfer learning, hidden Markov model, Viterbi decoding, forward-backward, sequential network attacks

show abstract

Cooperative Anomaly Detection With Transfer Learning-Based Hidden Markov Model in Virtualized Network Slicing

Cited by 17 publications

References 10 publications

A Survey on Network Slicing Security: Attacks, Challenges, Solutions and Research Directions

A Survey on Network Slicing Security: Attacks, Challenges, Solutions and Research Directions

Transferring the Contamination Factor between Anomaly Detection Domains by Shape Similarity

Learning to Learn Sequential Network Attacks Using Hidden Markov Models

Contact Info

Product

Resources

About