Distributed Online Anomaly Detection for Virtualized Network Slicing Environment

Wang, Weili; Liang, Chengchao; Chen, Qianbin; Tang, Lun; Yanıkömeroğlu, Halim; Liu, Tong

doi:10.1109/tvt.2022.3193074

Cited by 17 publications

(3 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors in [24] addressed distributed online anomaly detection of network slices based on the decentralized oneclass support vector machine by analyzing real-time measurements of virtual nodes mapped to physical nodes and correlation of measurements between neighbor virtual nodes. However, this study only focused on one type of anomaly in network slices, i.e., the anomalies of physical nodes.…”

Section: A Anomaly and Trigger Detectionmentioning

confidence: 99%

Federated Deep Reinforcement Learning for Prediction-Based Network Slice Mobility in 6G Mobile Networks

Ming,

Yu,

Taleb

2024

IEEE Trans. on Mobile Comput.

View full text Add to dashboard Cite

Network slices are generally coupled with services and face service continuity/unavailability concerns due to the high mobility and dynamic requests from users. Network slice mobility (NSM), which considers user mobility, service migration, and resource allocation from a holistic view, is witnessed as a key technology in enabling network slices to respond quickly to service degradation. Existing studies on NSM either ignored the trigger detection before NSM decision-making or didn't consider the prediction of future system information to improve the NSM performance, and the training of deep reinforcement learning (DRL) agents also faces challenges with incomplete observations. To cope with these challenges, we consider that network slices migrate periodically and utilize the prediction of system information to assist NSM decision-making. The periodical NSM problem is further transformed into a Markov decision process, and we creatively propose a prediction-based federated DRL framework to solve it. Particularly, the learning processes of the prediction model and DRL agents are performed in a federated learning paradigm. Based on extensive experiments, simulation results demonstrate that the proposed scheme outperforms the considered baseline schemes in improving long-term profit, reducing communication overhead, and saving transmission time.

show abstract

Section: A Anomaly and Trigger Detectionmentioning

confidence: 99%

Federated Deep Reinforcement Learning for Prediction-Based Network Slice Mobility in 6G Mobile Networks

Ming,

Yu,

Taleb

2024

IEEE Trans. on Mobile Comput.

View full text Add to dashboard Cite

show abstract

“…Wang et al propõem uma arquitetura distribuída para detecc ¸ão de anomalias em redes virtualizadas para nós e enlaces físicos. Os autores aplicam o algoritmo de aprendizado de máquina de vetor de suporte de classe única ( One-Class Support Vector Machines -1-SVM) para detectar anomalia em cada nó do ambiente de virtualizac ¸ão e a análise de correlac ¸ão canônica (CCA) [Wang et al, 2022]. O algoritmo 1-SVM identifica como anomalia qualquer ponto que esteja fora da superfície de decisão definida pelos vetores de suporte.…”

Section: Trabalhos Relacionadosunclassified

Seleção de Características com Alta Quantidade de Informação para Sistemas de Detecção de Intrusão baseada no Conjunto de Dominância de Pareto

Barbosa¹,

Mattos²

2023

Anais Do XLI Simpósio Brasileiro De Redes De Computadores E Sistemas Distribuídos (SBRC 2023)

View full text Add to dashboard Cite

A pandemia de COVID-19 impulsionou a mudança no perfil de uso da Internet, o que fomentou o aumento de ataques e novas ameaças a instituições, até então, pouco visadas. Nesse novo cenário, ferramentas de detecção e prevenção de ameaças tendem a ser substituídas por soluções baseadas em aprendizado de máquina, que exigem execução eficiente. Este artigo propõe um método eficiente para a seleção de características para o aprendizado de máquina, utilizando a fronteira de Pareto. A proposta minimiza a correlação de Pearson e a Informação Mútua entre pares de características selecionadas. As características dominantes selecionadas foram aplicadas a três modelos de aprendizado de máquinas para classificação de fluxos maliciosos. O método proposto apresentou eficiência quando comparado a outros métodos, pois permite utilizar menos características para atingir valores similares de acurácia, precisão e revocação, diminuindo o tempo de treinamento e validação.

show abstract

“…However, the monitoring framework designed in [4], [39], [40] used centralized database to collect and process relevant data of VMs distributed in different regions of substrate networks, which will cause high communication and computation overhead when learning a global VM anomaly detection model. Our previous work [41] designed a distributed monitoring mechanism from the perspective of physical nodes and links, not from the entire networks. In this paper, for each region of the entire networks, we deploy a VM monitor for a network slice to collect and store metrics data of VMs in the network slice as a local database.…”

Section: Monitoring Framework For Network Virtualization Environmentmentioning

confidence: 99%

Federated Multi-Discriminator BiWGAN-GP Based Collaborative Anomaly Detection for Virtualized Network Slicing

Wang

Liang

Lun

et al. 2022

IEEE Trans. on Mobile Comput.

Self Cite

View full text Add to dashboard Cite

Virtualized network slicing allows a multitude of logical networks to be created on a common substrate infrastructure to support diverse services. A virtualized network slice is a logical combination of multiple virtual network functions, which run on virtual machines (VMs) as software applications by virtualization techniques. As the performance of network slices hinges on the normal running of VMs, detecting and analyzing anomalies in VMs are critical. Based on the three-tier management framework of virtualized network slicing, we first develop a federated learning (FL) based three-tier distributed VM anomaly detection framework, which enables distributed network slice managers to collaboratively train a global VM anomaly detection model while keeping metrics data locally. The high-dimensional, imbalanced, and distributed data features in virtualized network slicing scenarios invalidate the existing anomaly detection models. Considering the powerful ability of generative adversarial network (GAN) in capturing the distribution from complex data, we design a new multi-discriminator Bidirectional Wasserstein GAN with Gradient Penalty (BiWGAN-GP) model to learn the normal data distribution from high-dimensional resource metrics datasets that are spread on multiple VM monitors. The multi-discriminator BiWGAN-GP model can be trained over distributed data sources, which avoids high communication and computation overhead caused by the centralized collection and processing of local data. We define an anomaly score as the discriminant criterion to quantify the deviation of new metrics data from the learned normal distribution to detect abnormal behaviors arising in VMs. The efficiency and effectiveness of the proposed collaborative anomaly detection algorithm are validated through extensive experimental evaluation on a real-world dataset.

show abstract

Distributed Online Anomaly Detection for Virtualized Network Slicing Environment

Cited by 17 publications

References 41 publications

Federated Deep Reinforcement Learning for Prediction-Based Network Slice Mobility in 6G Mobile Networks

Federated Deep Reinforcement Learning for Prediction-Based Network Slice Mobility in 6G Mobile Networks

Seleção de Características com Alta Quantidade de Informação para Sistemas de Detecção de Intrusão baseada no Conjunto de Dominância de Pareto

Federated Multi-Discriminator BiWGAN-GP Based Collaborative Anomaly Detection for Virtualized Network Slicing

Contact Info

Product

Resources

About