NFV-compliant Traffic Monitoring and Anomaly Detection based on Dispersed Vantage Points in Shared Network Infrastructures

Pavlidis, Adam; Sotiropoulos, Giannis; Giotis, Kostas; Kalogeras, Dimitris; Maglaris, Vasilis

doi:10.1109/netsoft.2018.8460031

Cited by 7 publications

(4 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The differentiation between normal and abnormal behavior is a difficult task; there is a chance that an anomalous event may occur close to normal behavior, and a normal event may occur close to anomalous behavior [67]. In both cases, we have a false alarm.…”

Section: (B) Reducing False Alarmmentioning

confidence: 99%

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

Zehra,

Faseeha,

Syed

et al. 2023

Sensors

View full text Add to dashboard Cite

Network function virtualization (NFV) is a rapidly growing technology that enables the virtualization of traditional network hardware components, offering benefits such as cost reduction, increased flexibility, and efficient resource utilization. Moreover, NFV plays a crucial role in sensor and IoT networks by ensuring optimal resource usage and effective network management. However, adopting NFV in these networks also brings security challenges that must promptly and effectively address. This survey paper focuses on exploring the security challenges associated with NFV. It proposes the utilization of anomaly detection techniques as a means to mitigate the potential risks of cyber attacks. The research evaluates the strengths and weaknesses of various machine learning-based algorithms for detecting network-based anomalies in NFV networks. By providing insights into the most efficient algorithm for timely and effective anomaly detection in NFV networks, this study aims to assist network administrators and security professionals in enhancing the security of NFV deployments, thus safeguarding the integrity and performance of sensors and IoT systems.

show abstract

Section: (B) Reducing False Alarmmentioning

confidence: 99%

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

Zehra,

Faseeha,

Syed

et al. 2023

Sensors

View full text Add to dashboard Cite

show abstract

“…The proposed VNF presents auto‐scaling properties and is empirically shown to be able to process up to 5 million messages per second. Another work that uses NFV technology to implement network monitoring architecture is presented in Reference . A set of monitoring agents is distributed across the network implemented as VNFs.…”

Section: Related Workmentioning

confidence: 99%

“…SPE's have been applied to sensor networks, the analysis of TCP flows, network intrusion detection . Multiple, diverse strategies for traffic anomaly detection have been proposed: machine learning, expert systems, rule mining, NFV technology, besides the strategy implemented in the present work which is the usage of entropy and PCA to detect traffic anomalies by monitoring the network traffic as a whole . It is possible to say that the major contribution of the present work is to employ an SPE extended with the operators to compute traffic entropy and PCA of the network as a whole in real time.…”

Section: Related Workmentioning

confidence: 99%

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Duarte

Hara

Torres

et al. 2020

Security and Privacy

View full text Add to dashboard Cite

BackStreamDB is distributed traffic monitoring system based on a stream processing engine (SPE) designed to monitor the traffic of wide area backbones.BackStreamDB provides arbitrary metrics about the traffic in real time, taking into account the backbone as a whole. The system was developed for and successfully deployed on the Brazilian National Academic Network (RNP). In this work, we describe the functionality for the detection of traffic anomalies. A large number of Internet attacks are continuously reported, and several types of attacks result in anomalous traffic. In the proposed strategy for anomaly detection, the traffic is sampled by monitors that are distributed across the backbone, which are accessed and processed by the SPE. BackStreamDB was extended with stream processing modules for computing traffic entropy and principal component analysis, which are the employed to detect traffic anomalies. Experimental results are reported which were obtained to validate the effectiveness of the proposed strategy for different types of attacks.

show abstract

“…In contrast, anomaly detection in NFV networks has attracted limited attention so far. Pavlidis et al [28] have proposed a management-plane monitoring and anomaly detection services in a monitoring architecture. These services applied within customized analytics module learning mechanisms based on average entropy values from normal traces, alerting if entropy values deviate from established references threshold.…”

Section: Related Workmentioning

confidence: 99%

Matrix Differential Decomposition-Based Anomaly Detection and Localization in NFV Networks

Chen

Wei³

et al. 2019

IEEE Access

View full text Add to dashboard Cite

Network function virtualization (NFV) is a promising network paradigm that enables the design and implementation of novel network services with lower cost, increased agility, and faster time-to-value. However, network anomalies caused by software malfunction, hardware failure, mis-configuration, or cyber attacks can greatly degrade the performance of NFV networks. A few matrix decomposition-based methods have shown their effectiveness in finding the existence of network-wide anomalies. However, a little attention has been paid to multiple anomalies detection and anomaly devices localization. To bridge this gap, in this paper, we propose a matrix differential decomposition (MDD)-based anomaly detection and localization algorithm for NFV networks. First, an NFV network prototype is built to investigate the property of NFV networks, and the effectiveness of traditional anomaly detection methods is evaluated. Second, we detail the MDD-based Anomaly DEtection and Localization (MADEL) algorithm. Finally, a series of experiments are conducted on three different NFV networks to evaluate the performance of the proposed algorithm. Experimental results show that the MADEL algorithm could effectively detect and localize different types of network anomalies.

show abstract

NFV-compliant Traffic Monitoring and Anomaly Detection based on Dispersed Vantage Points in Shared Network Infrastructures

Cited by 7 publications

References 14 publications

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Matrix Differential Decomposition-Based Anomaly Detection and Localization in NFV Networks

Contact Info

Product

Resources

About