Statistical-based anomaly detection for NFV services

Kourtis, Michail-Alexandros; Xilouris, George; Gardikis, Georgios; Koutras, Ioannis

doi:10.1109/nfv-sdn.2016.7919492

Cited by 14 publications

(11 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A fault injection process is used to emulate anomalies and provide abnormal states since the collected data obviously represents mostly the normal state. Paper [4] proposes another statistical learning solution for VNF anomaly detection. The idea here is to collect metrics by continuously monitoring the deployed VNFs and then predict the next values using a regression model.…”

Section: Background and Related Workmentioning

confidence: 99%

A network tomography approach for anomaly localization in Service Function Chaining

Rahali

Sanner

Phan

et al. 2021

2021 International Symposium on Networks, Computers and Communications (ISNCC)

View full text Add to dashboard Cite

The network slicing concept (probably one of the most important innovation brought by 5G) promises significant flexibility and autonomy for network management. Thanks to its main key features, heavily relying on the NFV and the SDN technologies, new communication services can be designed and deployed much faster than before. However, maintaining the reliability level of conventional networks remains a major open problem. One of its consequences is that the monitoring of the network infrastructure dedicated to this class of services is an essential challenge, which we address in this paper.In this paper we describe a new monitoring procedure, customized for NFV-based network infrastructures deployed with the Service Function Chaining (SFC) mechanism, one of the most important key enablers for NFV networks. Our solution allows the deployment of efficient probing schemes that guarantee the localization of multiple simultaneously failed nodes with a minimum cost. This is formulated as a graph matching problem and solved with a max-flow approach. Simulations show that our solution localizes the failed nodes with a small rate of false positives and false negatives.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

A network tomography approach for anomaly localization in Service Function Chaining

Rahali

Sanner

Phan

et al. 2021

2021 International Symposium on Networks, Computers and Communications (ISNCC)

View full text Add to dashboard Cite

show abstract

“…These services applied within customized analytics module learning mechanisms based on average entropy values from normal traces, alerting if entropy values deviate from established references threshold. Without the need of any metric thresholds, Kourtis et al [29] has proposed an automatic identification of an anomaly in an NFV service, as a significant deviation from its normal operation. Blaise et al [30] have introduced a VNF service chain anomalies detection method based on the Markov chain to identify the correctness of the service chaining request by observe whether exists abnormal behavior.…”

Section: Related Workmentioning

confidence: 99%

Matrix Differential Decomposition-Based Anomaly Detection and Localization in NFV Networks

Chen

Wei³

et al. 2019

IEEE Access

View full text Add to dashboard Cite

Network function virtualization (NFV) is a promising network paradigm that enables the design and implementation of novel network services with lower cost, increased agility, and faster time-to-value. However, network anomalies caused by software malfunction, hardware failure, mis-configuration, or cyber attacks can greatly degrade the performance of NFV networks. A few matrix decomposition-based methods have shown their effectiveness in finding the existence of network-wide anomalies. However, a little attention has been paid to multiple anomalies detection and anomaly devices localization. To bridge this gap, in this paper, we propose a matrix differential decomposition (MDD)-based anomaly detection and localization algorithm for NFV networks. First, an NFV network prototype is built to investigate the property of NFV networks, and the effectiveness of traditional anomaly detection methods is evaluated. Second, we detail the MDD-based Anomaly DEtection and Localization (MADEL) algorithm. Finally, a series of experiments are conducted on three different NFV networks to evaluate the performance of the proposed algorithm. Experimental results show that the MADEL algorithm could effectively detect and localize different types of network anomalies.

show abstract

“…1) Statistical based methods: Statistical based methods assume that normal data are associated with high probability states where as anomalous data are associated with low probability states of the process. M A Kourtis et al in [3] have used statistical methods like root mean square error [4] and covariance matrix [5] for detecting the anomalies in network function virtualization services. They perform the anomaly detection on system matrices (CPU load and memory utilization) using multiple linear regression and mahalanobis distance.…”

Section: Anomaly Detection Techniquesmentioning

confidence: 99%

Anomaly Detection in NFV Using Tree-Based Unsupervised Learning Method

Girish¹

2019

Preprint

View full text Add to dashboard Cite

With the increased adoption of virtualized NFs in data center, it is crucial to address some of the challenges such as performance and availability of the applications in virtualized network environment. The normal operation of the network can be analyzed with respect to the usage of various resources like, CPU, memory, network and disk. Inefficient usage or over usage of these resources leads to anomalous behavior. Anomalies are often preceded by faults. It is important to detect anomalies before they occur. The detected anomalies can be used for corrective and optimization actions. This paper presents that; unsupervised machine learning algorithm performs better compared to supervised machine learning algorithms in detecting anomalies. Here we use isolation forest algorithm on time series dataset, which is collected using monitoring agent collectd. Stress is induced to the computer using traffic monitoring generator and stress-ng. The results show that isolation forest algorithm gives better performance in anomaly detection with good anomaly score.

show abstract

Statistical-based anomaly detection for NFV services

Cited by 14 publications

References 5 publications

A network tomography approach for anomaly localization in Service Function Chaining

A network tomography approach for anomaly localization in Service Function Chaining

Matrix Differential Decomposition-Based Anomaly Detection and Localization in NFV Networks

Anomaly Detection in NFV Using Tree-Based Unsupervised Learning Method

Contact Info

Product

Resources

About