Distribution-based anomaly detection via generalized likelihood ratio test: A general Maximum Entropy approach

Coluccia, Angelo; D’Alconzo, Alessandro; Ricciato, Fabio

doi:10.1016/j.comnet.2013.07.028

Cited by 39 publications

(33 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Examples of such events include outages in mobile cloud services [31,8] and in VoIP peer-to-peer networks [9]. During those incidents, a large number of mobile devices attempt to recover connectivity to the application servers, generating significantly more keep-alive messages [5] and an unexpectedly high signaling load in the process.…”

Section: Signaling Stormsmentioning

confidence: 99%

Countering Mobile Signaling Storms with Counters

Gelenbe

Abdelrahman

2016

Internet of Things. IoT Infrastructures

View full text Add to dashboard Cite

Abstract. Mobile Networks are subject to signaling storms launched by misbehaving applications or malware, which result in bandwidth overload at the cell level and excessive signaling within the mobile operator, and may also deplete the battery power of mobile devices. This paper reviews the causes of signaling storms and proposes a novel technique for storm detection and mitigation. The approach is based on counting the number of successive signaling transitions that do not utilize allocated bandwidth, and temporarily blocking mobile devices that exceed a certain threshold to avoid overloading the network. Through a mathematical analysis, we derive the optimum value of the counter's threshold, which minimizes both the number of misbehaving mobiles and the signaling overload in the network. Simulation results are provided to illustrate the effectiveness of the proposed scheme.

show abstract

Section: Signaling Stormsmentioning

confidence: 99%

Countering Mobile Signaling Storms with Counters

Gelenbe

Abdelrahman

2016

Internet of Things. IoT Infrastructures

View full text Add to dashboard Cite

show abstract

Section: Prior Work On Storm Detection and Mitigationmentioning

confidence: 99%

“…A general framework for anomaly detection was presented in [13] based on time-series analysis and change detection algorithms. While the goal of [13,45] is to identify large-scale events by aggregating and analyzing statistics from all hosts and mobile users, respectively, our approach aims to identify users that are contributing to a problem, namely signaling overload, rather than detect the problem itself. The work in [42] considered the detection of mobile-initiated signaling attacks via a supervised learning approach, which monitors transmissions that trigger a radio access bearer setup procedure, and extracts from the corresponding packets features relating to destination IP and port numbers, packet size and response-request ratio.…”

Section: Prior Work On Storm Detection and Mitigationmentioning

confidence: 99%

“…The features that we wish to use should capture the RRC signaling dynamics of users, be easy to measure or calculate without high computational or storage cost, and reflect both the instantaneous behavior and the long term trend of the traffic. For each mobile under observation, we extract information related to inter-arrival times, lengths and destination IP addresses of packets, which have been suggested previously [13,42,56] as good indicators of signaling misbehavior. The specific features that we have used are described below.…”

Section: Feature Selectionmentioning

confidence: 99%

See 1 more Smart Citation

Detecting Network-Unfriendly Mobiles With the Random Neural Network

Abdelrahman

2016

Prob. Eng. Inf. Sci.

View full text Add to dashboard Cite

Mobile networks are universally used for personal communications, but also increasingly used in the Internet of Things and machine-to-machine applications in order to access and control critical services. However, they are particularly vulnerable to signaling storms, triggered by malfunctioning applications, malware or malicious behavior, which can cause disruption in the access to the infrastructure. Such storms differ from conventional denial of service attacks, since they overload the control plane rather than the data plane, rendering traditional detection techniques ineffective. Thus, in this paper we describe the manner in which storms happen and their causes, and propose a detection framework that utilizes traffic measurements and key performance indicators to identify in real-time misbehaving mobile devices. The detection algorithm is based on the random neural network which is a probabilistic computational model with efficient learning algorithms. Simulation results are provided to illustrate the effectiveness of the proposed scheme.

show abstract

“…Just recently interest has emerged in applying methods from the machine learning domain such as clustering algorithms [16] as well as Bayesian networks [18] to automate the detection of faulty cell behavior. Coluccia et al [17] analyzed the variations in the traffic profiles for 3G cellular systems to detect real world traffic anomalies. In terms of COC, the authors in [8], [9] investigated the effectiveness of control parameters such as the reference signal power, antenna tilt, scheduling parameters and the uplink target received power level in mitigating the effect of cell outage.…”

Section: Introductionmentioning

confidence: 99%

A Cell Outage Management Framework for Dense Heterogeneous Networks

Onireti

Zoha

Moysen

et al. 2016

IEEE Trans. Veh. Technol.

103

View full text Add to dashboard Cite

Abstract-In this paper, we present a novel cell outage management (COM) framework for heterogeneous networks (HetNets) with split control and data planes -a candidate architecture for meeting future capacity, quality of service and energy efficiency demands. In such architecture, the control and data functionalities are not necessarily handled by the same node. The control base stations (BSs) manage the transmission of control information and user equipment (UE) mobility, while the data BSs handle UE data. An implication of this split architecture is that, an outage to a BS in one plane has to be compensated by other BSs in the same plane. Our COM framework addresses this challenge by incorporating two distinct cell outage detection (COD) algorithms to cope with the idiosyncrasies of both the data and control planes. The COD algorithm for control cells leverages the relatively larger number of UEs in the control cell to gather large scale minimize drive testing (MDT) reports data, and detects outage by applying machine learning and anomaly detection techniques. To improve outage detection accuracy, we also investigate and compare the performance of two anomaly detecting algorithms, i.e. k− nearest neighbor and local outlier factor based anomaly detector, within the control COD. On the other hand, for data cells COD, we propose a heuristic grey-prediction based approach, which can work with the small number of UEs in the data cell, by exploiting the fact that the control BS manages UE-data BS connectivity, by receiving a periodic update of the received signal reference power (RSRP) statistic between the UEs and data BSs in its coverage. The detection accuracy of the heuristic data COD algorithm is further improved by exploiting the Fourier series of residual error that is inherent to grey prediction model. Our COM framework integrates these two COD algorithms with a cell outage compensation (COC) algorithm which can be applied to both planes. Our COC solution utilizes an actor critic (AC) based reinforcement learning (RL) algorithm, which optimizes the capacity and coverage of the identified outage zone in a plane, by adjusting the antenna gain and transmission power of the surrounding BSs in that plane. The simulation results show that the proposed framework can detect both data and control cell outage, and also compensate for the detected outage in a reliable manner.

show abstract

Distribution-based anomaly detection via generalized likelihood ratio test: A general Maximum Entropy approach

Cited by 39 publications

References 31 publications

Countering Mobile Signaling Storms with Counters

Countering Mobile Signaling Storms with Counters

Detecting Network-Unfriendly Mobiles With the Random Neural Network

A Cell Outage Management Framework for Dense Heterogeneous Networks

Contact Info

Product

Resources

About