Matrix Differential Decomposition-Based Anomaly Detection and Localization in NFV Networks

Chen, Jing; Chen, Ming; Wei, Xianglin; Chen, Bing

doi:10.1109/access.2019.2893624

Cited by 13 publications

(5 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Chen, Jing, et al [72] proposed the matrix differential decomposition (MDD) method of anomaly identification in the NFV network. They designed a technique that works in three phases.…”

Section: Matrix Differential Decompositionmentioning

confidence: 99%

“…Their approach used VM data for anomaly detection. The method proposed by Jing Chen [72] is a matrix decomposition method, in which they use a three-step procedure to detect the anomaly and solve the device localization problem that generates the anomaly. This method not only gives good results but also reduces the presence of anomalies in the NFV network through the localization of devices.…”

Section: Comparative Analysis Of State-of-the-art Anomaly Detection I...mentioning

confidence: 99%

See 1 more Smart Citation

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

Zehra,

Faseeha,

Syed

et al. 2023

Sensors

View full text Add to dashboard Cite

Network function virtualization (NFV) is a rapidly growing technology that enables the virtualization of traditional network hardware components, offering benefits such as cost reduction, increased flexibility, and efficient resource utilization. Moreover, NFV plays a crucial role in sensor and IoT networks by ensuring optimal resource usage and effective network management. However, adopting NFV in these networks also brings security challenges that must promptly and effectively address. This survey paper focuses on exploring the security challenges associated with NFV. It proposes the utilization of anomaly detection techniques as a means to mitigate the potential risks of cyber attacks. The research evaluates the strengths and weaknesses of various machine learning-based algorithms for detecting network-based anomalies in NFV networks. By providing insights into the most efficient algorithm for timely and effective anomaly detection in NFV networks, this study aims to assist network administrators and security professionals in enhancing the security of NFV deployments, thus safeguarding the integrity and performance of sensors and IoT systems.

show abstract

“…Chen, Jing, et al [72] proposed the matrix differential decomposition (MDD) method of anomaly identification in the NFV network. They designed a technique that works in three phases.…”

Section: Matrix Differential Decompositionmentioning

confidence: 99%

Section: Comparative Analysis Of State-of-the-art Anomaly Detection I...mentioning

confidence: 99%

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

Zehra,

Faseeha,

Syed

et al. 2023

Sensors

View full text Add to dashboard Cite

show abstract

“…With this approach, the solution presented here provides the TM between all possible combinations of OD pairs traversing S1 or S2. The getPorts( β 0 , β 1 ): linkports [2] function (lines 41-52) returns the β 0 , β 1 link ports. If the β 0 , β 1 link is an element of the L 1 , the function returns only the switch port (lines [43][44][45].…”

Section: ) Generate Lp Set Algorithmmentioning

confidence: 99%

“…A traffic matrix (TM) provides the traffic throughput between any OD pairs in a network over a specific time interval [1,2]. This information is essential for several activities in traffic engineering [42] (TE) such as switch load balancing, traffic analysis, and fault tolerance analysis.…”

Section: Introductionmentioning

confidence: 99%

A MapReduce Approach for Traffic Matrix Estimation in SDN

2020

View full text Add to dashboard Cite

A traffic matrix (TM) is a source of critical traffic throughput information for traffic engineering activities and network management tasks such as traffic prediction, capacity planning, network provisioning, and anomaly detection. However, estimating TM poses several challenges for network engineers. One of the challenges is that traffic data statistics are constantly changing, and their aggregation for real-time monitoring becomes a difficult task. This paper presents a near real-time TM estimation approach for OpenFlow (OF) networks. It makes use of Big Data techniques based on MapReduce operations to tackle the aggregation problem. The proposed method uses traffic data statistics collected from OF switches through an SDN controller as input and aggregates these data in a Big Data streaming processing environment. This paper explores the benefits of the distributed MapReduce computing model to provide an estimate of the TM for all origin-destination (OD) pairs of hosts in the network in two ways: 1) the accumulated throughput and 2) the throughput between two sequential TM estimates. This procedure enables network engineers to monitor the behavior and evolution of the throughput on each OD pair in the network and on each link in the path between each OD pair. The generated TM is persisted in a NoSQL database and can be made available for a variety of network traffic monitoring applications. The results of the simulations show the potential of the proposed MapReduce approach for TM estimation.

show abstract

“…Existing researches [6], [7], [8] have shown that the abnormal behaviors of VMs usually come with a significant change in resource metrics, so it is a good way to implement anomaly detection for VMs by collecting and analyzing its multi-dimensional resource metrics data. Although there have been many interesting researches for anomaly detection, including statistical and probability methods [9], [10], distance-based methods [11], [12], domain-based methods [13], [14], reconstruction-based methods [15], [16], [17], and information theory based methods [18], as classified in [19], detecting anomalies of VMs in virtualized network slicing environment still faces many challenges:…”

Section: Introductionmentioning

confidence: 99%

Federated Multi-Discriminator BiWGAN-GP Based Collaborative Anomaly Detection for Virtualized Network Slicing

Wang

Liang

Lun

et al. 2022

IEEE Trans. on Mobile Comput.

View full text Add to dashboard Cite

Virtualized network slicing allows a multitude of logical networks to be created on a common substrate infrastructure to support diverse services. A virtualized network slice is a logical combination of multiple virtual network functions, which run on virtual machines (VMs) as software applications by virtualization techniques. As the performance of network slices hinges on the normal running of VMs, detecting and analyzing anomalies in VMs are critical. Based on the three-tier management framework of virtualized network slicing, we first develop a federated learning (FL) based three-tier distributed VM anomaly detection framework, which enables distributed network slice managers to collaboratively train a global VM anomaly detection model while keeping metrics data locally. The high-dimensional, imbalanced, and distributed data features in virtualized network slicing scenarios invalidate the existing anomaly detection models. Considering the powerful ability of generative adversarial network (GAN) in capturing the distribution from complex data, we design a new multi-discriminator Bidirectional Wasserstein GAN with Gradient Penalty (BiWGAN-GP) model to learn the normal data distribution from high-dimensional resource metrics datasets that are spread on multiple VM monitors. The multi-discriminator BiWGAN-GP model can be trained over distributed data sources, which avoids high communication and computation overhead caused by the centralized collection and processing of local data. We define an anomaly score as the discriminant criterion to quantify the deviation of new metrics data from the learned normal distribution to detect abnormal behaviors arising in VMs. The efficiency and effectiveness of the proposed collaborative anomaly detection algorithm are validated through extensive experimental evaluation on a real-world dataset.

show abstract

Matrix Differential Decomposition-Based Anomaly Detection and Localization in NFV Networks

Cited by 13 publications

References 30 publications

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

A MapReduce Approach for Traffic Matrix Estimation in SDN

Federated Multi-Discriminator BiWGAN-GP Based Collaborative Anomaly Detection for Virtualized Network Slicing

Contact Info

Product

Resources

About