Using Self-Organizing Maps for the Behavioral Analysis of Virtualized Network Functions

Abstract

Detecting anomalous behaviors in a network function virtualization infrastructure is of the utmost importance for network operators. In this paper, we propose a technique, based on Self-Organizing Maps, to address such problem by leveraging on the massive amount of historical system data that is typically available in these infrastructures. Indeed, our method consists of a joint analysis of system-level metrics, provided by the virtualized infrastructure monitoring system and referring to resource consumption patterns of the physical hosts and the virtual machines (or containers) that run on top of them, and application-level metrics, provided by the individual virtualized network functions monitoring subsystems and related to the performance levels of the individual applications. The implementation of our approach has been validated on real data coming from a subset of the Vodafone infrastructure for network function virtualization, where it is currently employed to support the decisions of data center operators. Experimental results show that our technique is capable of identifying specific points in space (i.e., components of the infrastructure) and time of the recent evolution of the monitored infrastructure that are worth to be investigated by human operators in order to keep the system running under expected conditions.

Machine Learning-Based Anomaly Detection in NFV: A Comprehensive Survey

“…Lanciano, Giacomo, et al [81] presented an approach for detecting anomalies in virtual networks using unsupervised machine learning techniques. The proposed method involves the use of a self-organizing map (SOM), which is an unsupervised neural network that can cluster similar data points together.…”

Near Real-Time Anomaly Detection in NFV Infrastructures

“…However, the technique was evaluated on a benchmark using a single-variate data. Self-Organizing Maps (SOMs) have been proposed specifically for anomaly detection in NFV data centers [22], with a multi-variate analysis method that identifies clusters of similar daily patterns in multiple metrics of VMs of one or more VNFs, so that changes in the classified behavior is marked as a possible anomaly. The technique was coupled with a heuristic for removing false positives, as often occurring over transitions between working and weekend days.…”

“…The goal of the proposed system is to detect anomalous points in the temporal evolution of metrics related to VMs/VNFs, focusing on their resource consumption metrics, i.e., related to the utilization of the underlying infrastructure (INFRA metrics), as well as the applicationlevel metrics (VNF metrics). More information about these metrics and a visualization of their typical patterns can be found in a prior work of ours [22]. Data related to VMs are collected from proprietary management platforms by the local data collection component and stored in a Data Lake within a Google Cloud Platform (GCP) environment 1 , where we use the Cloud Big Table service 2 as a reliable NoSQL storage for the gathered time-series.…”

“…A per-VM cluster model is trained on a month of data on a random VM among those belonging to the same behavioral cluster. These clusters are identified by a SOM-based technique described in a prior work of ours [22]. Clustering is applied to avoid having to train an LSTM model for each VM, considering that in our experimentation each model training process takes about 3 hours of processing time on a single processor (multi-core and/or GPU acceleration might be conveniently used to speed-up the process).…”

“…In what follows, we show results obtained with the other two techniques based on a predictor followed by a threshold-based A new test dataset is chosen which is a subsample of 25 VMs containing numerous normal days as well as anomalous data points, including cases with an anomalous day preceeded by either regular days only, or by one or more anomalous days, and sudden upward and downward hiccups. See [22] for more information on these behavioral patterns. This dataset is released with an open data license, and it is accessible at: http://retis.sssup.it/ ∼ tommaso/papers/nfvsdn22.php.…”