Machine Learning-Based Anomaly Detection in NFV

Version	Summary	Created by	Modification	Content Size	Created at	Operation
1		Hassan Jamil Syed	--	4319	2023-06-15 03:21:12	\|
2	format	Jason Zhu	Meta information modification	4319	2023-06-15 05:02:07	\|

This entry is adapted from the peer-reviewed paper 10.3390/s23115340

Network function virtualization (NFV) is a rapidly growing technology that enables the virtualization of traditional network hardware components, offering benefits such as cost reduction, increased flexibility, and efficient resource utilization. Moreover, NFV plays a crucial role in sensor and IoT networks by ensuring optimal resource usage and effective network management.

network function virtualization (NFV) Internet of Things (IoT) security challenges

1. Taxonomy of Network-Based Anomaly Detection in NFV

1.1. NFV Security Issues

NFV works in a virtualized environment that has various vulnerabilities. researchers categorized it into two main types, performance-related vulnerabilities and security-related vulnerabilities ^[1]. Performance-related vulnerabilities occur due to weakness in the network architecture, lack of data flow control and backup devices, the poor configuration of software and security devices, etc. ^[2] which will affect the performance of the NFV network, and attackers will exploit these vulnerabilities for attacks ^[3]. Security-related threats, including malicious attacks, are more easily encountered in NFV because NFV is a shared resource architecture, primarily when implemented on a cloud platform. In addition to third-party interference, the use of public networks for communication also makes NFV security more vulnerable than traditional hardware networks ^[4].

1.2. Network-Based Anomaly Technique

Anomaly detection techniques are used to identify the abnormal behavior of the overall network and identify not only active and passive attacks but also dynamic and novel malicious attacks ^[5]. Anomaly detection techniques have some advantages over firewalls or other malware tools, as they can identify abnormal behavior across hosts, networks, and distributed levels.

Network anomaly detection involves monitoring traffic, analyzing various metrics, and using techniques such as statistical analysis, machine learning, and rule-based methods to detect anomalous behavior ^[6]. In an NFV network, network functions can be dynamically deployed, scaled, and migrated, making it difficult to detect anomalies. Therefore, specialized techniques and tools are needed, such as distributed monitoring and analysis, and techniques that focus on detecting anomalies in the behavior of virtualized network functions themselves ^[7]. Network anomaly detection in NFV is a specialized form of anomaly detection that focuses on identifying anomalies within virtualized network functions in an NFV environment ^[8].

1.2.1. Approaches for Anomaly Detection

Anomaly detection has different approaches to finding anomalies in the network, but three of them are more commonly implemented, that is, statistical-based, knowledge-based, and machine learning-based approaches ^[9]. In statistical-based anomaly detection, abnormalities related to network data traffic are identified using statistical measures, e.g., ^[10] the mean, standard deviation, uni-variant, and multi-variant. There are several efficient statistical methods for analyzing the anomaly’s existence, such as an operational model, Markov model, outlier model, clustering model, multivariate model, and time series model, etc. ^[11]. Knowledge-based anomaly detection uses a set of rules to identify malicious behavior; these rules are defined based on suspicious behavior observed from past knowledge of adverse attacks ^[12]. Therefore, it is also known as a rule-based anomaly detection technique. Machine learning-based anomaly detection uses the automatic approach of classifying normal and abnormal data with the help of a data mining approach ^[13].

1.2.2. Classification of Anomaly Detection

Machine learning-based anomaly detection is classified into three main approaches, supervised, semi-supervised, and unsupervised anomaly detection. In recent research, a combination of these approaches is used in anomaly detection for NFV networks ^[14]. Researchers have proposed a method using semi-supervised learning to identify network anomalies and then using supervised learning to classify them as benign or malicious. Others have proposed using unsupervised learning for anomaly detection and then applying semi-supervised learning to identify the root cause of the anomaly. These approaches have shown promising results in detecting and mitigating anomalous behavior in NFV networks ^[15].

a.: Supervised Model

In supervised anomaly detection, researchers create a model that works on a trained dataset and categorizes the data into two labels, i.e., normal and abnormal ^[16]. The system collects information regarding the network and compares it to the labeled data; if the data record is more likely to be routine data, then it is considered normal, while on the other hand, if the data are more likely to be abnormal, then it is considered to be an anomaly ^[17].

b.: Semi-supervised Model

The supervised model depends on the labeled dataset; therefore, the labeled dataset should be of good quality ^[18]. A semi-supervised model works only on a single label, i.e., a normal dataset; in this approach, if the collected data do not match the normal dataset, then it is considered an anomaly, but this approach does not identify all types of anomalies ^[19].

c.: Unsupervised Model

Unsupervised is an efficient but complicated approach to finding an anomaly in the network. It does not use any label dataset; it works on instance data and efficiently identifies novel anomalies in the network ^[20]. The unsupervised approach uses raw measurements and data related to normal behavior to help the system identify novel and dynamic anomalies. Therefore, it is also known as a behavior-based model. There are several unsupervised techniques, such as adaptive threshold-based, clustering, Bayesian belief networks, and principal component analysis ^[21].

1.2.3. Causes of Network Anomaly Detection

Anomaly detection identifies security vulnerabilities by finding anomalies in the system’s normal behavior ^[22]. There are several causes of network anomalies, such as network component failure, non-control network traffic, improper monitoring, improper security perimeters, flash crowd, etc. ^[23].

a.: Network Component Failure

The network component includes hardware- and software-related components, such as routers, firewalls, VNFs services functions, etc. If these components fail during critical data communication, it causes an anomaly, a performance-related issue ^[24].

b.: Non-Control Network Traffic

Non-control network traffic is a serious issue that causes the network to be unavailable; an attacker exploits this vulnerability and makes the victim server unavailable for legitimate users, which causes anomalies in the network traffic behavior ^[25].

c.: Improper Monitoring

The access and login of an unauthorized user, weak security monitoring, avoiding unnoticed events, and interruption in the network all come under improper monitoring and cause anomalies in the network ^[26].

d.: Improper Security Perimeters

Security perimeters include the security measures taken by the network administrator, and these perimeters also cause anomalies in the network. If security perimeters are not strong enough, the network will easily be compromised ^[27]. The attacker always tries to take advantage of such security vulnerabilities.

e.: Flash Crowd

The flash crowd is also one of the causes of an anomaly in the NFV ^[28]. Flash crowd means the network is overloaded with legitimate traffic, and many legal users try to access the server, creating abnormal network traffic ^[29].

1.2.4. Use Cases of Anomaly Detection

Anomaly detection is used in various scenarios in NFV networks to identify performance-related and security-related issues ^[30]. Some popular use cases of anomaly detection are intrusion detection, fraud detection, malware detection, data loss prevention, log anomaly detection, etc. ^[31]. The anomaly detection identifies anomalies in the NFV network in an automated way and generates alerts that help the network to take immediate countermeasures.

1.2.5. Challenges of Anomaly Detection

Anomaly detection is a helpful technique for identifying unusual behavior, through which researchers detect existing and novel intruders or malicious attacks, and it also helps improve the performance of the NFV network ^[32]. Despite all these, there are several limitations of the anomaly detection technique, a few of which are discussed here.

(a): Runtime Anomaly Detection

Fast and reliable communication has always been the goal of NFV; researchers always want a solution that helps to identify runtime anomalies accurately by inspecting the data traffic without disturbing the legitimate traffic ^[33].

(b): Reducing False Alarm

The differentiation between normal and abnormal behavior is a difficult task; there is a chance that an anomalous event may occur close to normal behavior, and a normal event may occur close to anomalous behavior ^[34]. In both cases, researchers have a false alarm. Design such anomaly detection techniques that reduce this false alarm in NFV.

(c): Dimensionality Reduction

The appropriate selection of network traffic features is an important challenge in NFV. Select those network features for anomaly detection to help identify anomalous data traffic without compromising performance ^[35].

(d): Adaptability to Unknown Attacks

As the communication world grows, new challenges in the form of anomalies exist, which should be dynamically identified by anomaly detection techniques ^[36].

(e): Infrastructure Attacks

NFV is a virtual network environment that involves third-party to provide network infrastructure; several vulnerabilities exist in this network environment ^[37]. Therefore, an efficient anomaly detection system is required for such types of vulnerabilities.

Due to these issues, detecting anomalies in the NFV network is not easy. Researchers proposed several anomaly detection methods to overcome these limitations ^[15].

2. Review and Comparative Analysis of State-of-the-Art Anomaly Detection in NFV

Recently, the detection of malicious attacks in the NFV network has received considerable attention, and new algorithms for detecting such attacks have been developed that use the anomaly detection technique. Anomaly detection can identify malicious attacks in the overall network, while the firewall detects malicious attacks only in the data that pass through the firewall ^[38]. Therefore, new algorithms for anomaly detection need to be developed to identify anomalies in the NFV network that should overcome all the limitations as researchers discussed in the previous section.

2.1. State-of-the-Art Anomaly Detection in NFV

2.1.1. Anomaly Detection Using SMNRT

Derstepanians, Arman, et al. (2022) ^[33] proposed a machine learning-based approach for detecting anomalies in network function virtualization (NFV) infrastructures. The proposed method, simple median near real-time (SMNRT), is a hybrid approach that combines unsupervised and supervised learning techniques. The unsupervised part of the system uses a clustering algorithm to group similar data points into clusters, with anomalous data points identified as outliers. The supervised part trains a machine learning model to classify data points as either normal or anomalous. The proposed system is evaluated on a dataset of network traffic data from a real-world NFV infrastructure and achieves high detection accuracy, with an F1 score of over 0.9. The paper’s methodology involves four main steps, including data pre-processing, feature extraction, unsupervised clustering, and supervised classification. The evaluation of the proposed system includes comparing its detection performance with other state-of-the-art anomaly detection methods, demonstrating its effectiveness in detecting anomalies in near real time with high accuracy.

2.1.2. Matrix Differential Decomposition

Chen, Jing, et al. ^[39] proposed the matrix differential decomposition (MDD) method of anomaly identification in the NFV network. They designed a technique that works in three phases. In the first phase, a prototype model is implemented in the NFV network that collects and monitors the NFV network traffic, and its behavior is analyzed. The second phase implements the matrix differential decomposition model (MDD) that identifies the anomaly in the NFV network. In the last step, the proposed algorithm is tested experimentally, evaluated on three NFV networks individually, and its outcomes are studied. The MDD algorithm for anomaly detection and localization not only gives good results in identifying multiple anomalies at a single time but also prevents anomalies due to the localization of network devices.

2.1.3. Machine Learning-Base Early Anomaly Detection

Elmajed, Arij, Armen Aghasaryan, and Eric Fabre et al. ^[40] presented a machine learning-based anomaly detection algorithm focusing on two main challenges to identifying the anomaly in the NFV network: first, to detect faults before they severely affect the network, and secondly, to take countermeasures before the unavailability of NFV services. For this purpose, an experimental cloud-based NFV application was created that is isolated from all other applications, and this environment contains few virtualized network functions. The authors injected a series of resource perturbations and collected multiple metrics of the system behavior. In the next step, using different machine language approaches, they identified the anomaly in the system. They studied four machine learning (ML) approaches and compared their metrics results; the random forest (RF), XGBOOST, and KNN algorithms gave accuracy above 90%, while the max-likelihood classifier had 84% accuracy. After analyzing the fault localization and identification performance, RF and XGBOOST gave the best results in classifying the different types of anomalies. Despite these results, the proposed model further needs to improve the method of anomalies in the NFV network in a more generalized way.

2.1.4. Tree-Based Anomaly Detection

Girish, L., et al. ^[41] discussed the isolation forest algorithm for anomaly detection in NFV networks, which is an unsupervised anomaly detection approach. In this method, each occurring event of the data can be efficiently separated and works as a decision tree. The highly sensitive nature of the isolation forest helps to isolate abnormal data points toward the end nodes of the decision tree and normal data points toward the root. The feature that kept anomalies isolated from normal points originally helps to detect abnormalities in the NFV network. The isolation forest algorithm is tested by injecting the anomalies in the NFV network and collecting 12 different metrics’ data. Results show that the isolation tree algorithm efficiently detects anomalies dynamically in the NFV network.

2.1.5. SLA-Aware Anomaly Detection

Hong, Jibum, et al. ^[42] proposed a machine learning algorithm for anomaly identification in NFV networks using service level agreement (SLA) violation and some of the VNF performance features. The SLA-Aware algorithm work in three steps. The first step is virtual network orchestration, in which a monitoring function operates on NFVI (NFV infrastructure) and collects data on different VNFs in the network in terms of metrics. The second preprocessing step converts the collected information into valid training models and analyzes the data regarding anomaly detection. They divided the data into two categories; normal and abnormal data. The anomalous data are further categorized based on VNF performance and SLA violations. VNF performance includes data that identify packet drops due to the unavailability of VNF resources. SLA violations contain data representing the time that the service does not respond to the request. The last step is training models; in this step, among several machine learning-supervised anomaly detection algorithms, they selected the four best models based on testing. The chosen algorithms are distributed Ran.F (random forest), Gradient Bo.M (boosting machine), Extreme G_B (X gradient boost), and Feed_forward NN (F neural network). The Gradient Bo.M algorithm performs best among these four top algorithms. The results show that the implemented architecture of 95% accurately identified anomalies in the NFV network.

2.1.6. Markov Chain and K-Means Method

Blaise, Agathe, Stan Wong, and A. Hamid Aghvami, et al. ^[43] proposed a decision-based machine learning algorithm to identify the anomaly in the NFV network. They analyzed the VNFs service in a forward and backward sequence and found the normal and abnormal patterns of network functions. On detecting any anomaly, an alert is generated and a message is sent to the administrator to isolate the NFV network. The whole method is divided into two parts. The first part analyzes the virtual network function services using the Markov chain algorithm. In contrast, in the second part, the K-mean pattern detection technique is used to distinguish the normal behavior or abnormal behavior of the NFV services. The property of the system’s future state depends on the current state because Markov does not store any information; therefore, it is free from history. researchers apply the properties of the Markov chain function both forward and backward. Every VNF represents the state in terms of two transition metrics that also show their connection. The K-mean creates data clusters and uses them to analyze the network behavior. Since K-Mean works on clustered data, it identifies anomalies more accurately than other algorithms and can produce more accurate results as the cluster size increases.

2.1.7. Distance-Based Anomaly Detection in NFV

In Ref. ^[44], the proposed framework designs a legitimate behavior model at runtime to monitor the network traffic in an NFV network. When an anomaly is detected, the administrator initiates a mitigation process using the root cause analysis technique. This method uses distance-based clustering techniques to develop a legitimate model for anomaly detection. The proposed method efficiently identifies anomalies with low latency rates and reduces the false alarm rate.

2.1.8. Intelligent Orchestration of NFV for Anomaly

Silva, Fernando, and Alberto Schaeffer-Filho, et al. ^[45] proposed a method for anomaly detection in NFV using a supervised learning technique. The method was implemented in NFV orchestration and management block to monitor the data traffic. The main objective of this technique is to monitor all the incoming traffic; if any anomaly or malicious traffic is found, the proposed module automatically instantiates the network function, which helps with anomaly mitigation. The proposed method is efficient because it is integrated with the NVF orchestration and management module and minimizes resource usage. The experimental evaluation shows that the proposed method identifies anomalies with more than 90% accuracy in the NFV network.

2.1.9. IFTM-Based Anomaly Detection in NFV

Schmidt, Florian, et al. ^[46] proposed a model that implemented an unsupervised learning approach for anomaly detection in the NFV network. This method consists of an automatic function for identification and a threshold-based technique for classifying data traffic into normal and abnormal behavior. Due to two main tasks, i.e., identity and threshold values, the proposed method is called IFTM. IFTM identifies anomalies dynamically. The first function monitors the network traffic and identifies its behavior; if the traffic data are found to be abnormal, they are sent to the threshold function, where researchers classify their behavior as malicious or normal. This method gives 98% accurate results and also reduces the false alarm rate. However, this method has some limitations; the IFTM method is an expert system and needs some administrative control to handle it. Therefore, a method should be designed with an automatic system for anomaly detection without the intervention of any administration.

2.1.10. LSTM-Based Anomaly Detection in NFV

Alessio Diamanti, Jose Manuel. S.V., et al. ^[47] proposed an event-driven unsupervised machine-learning method to detect anomalies in the NFV network. This method provides a fully automated anomaly detection solution and identifies anomalies at runtime. The proposed method works in two steps; in the first step, they designed different software modules for other network functions. They used long short-term memory (LSTM) autoencoders and identified whether the data were nominal or anomalous. In the second phase, if any anomaly was found, it was sent to the root cause analysis module, where the anomaly’s mitigation occurs. The LSTM autoencoder works on the radiography visualization approach. This method identifies anomalies dynamically in a heterogeneous environment. This method gave 90% accurate results, but this method works on the virtual layer. Therefore, the proposed design should be extended to physical and cross-layer anomalies.

2.1.11. Unsupervised Neural Network SOM

Lanciano, Giacomo, et al. ^[48] presented an approach for detecting anomalies in virtual networks using unsupervised machine learning techniques. The proposed method involves the use of a self-organizing map (SOM), which is an unsupervised neural network that can cluster similar data points together. The SOM is trained on network traffic data to create a map of the normal network behavior. During the detection phase, new traffic data are input into the SOM, and if the data deviate significantly from the normal behavior, an anomaly is detected. The authors evaluated their approach on a simulated virtual network environment and found that it was able to detect various types of anomalies, including denial-of-service (DoS) attacks and port scans, with a high degree of accuracy. Overall, the paper demonstrates that unsupervised machine learning techniques can be effective for detecting anomalies in virtual networks, and the proposed SOM-based approach shows promise for this task.

2.2. Comparative Analysis of State-of-the-Art Anomaly Detection in NFV

All the above-proposed methods for anomaly detection in the NFV have some strengths and weaknesses. The method proposed by Derstepanians, Arman, et al. ^[33] was useful for telecommunication and infrastructure services. Telecommunication providers are always ready to deploy easily configurable and cost-effective solutions. Derstepanians, Arman, et al. ^[33] therefore designed a model that is easily implemented within the VNF services module and uses both supervised and unsupervised methods for anomaly detection. Their approach used VM data for anomaly detection. The method proposed by Jing Chen ^[39] is a matrix decomposition method, in which they use a three-step procedure to detect the anomaly and solve the device localization problem that generates the anomaly. This method not only gives good results but also reduces the presence of anomalies in the NFV network through the localization of devices.

Arij Elmajed ^[40] proposed a runtime solution for anomaly detection and focused on two main tasks: detecting anomalies before they affect system performance and taking timely countermeasures. Arij Elmajed ^[40] implemented his method using four different machine learning algorithms and studied their behavior in terms of accuracy. Girish and Dr. Sridhar ^[41] used the isolation forest algorithm technique to identify anomalies in the NFV network and create a decision tree for data. This decision tree dynamically separates the anomalous data from the norm data and shows good results. Jibum Hong, Suhyun, and Jae Hyoung ^[42] used service level agreement (SLA) and performance characteristics of VNF. This approach works in three steps: monitoring data traffic, analyzing data, and taking countermeasures to mitigate anomalies. The analyzed phase plays a major role in detecting anomalies. It separate the data into two main categories: anomalies due to VNF performance or SLA violations.

Agathe Blaise ^[43] proposed a decision-based machine algorithm that detects anomalies in forward and backward sequences and generates an alert message. The method works in two steps. The first uses the Markov chain algorithm to detect anomalies, and the second uses the K-means algorithm to generate an alert message if any anomaly occurs.

Anton Gulenko, Florian Schmidt ^[46] used a distance-based clustering model to identify anomalies in a NFV network and implement a mitigation process using root cause analysis. This method relies on human interaction to deal with anomalies but has low latency and reduces the false alarm rate. Fernando Silva and Alberto, Schaeffer-Filho ^[45] proposed a method implemented in the NFV orchestration and management block to identify anomalies in the network without any human interaction automatically. The proposed method is efficient and reduces resource consumption. Florian Schmidt and Anton Gulenko ^[44] proposed a method that automatically identifies anomalies in the network’s data traffic and, after finding any anomalous data, checks whether the data are malicious or not. For this check, it uses a threshold value. Alessio Diamanti, Jose Manuel ^[47] proposed a method that identifies anomalies in a heterogeneous environment and provides zero-touch network orchestration in the NFV. This method dynamically and automatically detects anomalies but operates at the virtual layer of the NFV network ^[49]. Here, researchers compare these methods and analyze their efficiency and effectiveness in identifying anomalies in NFV. From the above-proposed methods, researchers conclude some important facts regarding the anomaly detection technique in the NFV:

Supervised methods identify anomalies in the NFV network more quickly and accurately as compared to unsupervised methods.
Supervised methods are either implemented in NFV orchestration and management block or VNFs services function block; this technique reduces the cost and resource utilization.
Unsupervised methods are complex compared to supervised methods but detect novel anomalies in the NFV network.
Unsupervised methods provide a runtime anomaly detection mechanism and are implemented as separate modules or service functions.
Unsupervised methods have more false alarm rates than supervised methods ^[50].
Unsupervised methods provide a more generalized solution for anomaly detection than supervised methods.
Supervised methods also provide a mitigation process using root cause analysis and reduce costs by integrating with the NFV infrastructure.
Unsupervised methods provide a zero-touch network ^[47] monitoring environment and automatic anomaly detection approach in the NFV, whereas supervised methods need human interaction to handle anomalies.
Unsupervised methods also work in heterogeneous data environments in runtime scenarios ^[46].

researchers also study other surveyed papers on state-of-the-art anomaly detection in the NFV network. For instance, Wang, Song, et al. ^[51] (2021) discuss anomaly detection in network security, including various machine-learning techniques that can be used for anomaly detection. However, they do not specifically focus on anomaly detection in NFV-based networks. Nonetheless, the paper provides a good overview of the techniques that can be used for network anomaly detection, which could be useful in the context of NFV-based networks as well ^[52].

2.3. Quantitative Comparison of State-of-the-Art Anomaly Detection in NFV Network

Accuracy measures how often a model correctly predicts the outcome. Precision measures how often the model is correct when it predicts a positive outcome. It is like asking “How many of the positive predictions were correct?” Precision is important when researchers want to avoid false alarms. Recall measures how often the model correctly predicts a positive outcome out of all the true positive outcomes. Recall is important when researchers want to ensure that researchers do not miss any positive outcomes. The F-measure is a harmonic mean of precision and recall. The F-measure is useful when researchers want to balance the trade-off between precision and recall.

Through the comparison of accuracy, recall, precision, and F1-score across different anomaly detection methods, researchers can determine which method is the most effective in detecting anomalies in the NFV network. It is essential to focus on these quantitative features to ensure that the selected method can accurately and effectively identify anomalies while minimizing false positives. The metrics are presented in a tabular form for each proposed method, except for DBCAD and IFTM, which are marked as “NSP” (not specified) due to the lack of reported results in the corresponding paper. The table aims to provide a quick comparison of the performance of different proposed methods in terms of anomaly detection accuracy. The accuracy metric indicates the percentage of correctly classified instances among all instances. According to this metric, SOM ^[48] shows the best performance among all methods, achieving an accuracy of 0.9959, followed by SMNRT ^[33] and SYRROCA ^[47] with accuracies of 0.981 and 0.974, respectively.

Precision indicates the proportion of true positives to the total number of positive predictions. Among all methods, SOM ^[48] shows the best precision with a score of 0.9803, followed by MCKM ^[43] with a precision score of 0.95.

Recall indicates the proportion of true positives to the total number of actual positive instances. Among all methods, SOM ^[48] shows the highest recall score with a value of 0.9992, indicating that it can identify almost all positive instances as anomalies.

Among all methods, SOM ^[48] also shows the highest F1-score with a value of 0.9896, followed by SMNRT ^[33] and SYRROCA ^[47] with F1-scores of 0.976 and 0.94, respectively.

Overall, the results suggest that SOM is the most effective method for anomaly detection in NFV networks based on the considered performance metrics. However, it is important to consider other factors, such as complexity, scalability, and robustness, when choosing an appropriate anomaly detection method for a specific NFV environment.

References

Kawahara, R.; Watanabe, K.; Harada, S.; Kawata, T. Application of AI to Network Operation. IEICE Commun. Soc. Glob. Newsl. 2020, 44, 11.
Sipple, J.; Youssef, A. A general-purpose method for applying Explainable AI for Anomaly Detection. In Proceedings of the Foundations of Intelligent Systems: 26th International Symposium, ISMIS 2022, Cosenza, Italy, 3–5 October 2022; pp. 162–174.
Ma, Q.; Sun, C.; Cui, B.; Jin, X. A novel model for anomaly detection in network traffic based on kernel support vector machine. Comput. Secur. 2021, 104, 102215.
Tahsien, S.M.; Karimipour, H.; Spachos, P. Machine learning based solutions for security of Internet of Things (IoT): A survey. J. Netw. Comput. Appl. 2020, 161, 102630.
Prabakaran, S.; Ramar, R.; Hussain, I.; Kavin, B.P.; Alshamrani, S.S.; AlGhamdi, A.S.; Alshehri, A. Predicting attack pattern via machine learning by exploiting stateful firewall as virtual network function in an SDN network. Sensors 2022, 22, 709.
Reynaud, F.; Aguessy, F.X.; Bettan, O.; Bouet, M.; Conan, V. Attacks against network functions virtualization and software-defined networking: State-of-the-art. In Proceedings of the 2016 IEEE NetSoft Conference and Workshops (NetSoft) IEEE, Seoul, Republic of Korea, 6–10 June 2016; pp. 471–476.
Kabir, M.A.; Luo, X. Unsupervised learning for network flow based anomaly detection in the era of deep learning. In Proceedings of the 2020 IEEE Sixth International Conference on Big Data Computing Service and Applications (BigDataService) IEEE, Oxford, UK, 3–6 August 2020; pp. 165–168.
D’Alconzo, A.; Drago, I.; Morichetta, A.; Mellia, M.; Casas, P. A survey on big data for network traffic monitoring and analysis. IEEE Trans. Netw. Serv. Manag. 2019, 16, 800–813.
Abdallah, E.E.; Otoom, A.F. Intrusion Detection Systems using supervised machine learning techniques: A survey. Procedia Comput. Sci. 2022, 201, 205–212.
Moustafa, N.; Hu, J.; Slay, J. A holistic review of network anomaly detection systems: A comprehensive survey. J. Netw. Comput. Appl. 2019, 128, 33–55.
Kourtis, M.A.; Xilouris, G.; Gardikis, G.; Koutras, I. Statistical-based anomaly detection for NFV services. In Proceedings of the 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN) IEEE, Palo Alto, CA, USA, 7–10 November 2016; pp. 161–166.
Bhuyan, M.H.; Bhattacharyya, D.K.; Kalita, J.K. Network anomaly detection: Methods, systems and tools. IEEE Commun. Surv. Tutor. 2013, 16, 303–336.
Makani, R.; Reddy, B. Taxonomy of machine leaning based anomaly detection and its suitability. Procedia Comput. Sci. 2018, 132, 1842–1849.
Kawasaki, J.; Mouri, G.; Suzuki, Y. Comparative analysis of network fault classification using machine learning. In Proceedings of the NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium IEEE, Budapest, Hungary, 20–24 April 2020; pp. 1–6.
Martínez Osorio, J.S. Detection and Mitigation of DDoS/Dos Security threats in an NFV Architecture. Master’s Thesis, Universidad de Antioquia, Ciudad de Mexico, Mexico, 2022.
Suhaimi, N.A.D.; Abas, H. A systematic literature review on supervised machine learning algorithms. Perintis Ejournal 2020, 10, 1–24.
Vergara-Reyes, J.; Martinez-Ordonez, M.C.; Ordonez, A.; Rendon, O.M.C. IP traffic classification in NFV: A benchmarking of supervised Machine Learning algorithms. In Proceedings of the 2017 IEEE Colombian Conference on Communications and Computing (COLCOM) IEEE, Cartagena, Colombia, 16–18 August 2017; pp. 1–6.
Akcay, S.; Atapour-Abarghouei, A.; Breckon, T.P. Ganomaly: Semi-supervised anomaly detection via adversarial training. In Proceedings of the Computer Vision–ACCV 2018: 14th Asian Conference on Computer Vision, Perth, Australia, 2–6 December 2018; Revised Selected Papers, Part III 14. pp. 622–637.
Chiu, C.Y.; Lee, Y.J.; Chang, C.C.; Luo, W.Y.; Huang, H.C. Semi-supervised learning for false alarm reduction. In Proceedings of the Advances in Data Mining Applications and Theoretical Aspects: 10th Industrial Conference, ICDM 2010, Berlin, Germany, 12–14 July 2010; pp. 595–605.
Johari, S.S.; Shahriar, N.; Tornatore, M.; Boutaba, R.; Saleh, A. Anomaly Detection and Localization in NFV Systems: An Unsupervised Learning Approach. In Proceedings of the NOMS 2022–2022 IEEE/IFIP Network Operations and Management Symposium, IEEE, Budapest, Hungary, 25–29 April 2022; pp. 1–9.
Thottan, M.; Liu, G.; Ji, C. Anomaly detection approaches for communication networks. In Algorithms for Next Generation Networks; Springer: Berlin, Germany, 2010; pp. 239–261.
Pelati, A.; Meo, M.; Dini, P. Traffic Anomaly Detection Using Deep Semi-Supervised Learning at the Mobile Edge. IEEE Trans. Veh. Technol. 2022, 71, 8919–8932.
Chica, J.C.C.; Imbachi, J.C.; Vega, J.F.B. Security in SDN: A comprehensive survey. J. Netw. Comput. Appl. 2020, 159, 102595.
Wu, X.; Hou, K.; Leng, X.; Li, X.; Yu, Y.; Wu, B.; Chen, Y. State of the art and research challenges in the security technologies of network function virtualization. IEEE Internet Comput. 2019, 24, 25–35.
Bahri, M.; Salutari, F.; Putina, A.; Sozio, M. Automl: State of the art with a focus on anomaly detection, challenges, and research directions. Int. J. Data Sci. Anal. 2022, 14, 113–126.
Arzo, S.T.; Naiga, C.; Granelli, F.; Bassoli, R.; Devetsikiotis, M.; Fitzek, F.H. A theoretical discussion and survey of network automation for IoT: Challenges and opportunity. IEEE Internet Things J. 2021, 8, 12021–12045.
Kandanaarachchi, S.; Ochiai, H.; Rao, A. Honeyboost: Boosting honeypot performance with data fusion and anomaly detection. Expert Syst. Appl. 2022, 201, 117073.
Katiyar, P.; Kumarn, U.S.; Balakrishanan, S. Detection and discrimination of DDoS attacks from flash crowd using entropy variations. Int. J. Eng. Technol 2013, 5, 3514–3519.
Lakhina, A.; Crovella, M.; Diot, C. Characterization of network-wide anomalies in traffic flows. In Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, Taormina, Italy, 25–27 October 2004; pp. 201–206.
Arko, A.R.; Khan, S.H.; Preety, A.; Biswas, M.H. Anomaly Detection In IoT Using Machine Learning Algorithms. Ph.D. Thesis, Brac University, Dhaka, Banglasesh, 2019.
Sgueglia, A.; Di Sorbo, A.; Visaggio, C.A.; Canfora, G. A systematic literature review of iot time series anomaly detection solutions. Future Gener. Comput. Syst. 2022, 134, 170–186.
Adoga, H.U.; Pezaros, D.P. Network function virtualization and service function chaining frameworks: A comprehensive review of requirements, objectives, implementations, and open research challenges. Future Internet 2022, 14, 59.
Derstepanians, A.; Vannucci, M.; Cucinotta, T.; Sahebrao, A.K.; Lahiri, S.; Artale, A.; Fichera, S. Near Real-Time Anomaly Detection in NFV Infrastructures. In Proceedings of the 2022 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN) IEEE, Phoenix, AZ, USA, 14–16 November 2022; pp. 26–32.
Pavlidis, A.; Sotiropoulos, G.; Giotis, K.; Kalogeras, D.; Maglaris, V. NFV-compliant traffic monitoring and anomaly detection based on dispersed vantage points in shared network infrastructures. In Proceedings of the 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft) IEEE, Montreal, QC, Canada, 25–29 June 2018; pp. 197–201.
Sood, K.; Nosouhi, M.R.; Nguyen, D.D.N.; Jiang, F.; Chowdhury, M.; Doss, R. Intrusion Detection Scheme With Dimensionality Reduction in Next Generation Networks. IEEE Trans. Inf. Forensics Secur. 2023, 18, 965–979.
Mathas, C.M.; Segou, O.E.; Xylouris, G.; Christinakis, D.; Kourtis, M.A.; Vassilakis, C.; Kourtis, A. Evaluation of Apache Spot’s machine learning capabilities in an SDN/NFV enabled environment. In Proceedings of the 13th International Conference on Availability, Reliability and Security, Hamburg, Germany, 27–30 August 2018; pp. 1–10.
Monshizadeh, M.; Khatri, V.; Gamdou, M.; Kantola, R.; Yan, Z. Improving data generalization with variational autoencoders for network traffic anomaly detection. IEEE Access 2021, 9, 56893–56907.
Abbasi, M.; Shahraki, A.; Taherkordi, A. Deep learning for network traffic monitoring and analysis (NTMA): A survey. Comput. Commun. 2021, 170, 19–41.
Chen, J.; Chen, M.; Wei, X.; Chen, B. Matrix differential decomposition-based anomaly detection and localization in NFV networks. IEEE Access 2019, 7, 29320–29331.
Elmajed, A.; Aghasaryan, A.; Fabre, E. Machine learning approaches to early fault detection and identification in NFV architectures. In Proceedings of the 2020 6th IEEE Conference on Network Softwarization (NetSoft), IEEE, Ghent, Belgium, 29 June–3 July 2020; pp. 200–208.
Girish, L. Anomaly Detection in NFV Using Tree-Based Unsupervised Learning Method. Int. J. Eng. Sci. Manag. Multidiscip. Publ. VTU 2019, 1, 27–31.
Hong, J.; Park, S.; Yoo, J.H.; Hong, J.W.K. A Machine Learning based SLA-Aware VNF Anomaly Detection Method in Virtual Networks. In Proceedings of the 2020 International Conference on Information and Communication Technology Convergence (ICTC) IEEE, Jeju, Republic of Korea, 21–23 October 2020; pp. 1051–1056.
Blaise, A.; Wong, S.; Aghvami, A.H. Virtual network function service chaining anomaly detection. In Proceedings of the 2018 25th International Conference on Telecommunications (ICT) IEEE, Saint-Malo, France, 26–28 June 2018; pp. 411–415.
Gulenko, A.; Schmidt, F.; Acker, A.; Wallschläger, M.; Kao, O.; Liu, F. Detecting anomalous behavior of black-box services modeled with distance-based online clustering. In Proceedings of the 2018 IEEE 11th International Conference on Cloud Computing (CLOUD) IEEE, San Francisco, CA, USA, 2–7 July 2018; pp. 912–915.
Silva, F.; Schaeffer-Filho, A. Intel-Ocnf: Intelligent Orchestration of Containerized Network Functions for Anomaly Mitigation. Available online: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4189456 (accessed on 9 March 2023).
Schmidt, F.; Gulenko, A.; Wallschläger, M.; Acker, A.; Hennig, V.; Liu, F.; Kao, O. Iftm-unsupervised anomaly detection for virtualized network function services. In Proceedings of the 2018 IEEE International Conference on Web Services (ICWS) IEEE, San Francisco, CA, USA, 2–7 July 2018; pp. 187–194.
Diamanti, A.; Vilchez, J.M.S.; Secci, S. LSTM-based radiography for anomaly detection in softwarized infrastructures. In Proceedings of the 2020 32nd International Teletraffic Congress (ITC 32) IEEE, Osaka, Japan, 22–24 September 2020; pp. 28–36.
Lanciano, G.; Ritacco, A.; Brau, F.; Cucinotta, T.; Vannucci, M.; Artale, A.; Barata, J.; Sposato, E. Using Self-Organizing Maps for the Behavioral Analysis of Virtualized Network Functions. In Proceedings of the Cloud Computing and Services Science: 10th International Conference, CLOSER 2020, Prague, Czech Republic, 7–9 May 2020; Revised Selected Papers 10. pp. 153–177.
Kumar, D.; Thakur, J. Handling Security Issues in Software-defined Networks (SDNs) Using Machine Learning. In Computational Vision and Bio-Inspired Computing: Proceedings of ICCVBIC 2021; Springer: Berlin, Germany, 2022; pp. 263–277.
Spiekermann, D.; Keller, J. Unsupervised packet-based anomaly detection in virtual networks. Comput. Netw. 2021, 192, 108017.
Wang, S.; Balarezo, J.F.; Kandeepan, S.; Al-Hourani, A.; Chavez, K.G.; Rubinstein, B. Machine learning in network anomaly detection: A survey. IEEE Access 2021, 9, 152379–152396.
Bondan, L.; Wauter, T.; Volckaert, B.; De Turck, F.; Granville, L.Z. NFV Anomaly Detection: Case Study through a Security Module. IEEE Commun. Mag. 2022, 60, 18–24.

© Text is available under the terms and conditions of the Creative Commons Attribution (CC BY) license; additional terms may apply. By using this site, you agree to the Terms and Conditions and Privacy Policy.

Upload a video for this entry

Information

Subjects: Computer Science, Artificial Intelligence

Contributors MDPI registered users' name will be linked to their SciProfiles pages. To register with us, please refer to https://encyclopedia.pub/register :

Sehar Zehra

Ummay Faseeha

Hassan Jamil Syed

Fahad Samad

Ashraf Osman Ibrahim

Anas W. Abulfaraj

Wamda Nagmeldin

View Times: 281

Update Date: 15 Jun 2023

Table of Contents

Video Upload Options

Confirm