Upgrading control plane network functions with proactive anomaly detection capabilities
A method, system and apparatus are disclosed. According to one or more embodiments, a detection node includes processing circuitry that is configured to determine a forecast sequence using a first prediction model, where the forecast sequence is determined based at least in part on an input sequence, and determine a reconstructed forecast sequence using a second prediction model, where the reconstructed forecast sequence is determined based at least in part on the determined forecast sequence. The processing circuitry is also configured to determine a reconstruction error between the determined reconstructed forecast sequence and the determined forecast sequence and determine a signaling behavior for anomaly detection based at least in part on the determined reconstruction error and a predetermined threshold.
1 . A detection node comprising processing circuitry configured to:
determine a forecast sequence using a first prediction model, the forecast sequence being determined based at least in part on an input sequence;
determine a reconstructed forecast sequence using a second prediction model, the reconstructed forecast sequence being determined based at least in part on the determined forecast sequence;
determine a reconstruction error between the determined reconstructed forecast sequence and the determined forecast sequence; and
determine a signaling behavior for anomaly detection based at least in part on the determined reconstruction error and a predetermined threshold.
2 . The detection node of claim 1 , wherein the detection node further comprises a communication interface configured to:
receive at least one performance measurement counter associated with at least one signal, the determined signaling behavior being associated with the at least one signal.
3 . The detection node of claim 2 , wherein the at least one performance measurement counter is associated with application-level statistics based on a Diameter protocol, the at least one performance measurement counter being used to train at least one of the first and second prediction models.
4 . The detection node of claim 3 , wherein the processing circuitry is further configured to:
determine a count of at least one of a successful request, an unsuccessful request, a successful response, an unsuccessful response associated with the at least one signal; and
determine at least one statistical feature based at least on the determined count.
5 . The detection node of claim 2 , wherein the processing circuitry is further configured to:
determine the input sequence based at least in part on the received at least one performance measurement counter.
6 . The detection node of claim 5 , wherein the determining of the input sequence includes:
determining a statistical multivariate time series for the at least one performance measurement counter; and
using supervised learning to determine the input sequence based on the statistical multivariate time series.
7 . The detection node of claim 5 , wherein the first prediction model is a long short-term memory, LSTM, and the second prediction model is an autoencoder.
8 . The detection node of claim 1 , wherein the reconstructed forecast sequence is a reconstructed vector.
9 . The detection node of claim 1 , wherein the reconstruction error is a scalar residual magnitude between the forecast sequence and the reconstructed forecast sequence.
10 . The detection node of claim 1 , wherein the determining of the signaling behavior includes at least one of:
determining whether the signaling behavior is one of an abnormal signaling behavior and a normal signaling behavior; and
flagging at least the abnormal signaling behavior.
11 . The detection node of claim 10 , wherein the processing circuitry is further configured to:
determine at least one anomaly score to determine whether the signaling behavior is one of the abnormal signaling behavior and the normal signaling behavior based at least in part on the determined reconstruction error and the predetermined threshold, the abnormal signaling behavior being flagged when the at least one anomaly score is greater than the predetermined threshold.
12 . The detection node of claim 11 , wherein the predetermined threshold is based on a harmonic mean of precision and recall of the predetermined threshold.
13 . The detection node of claim 1 , wherein the forecast sequence profiles at least one signaling behavior for a future time window.
14 . A method in a detection node, the method comprising:
determining a forecast sequence using a first prediction model, the forecast sequence being determined based at least in part on an input sequence;
determining a reconstructed forecast sequence using a second prediction model, the reconstructed forecast sequence being determined based at least in part on the determined forecast sequence;
determining a reconstruction error between the determined reconstructed forecast sequence and the determined forecast sequence; and
determining a signaling behavior for anomaly detection based at least in part on the determined reconstruction error and a predetermined threshold.
15 . The method of claim 14 , wherein the method further includes:
receiving at least one performance measurement counter associated with at least one signal, the determined signaling behavior being associated with the at least one signal.
16 . The method of claim 15 , wherein the at least one performance measurement counter is associated with application-level statistics based on a Diameter protocol, the at least one performance measurement counter being used to train at least one of the first and second prediction models.
17 . The method of claim 16 , wherein the method further includes:
determining a count of at least one of a successful request, an unsuccessful request, a successful response, an unsuccessful response associated with the at least one signal; and
determining at least one statistical feature based at least on the determined count.
18 . The method of claim 15 , wherein the method further includes:
determining the input sequence based at least in part on the received at least one performance measurement counter.
19 . The method of claim 18 , wherein the determining of the input sequence includes:
determining a statistical multivariate time series for the at least one performance measurement counter; and
using supervised learning to determine the input sequence based on the statistical multivariate time series.
20 . The method of claim 18 wherein the first prediction model is a long short-term memory, LSTM, and the second prediction model is an autoencoder.
21 . The method of claim 14 , wherein the reconstructed forecast sequence is a reconstructed vector.
22 . The method of claim 14 , wherein the reconstruction error is a scalar residual magnitude between the forecast sequence and the reconstructed forecast sequence.
23 . The method of claim 14 , wherein the determining of the signaling behavior includes at least one of:
determining whether the signaling behavior is one of an abnormal signaling behavior and a normal signaling behavior; and
flagging at least the abnormal signaling behavior.
24 . The method of claim 23 , wherein the method further includes:
determining at least one anomaly score to determine whether the signaling behavior is one of the abnormal signaling behavior and the normal signaling behavior based at least in part on the determined reconstruction error and the predetermined threshold, the abnormal signaling behavior being flagged when the at least one anomaly score is greater than the predetermined threshold.
25 . The method of claim 24 , wherein the predetermined threshold is based on a harmonic mean of precision and recall of the predetermined threshold.
26 . The method of claim 14 , wherein the forecast sequence profiles at least one signaling behavior for a future time window.