Sequential Deep Learning Architectures for Anomaly Detection in Virtual Network Function Chains

TL;DR

This paper introduces advanced sequential deep learning models for anomaly detection in virtual network function chains, improving detection accuracy and adaptability to varying service configurations in SDN and NFV environments.

Contribution

It develops novel sequential deep learning architectures that capture temporal dependencies and handle variable-length service function chains, surpassing prior non-sequential models.

Findings

Enhanced anomaly detection accuracy with sequential models

Models applicable to variable-length service function chains

Improved generalization over previous approaches

Abstract

Software-defined networking (SDN) and network function virtualization (NFV) have enabled the efficient provision of network service. However, they also raised new tasks to monitor and ensure the status of virtualized service, and anomaly detection is one of such tasks. There have been many data-driven approaches to implement anomaly detection system (ADS) for virtual network functions in service function chains (SFCs). In this paper, we aim to develop more advanced deep learning models for ADS. Previous approaches used learning algorithms such as random forest (RF), gradient boosting machine (GBM), or deep neural networks (DNNs). However, these models have not utilized sequential dependencies in the data. Furthermore, they are limited as they can only apply to the SFC setting from which they were trained. Therefore, we propose several sequential deep learning models to learn time-series patterns and sequential patterns of the virtual network functions (VNFs) in the chain with variable lengths. As a result, the suggested models improve detection performance and apply to SFCs with varying numbers of VNFs.