Adaptive Probing-Based Anomaly Detection Framework for Performance-Aware Network Management

Y. Rimada; K.L Mrinh

doi:10.31838/sq3a0h71

Authors

Y. Rimada School of Electrical Engineering, Hanoi University of Science and Technology, 1 Dai Co Viet, Hanoi 11615, Vietnam Author
K.L Mrinh School of Electrical Engineering, Hanoi University of Science and Technology, 1 Dai Co Viet, Hanoi 11615, Vietnam Author

DOI:

https://doi.org/10.31838/sq3a0h71

Keywords:

Adaptive probing, anomaly detection, software-defined networking (SDN), 5G networks, hybrid machine learning, network performance monitoring, QoS assurance

Abstract

Abnormal network behaviour is a fundamental problem to Quality of Service (QoS) and operational stability in the contemporary communication infrastructure, especially in the context of Software-Defined Networking (SDN) and 5G. This paper introduces an Adaptive Probing-Based Anomaly Detection Framework (APADF) which uses real-time network stability indicators and performance fluctuation as adaptive probe timing parameters. It is an active measurement framework that integrates such active measurement methods as latency, round-trip time (RTT) variance, jitter, and throughput analysis with hybrid machine learning algorithms to classify anomalies intelligently and context-sensitively. In comparison with the conventional fixed-interval surveillance systems, proposed adaptive mechanism uses feedback-related control to streamline the probe scheduling, such that when anomalies occur in a transient way, the proposed mechanism is responsive, and when the situation is stable, the mechanism consumes less bandwidth. Based on Gaussian Mixture Models (GMM) to perform unsupervised clustering and Random Forest (RF) to perform supervised classification, the Analytics Core facilitates correct differentiation between transient congestion, ongoing disruptions, and attack-related disruptions. Experimental analysis of both emulated SDN testbeds and experimental WAN link show that APADF can detect with 93 percent, false positives are reduced by 30 percent and has a measurement overhead of less than 1 percent of link capacity. The results provide a confirmation of the ability of the framework to operate with a high level of precision, low overhead network monitoring, yet also provides scalability with interoperability with the existing SDN controllers and edge-based network. On the whole, APADF offers proactive, performance-sensitive and self-scheduling monitoring paradigm, which is adapted to the dynamism of next-generation communication networks.