Intelligent Network Management for 5G Systems:

The SELFNET Approach

Wei Jiang∗† , Mathias Strufe∗ , and Hans D. Schotten†∗
∗ Intelligent Networking Group, German Research Center for Artificial Intelligence (DFKI)
Trippstadter street 122, Kaiserslautern, 67663 Germany
Emails: {wei.jiang, mathias.strufe, hans.schotten}@dfki.de
† Institute for Wireless Communication and Navigation, University of Kaiserslautern

Building 11, Paul-Ehrlich street, Kaiserslautern, 67663 Germany

Emails: {wei.jiang@dfki.uni-kl.de, schotten@eit.uni-kl.de}

Abstract—The maintenance and management for the current
Fourth Generation (4G) networks are still in a manual and
semi-automatic manner, which are costly and time-consuming.
This imposes a great challenge on the network management
of heterogeneous, software-defined and virtualized Fifth Gen-
eration (5G) systems. With the advent of network intelligence,
a possibility on intelligent management is opened for the 5G
system. Without interventions of network administrators, the
novel approach can autonomically deal with network failures,
cyber-attacks and inefficient resource utilization, which in turn
can lower operational expenditure, improve user’s experience
and reduce time-to-market of new services. In this paper, the
reference architecture, functionality, closed-loop control, enabling
algorithms of the network intelligence are presented. An intel-
ligent 5G test-bed is set up and the experimental results verify
the feasibility and effectiveness.
I. I NTRODUCTION
As of today, mobile networks’ troubleshooting (systems
failures, cyber-attacks, and performance degradations, etc.)
still cannot avoid manual operations, such as reconfiguring
software, repairing or replacing hardware. A mobile operator
has to keep an operational group with a large number of
network administrators with high expertise, leading to a costly
Operational Expenditure (OPEX) that is currently three times
that of Capital Expenditure (CAPEX) and keeps rising [1].
On the other hand, to meet the radical KPI requirements
of mobile broadband access and emerging services (Internet
of Things, virtual and augmented reality, self-driving car,
etc.), the forthcoming Fifth Generation (5G) system [2] is
envisioned to become far more complicated and heterogeneous
than current systems. It inevitably imposes a great challenge
on today’s manual and semi-automatic network management
that is already costly, vulnerable and time-consuming.
In this context, the EU H2020 SELFNET project [3] has
been established to design and implement an intelligent man-
agement framework for 5G mobile networks. Taking advan-
tage of cutting-edge technologies including Software-Defined
∗ This work was supported by the European Union’s Horizon 2020 Pro-
gramme under the 5G-PPP project: Framework for Self-Organized Network
Management in Virtualized and Software Defined Networks (SELFNET) with
Grant no. H2020-ICT-2014-2/671672.
Networking (SDN) [4], Network Function Virtualization (N-
FV) [5], Self-Organized Network (SON) [6] and Artificial
Intelligence [7], this framework provides the capabilities of
self-healing against network failures, self-protection against
distributed cyber-attacks, and self-optimization to improve
users’ Quality-of-Experience (QoE). Although SON has a self-
managing function, it is limited to static network resources. It
does not suit to some 5G scenarios, such as network slicing
[8] and multi-tenancy [9], where dynamic resource utilization
are required. Moreover, SON can only reactively respond to
detected network events, while the intelligent framework is
capable of proactively performing preventive actions for pre-
dicted problems. SELFNET aims to assist network operators
to simplify management and maintenance tasks, which in turn
lower OPEX, improve user experience and shorten time-to-
market of new services [10].
In addition to the SDN/NFV-based infrastructure [11], the
SELFNET framework mainly consists of: 1) sensors and a
monitor that can extract network metrics; 2) actuators and
an orchestrator that perform corrective and preventive actions;
and 3) the network intelligence that is in charge of diagnosing
network problems and making tactical decisions. This paper
focuses on presenting and validating the proposed network
intelligence. The rest of this paper is organized as follows:
Section II briefly introduces the architecture of the SELFNET
framework in order to provide a complete view. Section III
proposes the network intelligence, as well as its closed-loop
control and enabling algorithms. Section IV and V illustrate
the setup of intelligent 5G test-bed and some experimental
results, respectively. Finally, Section VI concludes this paper.
II. T HE SELFNET F RAMEWORK
Taking account into SDN and NFV technologies for the
5G system, the network intelligence is applied in software-
defined and virtualized network infrastructure. To provide a
complete view of the intelligent management, the reference
architecture of the SELFNET framework [12] is reviewed, as
shown in Fig.1. The differentiated layers are briefly explained
as follows:

c 2017 IEEE
978–1–5386–3873–6/17/$31.00

 Autonomic
Layer
Network
Monitor Orchestrator
Intelligence
Control Layer
Control Plane Sublayer
Sensors Actuators
SDN Controllers
Layer
Data
Data Plane Sublayer
Infrastructure
Virtualization Sublayer
Layer
Physical Sublayer
Fig. 1. Reference architecture of the SELFNET framework.
• Infrastructure Layer: All physical and virtual network re-
sources are located in this layer. It encompasses physical
and virtualization sublayer. The former provides an access
to physical resources (networking, computing, storage,
etc.), while the latter instantiates virtual infrastructures
on top of the physical sublayer.
• Data Layer: It implies an architectural evolution towards
the SDN paradigm by decoupling the control plane from
the data plane. In this framework, the Data Layer repre-
sents a simple data-forwarding, which can be either non-
virtualized or virtualized network function.
• Control Layer: This layer includes two internal sublayers:
SDN controllers and control plane sublayer. SDN/NFV
sensors and actuators, which are capable of collecting
data from the entire system and enforcing actions, re-
spectively, are also included.
• Autonomic Layer: This layer consists of three modules:
the monitor extracts features related to network behavior,
which are sent to the intelligence part to decide which
action should be done. The orchestrator coordinates phys-
ical/virtual resources and manages actuators to execute
the decided action.
• NFV Orchestration and Management Layer: This layer
is responsible for orchestrating and managing Virtual
Network Functions (VNFs) via the VNF manager, as
well as virtual resources through Virtualized Infrastruc-
ture Manager (VIM). It conforms to NFV Management
and Orchestration (MANO) specified by the European
Telecommunications Standards Institute (ETSI) [13].
III. T HE N ETWORK I NTELLIGENCE
One of the main innovative aspects of the SELFNET frame-
work is the network intelligence, which enables an autonomic
management for 5G networks. Taking advantage of cutting-
edge techniques in the field of artificial intelligence, it pro-
vides the capabilities of self-healing, self-protection and self-
optimization by means of reactively and proactively dealing
with detected and predicted network problems, respectively.
Network
Intelligence
Features Actions
NFV Orchestrator & Management Layer
VNF
Manager Monitor Orchestrator
VIM Sensor Actuator
Fig. 2. Control loop of the network intelligence.
This section presents closed-loop control of the network
intelligence, as well as the enabling algorithms.
A. Control Loop
Apart from the underlying software-defined and virtualized
network infrastructure, a closed control loop, starting from the
sensors and terminating at the actuators, is designed. Once
the monitor has detected or predicted a network problem, a
control loop initiates. The network intelligence diagnoses the
problem’s cause, decides a tactic and plans an action. As soon
as the orchestrator received an action request, it coordinates the
physical and virtual resources to enforce this action. As shown
in Fig.2, the input and output of the network intelligence
are features and actions, respectively, which are explained as
follows:
• Feature: According to [14], five differentiated data
sources have been identified in the SELFNET frame-
work. All monitoring information retrieved from physical
devices, data plane, SDN controller, SDN/NFV sensors,
and VIM, are uniformly called sensor data. The monitor is
capable of analyzing and aggregating the collected sensor
data so as to derive a set of network features that can be
evaluated to indicate the characteristics of an existing or
emerging network problem.
• Action: It is an implementable countermeasure to de-
scribe how to enforce, taking into account available
physical and virtual resources.
B. Enabling Algorithms (1): Feature Selection
In practice, a large number of features (network metrics)
can be extracted from the 5G infrastructure. Each feature
generally needs to be periodically recorded, resulting in a
huge volume of data. When the management system tackles a
specific problem, e.g., traffic congestion, it is inefficient (if not
infeasible) to process all data. That is because generally only a
relatively small subset of all-available features are informative,
while others are either irrelevant or redundant. As a data-
driven approach, the network intelligence should be built on
relevant features, while discarding others, so that irrelevant
and redundant features do not degrade the performance on
both training speed and predictive accuracy.
 RAN Edge
eNodeB
Server
Mini-PC as UE LTE USB Surfstick USRP
(HUAWEI E398) (Ettus B210)
Fig. 3.
Feature Selection (FS) is one of the most important intelli-
gence techniques and an indispensable component in machine
learning and data mining [15]. It can reduce the dimensionality
of data by selecting only a subset of features to built the
learning machine. In this paper, we take advantage of a
classical FS algorithm called Relief-F [16] to calculate the
relevance of the collected features.
C. Enabling Algorithms (2): Classification
In the terminology of machine learning, classification is an
instance of supervised learning. It is applied to identify which
class a new observation belongs on the basis of a training
dataset. An example would be assigning an incoming email
into ’SPAM’ or ’non-SPAM’ classes in terms of the observed
features of the email (source IP address, text length, title
content, etc.). Several classification algorithms that are used
in the test-bed are briefly reviewed as follows:
1) Decision Tree: Decision Tree (DT) [17] is a classical
supervised learning method used for classifying. Decision
rules are inferred from a training dataset and a tree-shaped
diagram is built. Each node of the decision tree relies on
a feature to separate the data, and each branch represents a
possible decision. DT is simple, interpretable and fast, whereas
it is hard to apply in a complex and non-linear case.
2) Support Vector Machine: Support Vector Machine
(SVM) [18] utilizes a so-called hyperplane to separate all data
points of one class from another. The number of features
does not affect the computational complexity of SVM, so
that it can perform well in the case of high-dimensional and
continuous features. However, it is a binary classifier and a
multi-class problem can be solved only by transferring into
multiply binary problems.
3) Nearest Neighbor: Another algorithm called k Nearest
Neighbor (kNN) is applied for data classification following the
hypothesis that close proximity in terms of inter-data distance
have an similarity. The class of an unclassified observation can
be decided by observing the classes of its nearest neighbors.
It is among the simplest algorithms with a good predictive
DC Core Data Plane
Management Plane
ZABBIX client
Network Intelligence Server YouTube
(with ZABBIX master)
iPerf3 Server
Internet
EPC Server Access Internet
(with HSS, SPGW & MME) Switch
The setup of intelligent 5G test-bed.
accuracy. But it needs high memory usage, is vulnerable to
noisy data and is not easy to interpret.
IV. A N I NTELLIGENT 5G T EST- BED
A. Test-Bed Setup
To demonstrate an intelligent management for 5G, as shown
in Fig.3, a mobile network test-bed is established. Its archi-
tecture conforms to ETSI’s Mobile Edge Computing (MEC)
[19], which was specially designed for the forthcoming 5G
networks. To approach a realistic network as much as possible,
an open-source LTE implementation called OpenAirInterface
(OAI) [20] is adopted. OAI provides a full protocol stack of
3GPP LTE standards for E-UTRAN radio access and EPC core
network. Relying on a software-defined radio module (Ettus
USRP B210) at the eNodeB side, a radio link is established
between user equipments (UEs) and the eNodeB. In our test-
bed, commercial UEs have been successfully tested to connect
the eNodeB and access the Internet, e.g., using an LTE-enabled
Apple iPad to browse webpages and watch YouTube videos.
Here, a mini-PC with an LTE surfstick (Huawei E398) rather
than a commercial UE is applied for the sake of easy to install
measurement tools. The UE and eNodeB form the RAN Edge
of MEC.
On the other side of this test-bed is the MEC Data Center
(DC) Core, where three servers and two switches are deployed.
First, the EPC server acts as the LTE EPC core network. It
is connected to the eNodeB at one side and to a switch at
the other side. The Internet access (data plane), marked by
the blue-solid lines in Fig.3, is granted to the UE. Second,
to facilitate a controllable network testing, a server is used
to deploy network tools like iPerf3 [21] (to flexibly generate
desired traffic) and to provide internal services such as video-
streaming. Third, the network intelligence server runs machine
learning algorithms so as to monitor, diagnose and control.
For the illustration shown in this paper, this server acts as
the data-sink for collecting network features with the help
of ZABBIX monitoring solution [22], implements feature
selection and classification modules. The hardware including
 TABLE I 0.4
LIST OF FEATURES

No. Metric Definition 0.3

1 EPC Traffic In Incoming trafffic of EPC server

Relevance Weight
2 EPC Traffic Out Outgoing trafffic of EPC server 0.2
3 UE Traffic In Incoming trafffic of UE
4 UE Traffic Out Outgoing trafffic of UE 0.1
5 Server Traffic In Incoming trafffic of iPerf3 server
6 PLR Average Packet Loss Rate
0
7 Delay Round trip delay
8 EPC Packet In Number of EPC’s incoming packets
-0.1
9 UE Packet In Number of UE’s incoming packets 0 2 4 6 8 10 12 14 16 18
10 eNB CPU Util eNodeB’s CPU utilization in percentage (%) Features
11 eNB CPU Temp eNodeB’s CPU temperature in (o C)
12 eNB Mem Util eNodeB’s memory utilization Fig. 4. Relevance weights of features.
13 EPC CPU Util EPC’s CPU utilization in percentage (%)
1
14 EPC CPU Temp EPC’s CPU temperature in (o C)
15 EPC Mem Util EPC’s memory utilization
16 UE CPU Util UE’s CPU utilization in percentage (%) 0.9

Prediction Accuracy
17 UE CPU Temp UE’s CPU temperature in (o C)
18 UE Mem Util UE’s memory utilization 0.8

DT
0.7
DT -r
servers, switches, mini-PC, radio modules and antennas fits SVM

into a server rack, as shown in the bottom-left part of Fig.3, 0.6

where the RAN Edge and the DC Core are not physically
separated.
B. Acquiring Network features
Since intelligence algorithms based on machine learning
are data-driven, data collecting is necessary for both training
and prediction phases. To guarantee the reporting of network
features, a separated traffic path for management plane is
required, as highlighted by the red-dashed lines in Fig.3.
ZABBIX clients are installed in the servers and mini-PC where
features needed to extract. These clients are connected to
the ZABBIX database running on the network intelligence
server via a switch, which is specific for the management
plane’s traffic. It is noted that the data traffic, such as YouTube
video-streaming, is transferred in an independent network
route through the Internet access switch. The reason is to
avoid potential collisions. In the previous tests, the data and
management traffic are not separated, the management traffic
is also blocked when testing data traffic congestion.
In this paper, we illustrate the operation of test-bed by
means of an example of traffic congestion. A testing procedure
is designed as follow:
1) Configure the maximal bandwidth of the Internet access
switch to 768kByte/s.
2) Run the eNodeB and EPC.
3) Connect the UE to the network, visit YouTube.com and
start a video down-streaming.
4) Generate traffic of 2.5MBytes/s by the iPerf3 server and
inject the traffic into the Internet access switch. Once the
iPerf3 traffic arrived, the congestion occurs.
SVM -r
kNN
kNN -r
0.5
2 4 6 8 10 12 14 16 18
Number of Features
Fig. 5. Predictive accuracy as a function of an incremental number of
features.
5) After a period of congestion, terminate the iPerf3 traffic
so as to return to the normal status.
During the whole test, the network features listed in Table I
are periodically (one sample per second) collected and stored
in the ZABBIX database. A training dataset consisting of 18
features with 240 observations is then obtained.
V. E XPERIMENTAL RESULTS
In this test, we take advantage of a classical algorithm called
Relief-F [16] to make clear which features listed in Table I
are relevant to the traffic congestion. The acquired training
dataset with the dimension of 240×18 is fed into the Relief-F
algorithm. A metric called relevance weight ranging from −1
to 1 is used to indicate the relevance of features. The larger
a weight is, the more relevant the corresponding feature. As
shown in Fig.4, the 6th and 14th features, namely PLR and
EPC CPU Temp, are the most relevant and irrelevant, respec-
tively. As we observed in the test, the CPU’s temperature of the
EPC server randomly fluctuates around 39o C, independently
with the occurrence of traffic congestion.
Then, predictive accuracies of three different classifiers
(DT, SVM, and kNN) are tested in terms of an incremental
number of features, where the number of features selected for
classification is gradually increased from 1 to 18. In the first
iteration, the number of used features is set to 1. The most
relevant feature PLR is the unique feature in the training data,
whereas other features are ignored. Three classifiers are trained
and the achieved predictive accuracies are 95.4%, 95.8%, and
96.3%, respectively. In other words, when the problem of
traffic congestion occurs 100 times, an average of around 96
times can be correctly detected by the network intelligence so
as to take further countermeasures.
On the contrast, the classifiers can be built on the basis of
the most irrelevant feature EP C CU P T emp. The resulting
predictive accuracies are only 62.9%, 62.9%, and 61.7%,
respectively. That is to say, the network intelligence is unaware
of almost 40% of occurred congestion. Suppose we merely
randomly decide (guess) whether there is congestion, like
throwing coins, the average accuracy is 50%. In comparison,
the classifiers with the most irrelevant feature get a really bad
performance since their results are just a little bit higher than
that of a random decision-making.
In the second iteration, the number of used features in-
creases to two by adding another feature. To be specific,
the most and second relevant features, namely P LR and
EP C P acket In, are selected to train and predict. Similarly,
EP C CU P T emp and Server T raf f ic In are used in the
irrelevant case. For each iteration, one feature is added to
the relevant and irrelevant tests according to their relevance,
until all of 18 features are used. Using DT as an example, as
shown in Fig.5, the curve ’DT’ shows the predictive accuracy
of the DT classifier with an incremental number of relevant
features. The curve ’DT-r’ gives its predictive accuracy with
the incremental number of irrelevant features.
Generally speaking, three classifiers can achieve a high
predictive accuracy merely using a few most relevant features.
Using 6 features, for example, DT can achieve its highest
accuracy of 98.3%. Then, its performance suffers from a slight
decrease with the number of features increases. This reveals
that the number of features does not follow the rule of ”the
more the better”. Notice that SVM and kNN can achieve the
optimal accuracy of 100%. Staring from 7 features, the SVM
keeps the optimal accuracy of 100% until all of 18 features
used. With 12 features, kNN achieves the optimal accuracy,
while there is a slight decrease when the number of features
is larger than 16. We can remark here that the classifiers can
achieve a very high accuracy of congestion detection with
a reasonable number of network features. It proves that the
network intelligence is both feasible and effective.
Notice that our objective in this paper is not the comparison
of different classifiers. The aim is to verify the feasibility and
effectiveness of applying the artificial intelligence technique
for implementing an intelligent 5G network management.
Now, we can say that this feasibility and effectiveness are
basically verified in the experiments.
VI. C ONCLUSIONS
This paper explored the possibility of intelligent network
management for software-defined and virtualized 5G systems.
Starting from a brief overview of the SELFNET framework,
the closed-loop control and enabling algorithms of the network
intelligence, which provides the functionalities of self-healing,
self-protection and self-optimization, have been presented. To
demonstrate the proposed approach, an example problem of
traffic congestion has been tested over an MEC-compliant 5G
test-bed. The experimental results validated that the network
intelligence is capable of autonomically detecting the anomaly
in a very high accuracy with the aid of feature selection
and classification algorithms. This verified the feasibility and
effectiveness of the proposed intelligent 5G management.
R EFERENCES
[1] “Top ten pain points of operating networks,” Aviat Networks, 2011.
[2] “5G white paper,” NGMN, Feb. 2015.
[3] EU H2020 5G-PPP SELFNET project. [Online]. Available:
https://selfnet-5g.eu/
[4] B. A. A. Nunes et al., “A survey of software-defined networking: Past,
present, and future of programmable networks,” IEEE Commun. Surveys,
vol. 16, no. 3, pp. 1617–1634, 2014.
[5] R. Mijumbi et al., “Network function virtualization: State-of-the-art and
research challenges,” IEEE Commun. Surveys, vol. 18, no. 1, pp. 236–
262, 2016.
[6] S. Dixit et al., “On the design of self-organized cellular wireless
networks,” IEEE Commun. Mag., vol. 43, no. 7, pp. 86–93, Jul. 2005.
[7] A. He et al., “A survey of artificial intelligence for cognitive radios,”
IEEE Trans. Veh. Technol., vol. 59, no. 4, pp. 1578–1592, May 2010.
[8] X. Zhou et al., “Network slicing as a service: enabling enterprises’ own
software-defined cellular networks,” IEEE Commun. Mag., vol. 54, no. 7,
pp. 146–153, Jul. 2016.
[9] K. Samdanis et al., “From network sharing to multi-tenancy: The 5G
network slice broker,” IEEE Commun. Mag., vol. 54, no. 7, pp. 32–39,
Jul. 2016.
[10] L. J. G. Villalba et al., “D2.1 - Use cases definition and requirements
of the system and its components,” EU H2020 SELFNET project, Tech.
Rep., Oct. 2015. [Online]. Available: https://selfnet-5g.eu/deliverables/
[11] P. Neves et al., “The SELFNET approach for autonomic management in
an NFV/SDN networking paradigm,” Intl. Journal of Distributed Sensor
Networks, vol. 16, no. 2, pp. 1–17, Feb. 2016.
[12] R. Cale et al., “D2.2 - Definition of APIs and interfaces of the
SELFNET framework,” EU H2020 SELFNET project, Tech. Rep., Mar.
2016. [Online]. Available: https://selfnet-5g.eu/deliverables/
[13] “Network Functions Virtualisation (NFV): Management and
Orchestration,” ETSI, Tech. Rep., Dec. 2014. [Online]. Available:
http://www.etsi.org/
[14] L. J. G. Villalba et al., “D4.1 - Report and prototypcal implementation
of the monitoring and discovery module,” EU H2020 SELFNET project,
Tech. Rep., Sep. 2016.
[15] V. Kumar and S. Minz, “Feature selection: A literature review,” Smart
Computing Review, vol. 4, no. 3, pp. 211–229, Jun. 2014.
[16] I. Kononenko et al., “Estimating attributes: analysis and extensions of
RELIEF,” in Proc. of the 6th European Conf. on Machine Learning,
Catania, Italy, Apr. 1994, pp. 171–182.
[17] S. K. Murthy, “Automatic construction of decision trees from data:
A multi-disciplinary survey,” Journal on Data Mining and Knowledge
Discovery, vol. 2, no. 4, pp. 345–389, Dec. 1998.
[18] C. J. Burges, “A tutorial on support vector machines for pattern recog-
nition,” Journal on data mining and knowledge discovery, vol. 2, no. 2,
pp. 121–167, Dec. 1998.
[19] M. Patel, et al., “Mobile-Edge Computing introductory technical white
paper,” Mobile-Edge Computing (MEC) industry initiative, 2014.
[20] N. Nikaein et al., “OpenAirInterface: A flexible platform for 5G
research,” ACM SIGCOMM Computer Communication Review, vol. 44,
no. 5, pp. 33–38, 2014.
[21] iPerf - The ultimate speed test tool for TCP, UDP and SCTP. [Online].
Available: https://iperf.fr/
[22] ZABBIX: The enterprise-class monitoring solution for everyone. Zabbix
LLC. [Online]. Available: http://www.zabbix.com/