Professional Documents
Culture Documents
net/publication/332415048
CITATIONS READS
2 885
3 authors:
Tamás Tóthfalusi
14 PUBLICATIONS 83 CITATIONS
SEE PROFILE
Some of the authors of this publication are also working on these related projects:
MANTIS - Cyber Physical System based Proactive Collaborative Maintenance View project
All content following this page was uploaded by Pal Varga on 15 April 2019.
Abstract—Traditional network and service management meth- than other Machine Learning (ML) methods trained with
ods were based on counters, data records, and derived key extracted – and not learned – features. The instrumentation
indicators, whereas decision were mostly made in a rule-based for their effective application has become available in recent
manner. Advanced techniques have not yet got into the everyday
life of operators, mostly due to complexity and scalability issues. years, in the form of high-performance GPUs. The other
Recent progress in computing architectures, however, allows to main ingredient for DL application is the vast amount of
re-visit some of these techniques – nowadays, especially artificial data to ”learn” from. This traditionally gets generated during
neural networks –, and apply those in the network management. network operations, although, the practical access to such data
There are two aims of this paper. First, to briefly describe the is another issue, even after the advent of Big Data.
possible network and service management tasks within the mobile
core, where utilizing deep learning techniques can be beneficial. The motivation of this paper is to suggest DL methods as a
Secondly, to provide a living example of predicting certain fault- possible solution for some re-appearing issues of the network
types based on historical events, and to project further, similar and service management domain. The paper describes a prac-
examples to be executed on the same architecture. The real-life tical, real-life example for this, in the area of mobile telco’
example presented here aims to predict the occurrence of certain network management. Our use-case is predicting future error
errors during the VoLTE (Voice over LTE) call establishment
procedure. The methods and techniques presented in this paper occurrence based on statistical features of preceding message
has been validated through live network monitoring data. processing delays (also referred to as time differences).
The supervised model is trained on data gathered from a
I. I NTRODUCTION nationwide network. The training dataset consists of messages
with their time stamps and nodes IDs. The input features
During this time interval we captured about 66 million dropping them 37,473,377 entries and 10,985,871 sessions
INVITE messages. The captured file contained key parameters remained. The time difference between each communication
about INVITE methods between different IP addresses. in every session was calculated, separately. As time difference
Using the cross-correlation parameters (Call-ID and IMS- cannot be computed in the case of first elements of the
Charging-ID) from our previous work [11], we generated an sessions, these were dropped, resulting in 26,487,506 entries.
own ID, namely Call-Summary-ID (CSID), for each INVITE To provide a view of the delays in this complex and dis-
message. The CSID is used to follow the control traffic hop- tributed network architecture, we also grouped the IP addresses
by-hop. In order to have clearly defined records to feed the DL into five node groups. Without such a node type grouping the
algorithms with, the next step was the creation of a comma neural network would have been forced to cope with several
separated value (csv) file, with the following columns: dozens of ”different” nodes. Beside the calculations taking
1) Timestamp, superfluously long, such an approach would have suffered
2) Source IP, from lack of data volume at many node-pairs, and noisy data
3) Destination IP, at many other pairs.
4) CSID, We used our own and the operators’ engineering expert
5) Status code of the response message to the INVITE. knowledge to group the node types for this given purpose.
The status code of the response message is used to differen- Our node clustering method is based on the trusted and
tiate the error events. We consider the 4xx, 5xx and 6xx status untrusted domain definition from the operator’s viewpoint; the
code classes as an error response, except the following codes: typical entry points into the IMS domain and the architectural
positions. There were 1935 unique nodes with different IP
• 401 Unauthorized,
addresses, that resulted in 51 different node types based on
• 407 Proxy Authentication Required,
the IP address range. Then the node types were grouped into
• 486 Busy Here,
the following five node categories:
• 487 Request Terminated.
1) Node0: other operator’s node
Codes 401 and 407 are often (re-)authentication requests
2) Node1: untrusted domain entry points (e.g.: MSAN,
from the IMS. The 486 response means that the callee could
IBCF - Interconnection Border Control Function)
not accept the call, and the 487 status code ends a cancelled
3) Node2: trusted domain entry points (e.g.: SBC, PCSCF)
session. This expert knowledge on practical categorization of
4) Node3: ICSCF, SCSCF nodes
SIP reject codes have been further detailed in [10].
5) Node4: Application servers
B. Data preparation Message processing delays were then analyzed as Figure 2
The first step was to sort the CSV file based on the CSID suggests. This categorization may not be perfect, but helps
and the timestamp information. As a result, we got INVITE decreasing the problem space without introducing major mis-
message groups, in which the INVITE methods belong to the understandings to the method.
same call-setup procedure, ordered by time. Thus, IP pairs formed ten node category pairs: Node1 &
After gathering the data of one day from the described Node1, Node1 & Node2, Node1 & Node3, Node1 & Node4,
sources, the features consisted of a timestamp, a session Node2 & Node2, Node2 & Node3, Node2 & Node0, Node3
identifier, status codes and two IP addresses, that are two nodes & Node3, Node3 & Node4, Node0 & Node0.1 From the status
in the signaling. There were altogether 64,538,731 entries and 1 According to Figure 2 Node1 & Node3, Node1 & Node4, Node2 & Node0
38,051,225 sessions in the data. Sessions with only one entry and Node0 & Node0 category pairs should not exist. However, in real-world
were dropped. There were 27,065,354 such sessions, and after networks, signalling between such nodes also occurs.
Fig. 2. Simplified view of INVITE messages getting delayed at Nodes
The corresponding outputs – the number of errors in the next Fig. 6. Outputs (number of errors in the next time step) for the node category
pairs (1 second resampling). Y axis (please note, it has different scales):
time step for all the category pairs within the given day – are moving average of the number of errors in the next time step (window size:
shown in Figure 6. 100). X axis: time, duration of one day (from 0:00 to 23:59).
The output of all the node category pairs show similar
distribution, however, the number of errors differs in all node
categories. Node2 & Node2 had the highest, while Node1 & the table shows, in case of 10 seconds resampling the mean
Node4 had the lowest number of errors in average. The number squared error showed a similar pattern as in case of 1 second
of errors is low during the night, it peaks in the morning, it resampling, however, the errors were higher, as the target
slowly decays until the late afternoon, and in the evening it values had higher value range, indeed, over longer period.
decreases rapidly to low values again. Inspecting the mean The predictions and ground truth of the test database are
and standard deviation (Figure 5) some nodes category pairs shown in Figure 7. The test set represents the last 30% of
show similar characteristics (e.g., Node2 & Node2, Node2 & the data chronologically, so it refers to cca. from 17h to
Node0, Node3 & Node 4), while others has fast transients 24h of the day. This part of the data was unseen by the
(e.g., Node1 & Node 1, Node 1 & Node 4, Node 3 & Node model. The figure shows that the convolutional neural network
3). successfully learned to predict the number of errors in the
The 50% of the data was used for training, 20% for next time step based on the statistical features of previous 60
validation and 30% for testing. To preserve the temporal time step. In some cases, e.g. Node2 & Node2 and Node2 &
nature, the splitting was done on the chronologically ordered Node0 faster transients were successfully modeled: the red
data. line partially follows the first three peaks of the blue line
The network learned the problem in both cases with mean (denoted by blue circles). In other cases, e.g., Node3 & Node4,
squared errors measured on test data shown in Table II. As it couldn’t catch these variations (denoted by red circles).
VI. ACKNOWLEDGEMENTS
Parts of this research presented has been founded by the Na-
tional Research, Development and Innovation Office, Hungary
(KFI 16-1-2017-0024).
Parts of the research presented in this paper has been
supported by the BME-Artificial Intelligence FIKP grant
of Ministry of Human Resources (BME FIKP-MI/SC),
by Doctoral Research Scholarship of Ministry of Human
Resources (UNKP-18-4-BME-394) in the scope of New
National Excellence Program, and by János Bolyai Research
Scholarship of the Hungarian Academy of Sciences. We
gratefully acknowledge the support of NVIDIA Corporation
with the donation of the Titan Xp GPU used for this research.
Node1&Node2
Node1&Node3
Node1&Node4
Node2&Node2
Node2&Node3
Node2&Node0
Node3&Node3
Node3&Node4
Node0&Node0
Overall MSE
0.2 0.7 0.7 0.1 6.4 1.8 2.3 0.4 4.3 0.8 1.8 [6] P. V. Klaine, M. A. Imran, O. Onireti, and R. D. Souza, “A survey of ma-
chine learning techniques applied to self-organizing cellular networks,”
IEEE Communications Surveys Tutorials, vol. 19, no. 4, pp. 2392–2431,
2.8 10.4 10.9 1.3 162.6 25.7 38.2 5.7 80.6 10.0 34.8 Fourthquarter 2017.
[7] T. Shon and J. Moon, “A hybrid machine learning approach to network
anomaly detection,” Information Sciences, vol. 177, no. 18, pp. 3799 –
3821, 2007. [Online]. Available: http://www.sciencedirect.com/science/
article/pii/S0020025507001648
V. C ONCLUSION [8] G. Kathareios, A. Anghel, A. Mate, R. Clauberg, and M. Gusat, “Catch
it if you can: Real-time network anomaly detection with low false
Applying DL techniques at various areas of telecommuni- alarm rates,” in 2017 16th IEEE International Conference on Machine
cations network and service management is promising. There Learning and Applications (ICMLA), Dec 2017, pp. 924–929.
[9] R. Sommer and V. Paxson, “Outside the closed world: On using machine
are lots of space for improvement in terms of covering FCAPS learning for network intrusion detection,” in 2010 IEEE Symposium on
management areas, which this paper provided suggestions Security and Privacy, May 2010, pp. 305–316.
for. As a specific example, we trained a deep convolutional [10] P. Varga, T. Tothfalusi, Z. Balogh, and G. Sey, “Complex solution for
volte monitoring and cross-protocol data analysis,” in 30th IEEE/IFIP
neural architecture for predicting the number of errors for Network Operations and Management Symposium (NOMS), AnNet, Apr.
every node category pairs based on temporal features of 2018.
the signaling in different timescales. In case of some nodes [11] T. Tothfalusi and P. Varga, “Assembling sip-based volte call data records
based on network monitoring,” Telecommunications Systems, vol. 68,
category pairs, the features were correlated to the output, no. 3, pp. 393–407, 2018.
however, the prediction was acceptable in case of other node [12] J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson,
category pairs. Based on these preliminary results by collecting R. Sparks, M. Handley, and E. Schooler, “Sip: Session initiation proto-
col,” RFC 3261, 2002.
more data and increasing the receptive field the prediction [13] F. M. E. David C. Hoaglin and J. W. Tukey, Understanding Robust and
range is likely to be extensible and thus, errors on different Exploratory Data Analysis, 2000.
parts of the network will be able to be predicted. Future work [14] Y. LeCun, Y. Bengio et al., “Convolutional networks for images, speech,
and time series,” The handbook of brain theory and neural networks,
for this specific example will include training in greater data vol. 3361, no. 10, p. 1995, 1995.
sets, and predicting for longer time periods (several minutes). [15] N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhut-
Furthermore, other data sources of the VoLTE monitoring dinov, “Dropout: a simple way to prevent neural networks from over-
fitting,” The Journal of Machine Learning Research, vol. 15, no. 1, pp.
architecture is going to be introduced in the described DL 1929–1958, 2014.
infrastructure. This should allow the operator to act on the [16] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,”
predictions in a timely manner. arXiv preprint arXiv:1412.6980, 2014.