Improving anomaly detection accuracy in time series data is essential for the operation of communication networks. Encoder-decoder models, which learn the correlations within the data, have been widely used for anomaly detection because the models can be trained without anomalous data. To capture the correlations within the data, encoder-decoder models are trained to reconstruct the data by using their encoders and decoders. However, existing encoder-decoder models struggle to reconstruct the input data depending on the geometric features of the data. In this paper, we focus on periodic time series data with complex geometric features and propose an expressive encoder-decoder model with learnable parameters that can exactly reconstruct periodic time series data. In anomaly detection experiments on two periodic time series datasets, our proposed model achieved higher area under the curve (AUC) scores than existing encoder-decoder models.

Identifying the fault device is one of the important tasks for network operators so that operators can immediately take action for the fault device in a communication network. Many methods have been developed to automate the identification of the fault device, and these methods assume only a single cause, such as hardware failure, which generates alarms. However, alarms are generated simultaneously due to multiple events (i.e., failure, construction work, and notification for operators) in a production communication network. This paper addresses the challenge of identifying fault devices in communication networks, which is complicated by the simultaneous occurrence of alarms from multiple events. We introduce a method utilizing alarm clustering to improve the accuracy of fault device identification by effectively distinguishing between these mixed alarms. Our evaluation was conducted using dataset in a real-world production environment more than one month and demonstrated significant enhancements in identifying faulty devices.

Vehicle communication services via mobile networks would further increase communication traffic volume. To prevent network congestion caused by the increase in communication traffic volume, network operators expand the number of base stations by predicting the maximum communication traffic volume. Although conventional methods for predicting communication traffic volume use previous mobile traffic data, vehicle communication services lack sufficient data due to limited usage. In this paper, we attempt to predict the maximum communication traffic volume without using mobile traffic data by relying on the maximum vehicle traffic density, which represents the number of vehicles per kilometer of road, although this is challenging since the vehicle traffic density is measured on only some roads. Meanwhile, road characteristics (e.g., the number of lanes) can be obtained for all roads. Therefore, we propose a method to estimate the maximum vehicle traffic density from road characteristics using a deep learning (DL) model to predict the maximum communication traffic for all roads. The proposed method uses the maximum vehicle traffic density or the parameters of the probability density function (PDF) of vehicle traffic density as labels. Training to estimate the parameters of the PDF allows us to calculate the maximum vehicle traffic density with a limited number of measurement days of data. Experimental results showed that the proposed method is more accurate than the baseline method in estimating the maximum vehicle traffic density.

Many unsupervised anomaly detection (UAD) methods for ICT systems that use only normal data collected from routers or servers, such as traffic volumes and text logs, have been developed to detect anomalies. Since the normal states of the ICT systems change due to the addition or deletion of devices, configuration changes, and OS updates, system operators need to collect enough normal data to learn various normal states whenever there is a change. Therefore, UAD methods cannot be applied until new data is gathered and a new normal state is identified. Using fine-tuning, one of the transfer learning techniques might reduce the duration of collecting normal state data. However, most of the existing papers focus on transferring knowledge of supervised models on image classification tasks, which are completely different from UAD in ICT systems. This paper analyzes a fine-tuning architecture to improve UAD in an ICT system with a small amount of normal data. By preparing five datasets, comprehensive experiments were conducted, and it was found that the fine-tuning architecture has the possibility to improve the accuracy of anomaly detection with a small amount of data for the ICT system dataset and scenarios.

Reinforcement Learning (RL)-based scaling methods have been proposed to automatically scale in or out Network Functions (NFs) according to their traffic load. However, the scaling operation of NFs in real systems has significant scaling process delay which is the time difference between the moment the scaling of a NF is executed and the moment a new instance is ready to handle the incoming traffic, which leads to degrading the performance of basic RL-based approach. In this paper, we propose a Deep Reinforcement Learning (DRL)-based scaling method which integrates state prediction to deal with this delay. The proposed method was evaluated on a testbed based on the Open-Source Magma project that was automated to perform scaling actions of NF. The results show that the proposed method enables to handle a higher load and improves CPU and memory usage by approximately 14% when compared to the baselineDRL-based method.

The scalability problem for Network Functions (NFs) is the scaling of cloud resources allocated to NFs according to the workload to guarantee the Quality of Service (QoS). This work investigates how Deep Reinforcement Learning (DRL) can be applied as a proactive solution to this problem and performance is evaluated on a testbed running an Open-Source packet core NF, provided by the Magma project. Dueling Double Deep Q-network (D3QN) algorithm is considered for the DRL method, with a reward function that considers resources usages and workload. Performance of the DRL method is compared to the traditional threshold-based approach on the testbed. Results show DRL-based scaling methods improve the QoS by reducing the number of dropped sessions by a factor of up to 100 while keeping resources usage in a defined range.

Machine learning (ML) has been used for various tasks in network operations in recent years. However, since the scale of networks has grown and the amount of data generated has increased, it has been increasingly difficult for network operators to conduct their tasks with a single server using ML. Thus, ML with edge-cloud cooperation has been attracting attention for efficiently processing and analyzing a large amount of data. In the edge-cloud cooperation setting, although transmission latency, bandwidth congestion, and accuracy of tasks using ML depend on the load balance of processing data with edge servers and a cloud server in edge-cloud cooperation, the relationship is too complex to estimate. In this paper, we focus on monitoring anomalous traffic as an example of ML tasks for network operations and formulate transmission latency, bandwidth congestion, and the accuracy of the task with edge-cloud cooperation considering the ratio of the amount of data preprocessed in edge servers to that in a cloud server. Moreover, we formulate an optimization problem under constraints for transmission latency and bandwidth congestion to select the proper ratio by using our formulation. By solving our optimization problem, the optimal load balance between edge servers and a cloud server can be selected, and the accuracy of anomalous traffic monitoring can be estimated. Our formulation and optimization framework can be used for other ML tasks by considering the generating distribution of data and the type of an ML model. In accordance with our formulation, we simulated the optimal load balance of edge-cloud cooperation in a topology that mimicked a Japanese network and conducted an anomalous traffic detection experiment by using real traffic data to compare the estimated accuracy based on our formulation and the actual accuracy based on the experiment.

Kubernetes (K8s) is promising software for application systems since it makes application systems more flexible and robust by auto-scaling, which automatically scales up the application system resources when the application system is overloaded, and self-healing, which automatically recovers the application system from a failure. However, auto-scaling and self-healing make system operators' tasks complex. First, there is a delay, which is the time difference between executing auto-scaling or self-healing and recovering degraded application performance metrics such as response time. Second, the delay depends on types of abnormalities (i.e., overloads and failures). Moreover, the auto-scaling and self-healing cannot always recover the abnormality. Therefore, system operators need to understand the degree of abnormality (i.e., how much the application performance is degraded and how long the delay is). Although many anomaly detection methods have been developed, they have not considered auto-scaling or self-healing when the abnormality occurs. In this paper, we analyze the performance of anomaly detection methods with auto-scaling and self-healing in K8s by implementing anomaly detection methods, and deploying a web application system on K8s. Specifically, first, we verified that there is a delay that depends on types of abnormality by injecting anomalies into the web application system. Then, we evaluated the anomaly detection accuracy of each method by using the data collected from the web application. Finally, a clustering approach is used for anomaly scores, which are the outputs of these methods, to investigate whether anomaly detection methods can provide the degree of abnormality. The evaluations show that our analysis provides useful information for operators to manage the K8s with auto-scaling and self-healing.

In video-streaming services, adaptive bitrate (ABR) streaming is widely used, and service providers should monitor the quality of their services so that they can detect the quality degradation. Although many quality-estimation models have been developed for monitoring ABR streaming services, these models are insufficient for service providers. This is because, to improve their services after quality degrades, service providers need to know which quality-influencing features, such as audio bitrate, video representation (i.e., video bitrate, framerate, and resolution), and stalling, cause the degradation. In this paper, we propose a Shapley-value-based quality degradation analysis method to provide contribution values, which indicate the degree of quality degradation due to each quality-influencing feature for improving their services. The proposed method adapts the Shapley value concept to our problem and calculates the contribution values by comparing the estimated quality with the maximum quality, i.e., the quality of viewing history with the highest audio bitrates, highest quality level of video representation, and no stalling. In the evaluation, a viewing experiment dataset on ABR streaming is used, and results show that our proposed method can extract the quality-influencing feature that decreases quality the most by calculating contribution values.

Because automatic recovery from failures is of great importance for future operations of ICT systems, we propose a framework for learning a recovery policy using deep reinforcement learning. In our framework, while iteratively trying various recovery actions and observing system metrics in a target system, an agent autonomously learns the optimal recovery policy, which indicates what recovery action should be executed on the basis of observations. By using failure injection tools designed for Chaos Engineering, we can reproduce many types of failures in the target system, thereby making the agent learn a recovery policy applicable to various failures. Once the recovery policy is obtained, we can automate failure recovery by executing recovery actions that the recovery policy returns. Unlike most previous methods, our framework does not require any historical documents of failure recovery or modeling of system behavior. To verify the feasibility of the framework, we conducted an experiment using a container-based environment built on a Kubernetes cluster, demonstrating that training converges in a few days and the obtained recovery policy can successfully recover from failures with a minimum number of recovery actions.

With the increase in scale and complexity of ICT systems, their operation increasingly requires automatic recovery from failures. Although it has become possible to automatically detect anomalies and analyze root causes of failures with current methods, making decisions on what commands should be executed to recover from failures still depends on manual operation, which is quite time-consuming. Toward automatic recovery, we propose a method of estimating recovery commands by using Seq2Seq, a neural network model. This model learns complex relationships between logs obtained from equipment and recovery commands that operators executed in the past. When a new failure occurs, our method estimates plausible commands that recover from the failure on the basis of collected logs. We conducted experiments using a synthetic dataset and realistic OpenStack dataset, demonstrating that our method can estimate recovery commands with high accuracy.

When a failure occurs in a network, network operators need to recognize service impact, since service impact is essential information for handling failures. In this paper, we propose Deep learning based Service Impact Prediction (DeepSIP), a system to predict the time to recovery from the failure and the loss of traffic volume due to the failure in a network element using a temporal multimodal convolutional neural network (CNN). Since the time to recovery is useful information for a service level agreement (SLA) and the loss of traffic volume is directly related to the severity of the failures, we regard these as the service impact. The service impact is challenging to predict, since a network element does not explicitly contain any information about the service impact. Thus, we aim to predict the service impact from syslog messages and traffic volume by extracting hidden information about failures. To extract useful features for prediction from syslog messages and traffic volume which are multimodal and strongly correlated, and have temporal dependencies, we use temporal multimodal CNN. We experimentally evaluated DeepSIP and DeepSIP reduced prediction error by approximately 50% in comparison with other NN-based methods with a synthetic dataset.

Operator-theoretic analysis of nonlinear dynamical systems has attracted much attention in a variety of engineering and scientific fields, endowed with practical estimation methods using data such as dynamic mode decomposition. In this paper, we address a lifted representation of nonlinear dynamical systems with random noise based on transfer operators, and develop a novel Krylov subspace method for estimating the operators using finite data, with consideration of the unboundedness of operators. For this purpose, we first consider Perron-Frobenius operators with kernel-mean embeddings for such systems. We then extend the Arnoldi method, which is the most classical type of Kryov subspace methods, so that it can be applied to the current case. Meanwhile, the Arnoldi method requires the assumption that the operator is bounded, which is not necessarily satisfied for transfer operators on nonlinear systems. We accordingly develop the shift-invert Arnoldi method for Perron-Frobenius operators to avoid this problem. Also, we describe an approach of evaluating predictive accuracy by estimated operators on the basis of the maximum mean discrepancy, which is applicable, for example, to anomaly detection in complex systems. The empirical performance of our methods is investigated using synthetic and real-world healthcare data.

We propose a root-cause diagnosis method for finding equipment suffering from rare failures in a communication network. Although many studies have been conducted on root cause diagnosis for finding failed equipment using a Bayesian Network or other methods, there has not been sufficient research into finding rare-failure equipment. Current methods are mainly focused on typical-failure equipment and cannot find rare-failure equipment. This is because rare failures have two features;unexpected causal relations and observation errors. To adapt rare- failure features, we propose a method that consists of an extended causal model and an extended inference algorithm with dynamic modification of the causal relations and observation statuses in a Bayesian Network. We experimentally evaluated its effectiveness.

In current large scale networks, troubleshooting has become more complicated task due to the diversification in the causes of network failures. The increase in the operational costs has become a serious problem. Thus, manualization of the troubleshooting process also becomes important task though it is time-consuming. We propose a method that automatically extracts a workflow for troubleshooting using multiple trouble tickets. Our method extracts an operator's actions from free-format texts and aligns relative sentences between multiple trouble tickets. Finally, we show a novel approach to visualizing a workflow by mining conditional branches using clustering. We validated our method using real trouble ticket data captured from a network operation and showed that it can extract the workflow to identify the cause of failure.