Dynamic resource allocation for microservices is crucial for meeting management objectives like high throughput and low latency. Recent advancements highlight reinforcement learning as a promising technique, with policy adaptation offering potential for coping with dynamic environments. However, traditional policy adaptation methods often suffer from slow adaptation, particularly in rapidly changing scenarios, limiting their effectiveness in achieving timely responses. To address this limitation, we explore a meta-learning technique to train more generalizable and robust policies that adapt more quickly to target environments. Our findings from extensive experimentation in a real testbed reveal that the MAML meta-learning technique outperforms in scenarios with changing management objectives and achieves comparable performance to baselines in handling dynamic infrastructure loads.

Intrusion Detection Systems (IDS) are crucial for monitoring and managing critical infrastructure; however, their prominence makes them attractive targets for network attacks. Machine Learning (ML) techniques incorporated into IDS have shown promise in detecting and mitigating these threats. Unfortunately, the scarcity of attack samples presents challenges for model training and generalizability, and attackers can easily bypass detection systems by introducing temporal variations in their attacks. This paper develops strategies for detecting network attacks and specifically examines the impact of network configurations on the generalizability of detection models. As an illustrative example, we investigate the performance of Long Short-Term Memory (LSTM) models in capturing temporal changes in network behavior during attacks, and its resilience against distributional changes. Our study considers multiple factors in terms of attack types, variations, and network configurations, including different topologies and numbers of nodes. We provide insights into how these factors impact the generalizability of models trained using knowledge sharing. To support our research, we implemented Blackhole and DIS-flooding attack variations using the Cooja network simulator. Our objective was to generate a large dataset that enables a comprehensive analysis of attack variations across a diverse set of network configurations, focusing on the impact on LSTM-based IDS for IoT networks.

From a 5G operator’s perspective, accurate estimates of key User Equipments (UEs) performance metrics, especially One-Way Delay (OWD), can provide valuable information. These estimates can trigger management tasks such as reconfiguration to prevent violations of Service Level Objectives (SLOs). Moreover, such insights into UE performance can empower applications to adapt their services to end-users in a more effective manner. We use advanced machine learning over data gathered at the base stations to predict OWD from UEs and show that we are able to predict OWD with over a 2× reduction in percentage error compared to the considered baseline. We discover the close coupling between the performance of the OWD model and the type of UE, which poses a model generalization challenge. Addressing this problem, we demonstrate the shortcomings of the commonly used fine-tuning approach and develop a novel method based on domain adversarial neural networks, that can adapt to a target domain without compromising on the performance of the source domain. Our results show that we can adapt our source model to provide OWD prediction performance within 1-4 percentage points of the ideal scenario when the source and the target domains are the same. Also, our work is grounded in empirical experiments conducted within a 5G testbed, using commercially available hardware.

Dynamic resource allocation for network services is pivotal for achieving end-to-end management objectives. Previous research has demonstrated that Reinforcement Learning (RL) is a promising approach to resource allocation in networks, allowing to obtain near-optimal control policies for non-trivial system configurations. Current RL approaches however have the drawback that a change in the system or the management objective necessitates expensive retraining of the RL agent. To tackle this challenge, practical solutions including offline retraining, transfer learning, and model-based rollout have been proposed. In this work, we study these methods and present comparative results that shed light on their respective performance and benefits. Our study finds that rollout achieves faster adaptation than transfer learning, yet its effectiveness highly depends on the accuracy of the system model.

Intrusion detection systems (IDS) are crucial components in a defense strategy for IoT networks, as such networks have applicability in safety-critical environments such as healthcare, manufacturing, and smart cities, to name but a few. A promising approach is to train IDS models using machine learning (ML) with data from previous attacks. Unfortunately, the models are only as good as the data provided in the training, and often access to realistic attack data is limited. In this paper we focus on Blackhole attacks in low-power and lossy IoT networks. Specifically, we study the impact of Blackhole attack variations on a ML-based IDS. We implemented the variation strategies in the Cooja network simulator, with the objective to create new data sets and to quantity the impact of an attack variation on the network and IDS model performance. Our initial results show that variations of the Blackhole attack have a negative impact on the performance of the IDS, and thus, paves the way forward for further research on how attack variations and corresponding data set complexity can improve the performance of an IDS.

Network performance modeling using machine learning (ML) has proven to be essential for proactive network and service management. Dynamic changes and re-configurations in the network infrastructure can impact the data distribution, causing degradation in the performance of the deployed ML models. To adapt to such changes, traditional approaches suggest that the models must be updated using new labeled data from the operational network. Unfortunately, these labels can be costly or impossible to obtain.In this paper, we propose a customized approach named cDANN using domain adaptation to target these challenges for network performance modeling. We report on an empirical study where we evaluate the impact of labeled data availability, ranging from no available labels to a fully labeled data set. We specifically study scenarios for network performance modeling using two realistic data sets; one obtained from a cloud testbed environment and the other from a 5G - mm Wave testbed. Our results show that incorporating unlabeled samples reduces the need for costly collection of labeled data. The proposed method either radically improves or performs on par with the baselines.

In sliced networks, the shared tenancy of slices requires adaptive admission control of data flows, based on measurements of network resources. In this paper, we investigate the design of measurement-based admission control schemes, deciding whether a new data flow can be admitted and in this case, on which slice. The objective is to devise a joint measurement and decision strategy that returns a correct decision (e.g., the least loaded slice) with a certain level of confidence while minimizing the measurement cost (the number of measurements made before committing to the decision). We study the design of such strategies for several natural admission criteria specifying what a correct decision is. For each of these criteria, using tools from best arm identification in bandits, we first derive an explicit information-theoretical lower bound on the cost of any algorithm returning the correct decision with fixed confidence. We then devise a joint measurement and decision strategy achieving this theoretical limit. We compare empirically the measurement costs of these strategies, and compare them both to the lower bounds as well as a naive measurement scheme. We find that our algorithm significantly outperforms the naive scheme (by a factor 2 - 8).

A promising approach for leveraging the flexibility and mitigating the complexity of future telecom systems is the use of machine learning (ML) models that can analyze the network performance, as well as taking proactive actions. A key enabler for ML models is timely access to reliable data, in terms of features, which require pervasive measurement points throughout the network. However, excessive monitoring is associated with network overhead. Considering domain knowledge may provide clues to find a balance between overhead reduction and meeting requirements on future ML use cases by monitoring just enough features. In this work, we propose a method of unsupervised feature selection that provides a structured approach in incorporation of the domain knowledge in terms of policies. Policies are provided to the method in form of must-have features defined as the features that need to be monitored at all times. We name such family of unsupervised feature selection the policy-induced unsupervised feature selection as the policies inform selection of the latent features. We evaluate the performance of the method on two rich sets of data traces collected from a data center and a 5G-mmWave testbed. Our empirical evaluations point at the effectiveness of the solution.

Maintaining machine-learning models for prediction of service performance is challenging, especially in dynamic network and cloud environments where route changes occur, and execution environments can be scaled and migrated. Recently, transfer learning has been proposed as an approach for leveraging already learned knowledge in a new environment. The challenge is that the new environment may be significantly different from the one the model is trained in, and transferred from, with respect to data distributions and dimensionality.In this paper, we introduce heterogeneous transfer learning in the context of dynamic environments and show its efficiency in predicting service performance. We propose two heterogeneous transfer-learning approaches and evaluate them on several neural-network architectures and scenarios. The scenarios are a natural consequence of network and cloud infrastructure reorchestration. We quantify the transfer gain, and empirically show positive gain in a majority of cases for both approaches. Furthermore, we study the impact of neural-network configurations on the transfer gain, providing tradeoff insights. The evaluation of the approaches is performed using data traces collected from a cloud testbed that runs two services under multiple realistic load conditions.

ANIARA (https://www.celticnext.eu/project-ai-net) attempts to enhance edge architectures for smart manufacturing and cities. AI automation, orchestrated lightweight containers, and efficient power usage are key components of this three-year project. Edge infrastructure, virtualization, and containerization in future telecom systems enable new and more demanding use cases for telecom operators and industrial verticals. Increased service flexibility adds complexity that must be addressed with novel management and orchestration systems. To address this, ANIARA will provide en-ablers and solutions for services in the domains of smart cities and manufacturing deployed and operated at the network edge(s).

Data-driven functions for operation and management require measurements and readings from distributed data sources for model training and prediction. While the number of candidate data sources can be very large, research has shown that it is often possible to reduce the number of data sources significantly while still allowing for accurate prediction. Consequently, there is potential to lower communication and computing resources needed to continuously extract, collect, and process this data. We demonstrate the operation of a novel online algorithm called OSFS, which sequentially processes the collected data and reduces the number of data sources for training prediction models. OSFS builds on two main ideas, namely (1) ranking the available data sources using (unsupervised) feature selection algorithms and (2) identifying stable feature sets that include only the top features. The demonstration shows the search space exploration, the iterative selection of feature sets, and the evaluation of the stability of these sets. The demonstration uses measurements collected from a KTH testbed, and the predictions relate to end-to-end KPIs for network services.

Transfer learning has been proposed as an approach for leveraging already learned knowledge in a new environment, especially when the amount of training data is limited. However, due to the dynamic nature of future networks and cloud infrastructures, a new environment may differ from the one the model is trained and transferred from. In this paper, we propose and evaluate an approach based on neural networks for heterogeneous transfer learning that addresses model transfer between environments with different input feature sets, which is a natural consequence of network and cloud re-orchestration. We quantify the transfer gain, and empirically show positive gain in a majority of cases. Further, we study the impact of neural-network architectures on the transfer gain, providing tradeoff insights for multiple cases. The evaluation of the approach is performed using data traces collected from a testbed that runs a Video-on-Demand service and a Key-Value Store under various load conditions.

Learning performance models for network and cloud services is challenging due to the dynamics of the operational environment stemming from network changes, and scaling and migration decisions in the cloud. This requires exchange or adaptation of the models in order to maintain prediction accuracy over time. Approaches that incorporate previously acquired knowledge using transfer learning is a viable technique for timely and robust model adaptation, especially when the training data is limited. In this paper, we study the challenge of source selection in transfer learning for improved service performance prediction. We quantify the impact of different source domains on the accuracy of a target model in another domain. The evaluation is performed using data traces obtained from a testbed that runs a Video-on-Demand service and a Key-Value Store under various load conditions. We find that the choice of source domain can yield a transfer gain, and sometimes a substantial transfer penalty. To mitigate this, we propose and evaluate two source-selection approaches with the aim of selecting a source domain with relevant knowledge for the target domain. A key result is that such source selection should encourage source-domain diversity rather than domain similarity in scenarios with few samples in the target domain.

We predict the conditional distributions of service metrics, such as response time or frame rate, from infrastructure measurements in a networked environment. From such distributions, key statistics of the service metrics, including mean, variance, or quantiles can be computed, which are essential for predicting SLA conformance and enabling service assurance. We present and assess two methods for prediction: (1) mixture models with Gaussian or Lognormal kernels, whose parameters are estimated using mixture density networks, a class of neural networks, and (2) histogram models, which require the target space to be discretized. We apply these methods to a VoD service and a KV store service running on our lab testbed. A comparative evaluation shows the relative effectiveness of the methods when applied to operational data. We find that both methods allow for accurate prediction. While mixture models provide a general and elegant solution, they incur a very high overhead related to hyper-parameter search and neural network training. Histogram models, on the other hand, allow for efficient training, but require adjustment to the specific use case.

In this paper we describe and evaluate an approach for predicting conditional RTT probability distributions in an IoT system. From the distributions we derive conditional mean and quantiles, for example, which are essential for performance management and service assurance. The distribution is represented by a histogram, which requires a discretized target space, trained using supervised learning of a random forest classifier.We evaluate the approach using data traces obtained from experimentation in a realistic IoT testbed. The results show high model performance in prediction of quantiles and aggregated distributions, and the trends for conditional mean are captured.For the operator, the approach enables low-overhead and tractable IoT performance assessment, especially compared to traditional approaches using for example active measurements.

Estimation of user perceived quality of offered services, from massive number of Key Performance Indicator (KPI)'s that are measured in diverse components, has been a necessity for mobile network operators. The goal is first to have a good estimator for poor Quality of Experience (QoE), which can potentially be achieved with machine learning, and then pinpoint the features that are contributing to the poor performance. There is often a tradeoff between accuracy and interpretability of models. In this paper, we address this tradeoff by first developing a robust but complex teacher machine learning model to map the subjective Net Promoter Score (NPS) values computed from the user quality feedback to the underlying subset of KPI metrics. Next, we develop a rather interpretable student model supervised by the pre-trained teacher model. Eventually the compact student decision tree model learns to mimic the behavior of the teacher model with an at least 10 % improved accuracy in testset as compared to conventional way of directly training using the decision tree model. In the last step, we extract the rules and important influential features of the distilled student model.

Service assurance for cloud applications is a challenging task and is an active area of research for academia and industry. One promising approach is to utilize machine learning for service quality prediction and fault detection so that suitable mitigation actions can be executed. In our previous work, we have shown how to predict service-level metrics in real-time just from operational data gathered at the server side. This gives the service provider early indications on whether the platform can support the current load demand. This paper provides the logical next step where we extend our work by proposing an automated detection and diagnostic capability for the performance faults manifesting themselves in cloud and datacenter environments. This is a crucial task to maintain the smooth operation of running services and minimizing downtime. We demonstrate the effectiveness of our approach which exploits the interpretative capabilities of Self- Organizing Maps (SOMs) to automatically detect and localize different performance faults for cloud services.

Network operators are accustomed to use IP-layer active measurements for assessing end-to-end network performance and expect that new technology, such as IoT, provides similar means. This paper investigates the potential and also over-head associated with active measurements in IoT environments, with emphasis on the wireless part. An experimental approach provides insights into RTT accuracy for IoT devices, overhead in terms of energy consumption and network impact, and visualization of network-wide results for bottleneck localization.

Automated detection and diagnosis of the performance faults in cloud and datacenter environments is a crucial task to maintain smooth operation of different services and minimize downtime. We demonstrate an effective machine learning approach based on detecting metric correlation stability violations (CSV) for automated localization of performance faults for datacenter services running under dynamic load conditions.

Predicting resource requirements for cloud services is critical for dimensioning, anomaly detection and service assurance. We demonstrate a system for real-time estimation of the needed amount of infrastructure resources, such as CPU and memory, for a given service. Statistical learning methods on server statistics and load parameters of the service are used for learning a resource prediction model. The model can be used as a guideline for service deployment and for real-time identification of resource bottlenecks.

The popularity of container technologies and their widespread usage for building microservices demands solutions dedicated for efficient monitoring of containers and their interactions. In this paper we present ConMon, an automated system for monitoring the network performance of container-based applications. It automatically identifies newly instantiated application containers and observes passively their traffic. Based on these observations, it configures and executes monitoring functions inside adjacent monitoring containers. The system adapts the monitoring containers to changes driven by either the application or the execution platform. The evaluation results validate the feasibility of the ConMon approach and illustrate its scalability in terms of low overhead on compute resources, moderate impact on applications, and negligible impact on the background network traffic.

Determining an optimal placement for active measurement points in an arbitrary network topology is challenging. Software-defined infrastructure and the virtualization of network functions imply that re-optimized placement is needed frequently to keep up with dynamic changes in the infrastructure. We present a novel genetic algorithm that was defined for optimizing the placement of active measurement points in this environment. Initial results from simulations show that the method is effective and efficient in producing good solutions for four different topologies inspired from real networks. We also devised a strategy that enables faster reaction to incremental changes in the measured topology, reducing in half the execution time for two of the topologies.

Service assurance for the telecom cloud is a challenging task and is continuously being addressed by academics and industry. One promising approach is to utilize machine learning to predict service quality in order to take early mitigation actions. In previous work we have shown how to predict service-level metrics, such as frame rate for a video application on the client side, from operational data gathered at the server side. This gives the service provider early indications on whether the platform can support the current load demand. This paper extends previous work by addressing scalability issues for cluster-based services. Operational data being generated in large volumes, from several sources, and at high velocity puts strain on computational and communication resources. We propose and evaluate a distributed machine learning system based on the Winnow algorithm to tackle scalability issues, and then compare the new distributed solution with the previously proposed centralized solution. We show that network overhead and computational execution time is substantially reduced while maintaining high prediction accuracy making it possible to achieve real-time service quality predictions in large systems.

Predicting the performance of cloud services is intrinsically hard. In this work, we pursue an approach based upon statistical learning, whereby the behaviour of a system is learned from observations. Specifically, our testbed implementation collects device statistics from a server cluster and uses a regression method that accurately predicts, in real-time, client-side service metrics for a video streaming service running on the cluster. The method is service-agnostic in the sense that it takes as input operating-systems statistics instead of service-level metrics. We show that feature set reduction significantly improves prediction accuracy in our case, while simultaneously reducing model computation time. We also discuss design and implementation of a real-time analytics engine, which processes streams of device statistics and service metrics from testbed sensors and produces model predictions through online learning.

Active measurements tools transmit probe packets between a sender and a receiver to estimate performance metrics such as round-trip time, jitter and loss. In this paper we evaluate how KVM virtualization affects measurements of performance metrics, specifically the round-trip time (RTT). To understand the impact we investigate the interplay of various environment and measurement parameters with virtualization. A number of experiments are performed in order to investigate which parameters had major impact on the RTT. The paper shows that the measurements are affected by CPU load in the host as well as network load while I/O load seemed to have limited impact.

While real-time service assurance is critical for emerging telecom cloud services, understanding and predicting performance metrics for such services is hard. In this paper, we pursue an approach based upon statistical learning whereby the behavior of the target system is learned from observations. We use methods that learn from device statistics and predict metrics for services running on these devices. Specifically, we collect statistics from a Linux kernel of a server machine and predict client-side metrics for a video-streaming service (VLC). The fact that we collect thousands of kernel variables, while omitting service instrumentation, makes our approach service-independent and unique. While our current lab configuration is simple, our results, gained through extensive experimentation, prove the feasibility of accurately predicting client-side metrics, such as video frame rates and RTP packet rates, often within 10-15% error (NMAE), also under high computational load and across traces from different scenarios.

Predicting performance metrics for cloud services is critical for real-time service assurance. We demonstrate a platform for estimating real-time service-level metrics. Statistical learning methods on device statistics are used to predict metrics for services running on these devices.

Detecting and localizing performance degradations is a difficult problem that increases in importance as telecom network transition to all-packet equipment. Operators require solutions that are accurate in localization and do not impose large additional costs in terms of hardware deployment or manual labor for operations. Existing commercial solutions are generally difficult to operate, while many academic proposals typically require significant computational resources and are difficult to adapt to production networks. This paper describes a novel network fault localization algorithm based on active network measurements, probabilistic inference and change detection. The algorithm is computationally efficient for networks with thousands of nodes and requires few configuration parameters. Results obtained in a simulated environment on tree topologies show that the solution provides fast and accurate localization of performance degradations.

This paper presents a system for automating and integrating the provisioning and validation of Ethernet point-to-point connectivity services over transport networks. The provisioning is based on standard control plane functionality. The service performance is validated using the BART tool for measuring capacity, extended to provide Ethernet measurement capabilities. We report on preliminary results from a proof-of-concept system implemented in a virtualized testbed.

BART is a state-of-the-art active end-to-end bandwidth measurement method that estimates not only the available bandwidth but also the link capacity of the bottleneck link. It uses a Kalman filter to give estimates in real time during a measurement session. In this paper, we have studied the impact of 802.11 networks on the bandwidth estimates produced by BART. The Kalman filter used by BART is tunable, and one of the contributions of this paper is to show how the Kalman filter should be adjusted to improve real-time tracking and estimation accuracy when the bottleneck is an 802.11 link. Further, the paper contributes by discussing how to interpret the estimates produced by BART and similar bandwidth estimation tools relying on self-induced congestion when used in wireless scenarios. An analysis show that the BART estimates produced are correct - but corresponds to a fair share of the wireless link rather than to the unused capacity. However, the estimates do indicate how much bandwidth an application or device in the wireless network can expect when sending and/or receiving network traffic.

This paper presents a new method, BART (bandwidth available in real-time), for estimating the end-to-end available bandwidth over a network path. It estimates bandwidth quasi-continuously, in real-time. The method has also been implemented as a tool. It relies on self-induced congestion, and repeatedly samples the available bandwidth of the network path with sequences of probe packet pairs, sent at randomized rates. BART requires little computation in each iteration, is lightweight with respect to memory requirements, and adds only a small amount of probe traffic. The BART method uses Kalman filtering, which enables real-time estimation (a.k.a. tracking). It maintains a current estimate, which is incrementally improved with each new measurement of the inter-packet time separations in a sequence of probe packet pairs. The measurement model has a strong non-linearity, and would not at first sight be considered suitable for Kalman filtering, but we show how this non-linearity can be handled. BART may be tuned according to the specific needs of the measurement application, such as agility vs. stability of the estimate. We have tested an implementation of BART in a physical test network with carefully controlled cross traffic, with good accuracy and agreement. Test measurements have also been performed over the Internet. We compare the performance of BART with that of pathChirp, a state-of-the-art tool for measuring end-to-end available bandwidth in real-time