Abstract
Finding the root causes of network performance anomalies is critical to satisfy the quality-of-service requirements. In this paper, we introduce machine learning (ML) models to process TCP socket statistics to pinpoint underlying reasons of performance issues such as packet loss and jitter. More importantly, we introduce a novel feature engineering method to transform network-dependent metrics (e.g., total packet count and round-trip time) in training datasets into network independent forms to be able to transfer the models to new network settings without requiring retraining them. Experimental results in various network settings show that the proposed feature engineering approach improves the performance of the models in previously unseen network settings from around 60% to nearly 90%. We believe ability to transfer ML models across networks will pave the way for wide adoption of ML solutions in production networks where collecting labeled data is not possible.
Recommended Citation
M. Arifuzzaman et al., "Towards Generalizable Network Anomaly Detection Models," 2021 IEEE 46th Conference on Local Computer Networks (LCN), Institute of Electrical and Electronics Engineers, Oct 2021.
The definitive version is available at https://doi.org/10.1109/lcn52139.2021.9525015
Department(s)
Computer Science
Keywords and Phrases
Transfer Learning, Feature Transformation, Network Anomaly Detection, Random Forest
Document Type
Article - Conference proceedings
Document Version
Citation
File Type
text
Language(s)
English
Rights
© 2024 Institute of Electrical and Electronics Engineers, All rights reserved.
Publication Date
04 Oct 2021
