A computer-implemented method for training a regression model

Abstract

There is provided a computer-implemented method (400) for training a first regression model to generate time-series data representing one or more key performance indicators in a communication network at one or more time points. The method comprises obtaining (402), from a network node in the communication network, first time-series data representing the one or more KPIs at a first one or more past time points. The method further comprises deriving (404), from the first regression model, a plurality of regression models, wherein each of the plurality of regression models is a respective variant of the first regression model. The method further comprises generating (406), for each of the plurality of regression models, one or more adversarial samples. The method further comprises training (408) the first regression model based on the generated adversarial samples and the first time-series data.

Description

[0001] A COMPUTER-IMPLEMENTED METHOD FOR TRAINING A REGRESSION MODEL

[0002] TECHNICAL FIELD

[0003] 5 The present disclosure relates to a computer-implemented method for training a first regression model to generate time-series data representing one or more key performance indicators (KPIs) in a communication network at one or more time points. The present disclosure also relates to a network node, a computer program and a computer program product.

[0004] BACKGROUND

[0005] As Machine Learning (ML) technologies rapidly advance, their integration into various products is becoming increasingly prevalent. One significant concern for this Al-driven

[0006] 15 evolution is the security of Al systems.

[0007] Previous work has highlighted the vulnerability of Al systems to adversarial attacks. A substantial portion of the data in telecommunications networks is time-series data, and forecasting models may be used for various telecommunications applications, such as

[0008] 20 predicting optimal times for network site software upgrades. Previous work has successfully mitigated white-box adversarial attacks on a traffic forecasting model using adversarial learning, enhancing the performance of the model and reducing attack accuracy in the specific use-case of automatic software upgrade.

[0009] 25 White-box adversarial attacks on time series classification models have also been studied. For example, in (Karim, Fazle, Somshubra Majumdar, and Houshang Darabi. "Adversarial attacks on time series." IEEE transactions on pattern analysis and machine intelligence 43.10 (2020): 3309-3320), the use of an Adversarial Transformation Network (ATN) for attacking time series classification models is discussed. This approach includes training methodology considerations, such as using knowledge distillation for training a student neural network, and evaluating the performance of the adversarial model on different types of datasets.

[0010] However, in real-world applications, it is often impractical to make white-box

[0011] 35 assumptions. White-box attack scenarios, where the attacker has complete knowledge of the model's architecture and training data, are often considered unrealistic in practical applications. In real-world settings, especially in sensitive domains such as the telecom domain, access to such detailed information about Al systems is typically restricted to protect against malicious activities.

[0012] There is growing concern about black-box attacks, where attackers do not have access to the internal properties of a model. Black-box attacks represent a different spectrum of threats, as they exploit the input-output relationship of a model without knowledge of the architecture of the model, or the data used to train the model. This obscurity makes it challenging to predict and understand attack strategies that could be employed, thereby complicating the development of effective defences against such attacks. Such attacks can significantly impact forecasting models, especially in critical applications such as network traffic forecasting for scheduling software upgrades.

[0013] The following types of black box attacks have been observed. One example is an input manipulation attack ("ML01 :2023 Input Manipulation Attack." OWASP Machine Learning Security Top Ten 2023, OWASP Foundation, 2023, https: / / owasp.org / www-project- machine-learning-security-top-10 / docs / ML01_2023-lnput_Manipulation_Attack*).

[0014] These attacks involve subtly altering the input data in a way that leads to incorrect predictions by a model, without needing to understand the internal structure of the model. Another example is a model inversion attack ("Simple Black-box Adversarial Attacks." ar5iv, 2023, https: / / ar5iv.org / html / 1905.07121). In this example, an attacker uses the model's outputs to infer sensitive information about the data the model was trained on, without direct access to the internals of the model. Protecting against such model inversion attacks, while ensuring the confidentiality of sensitive data, is a complex issue. Another example is a transferability attack ("Simple Black-box Adversarial Attacks." ar5iv, 2023, https: / / ar5iv.org / html / 1905.07121). In these attacks, adversarial examples, created using one model (which the attacker has access to), are used to attack another model (to which the attacker does not have access), by exploiting similarities in the model’s learning patterns. This phenomenon of transferability, where adversarial examples developed for one model are effective against another model, is problematic in environments where multiple forecasting models are used, as it allows attackers to exploit one model to compromise another.

[0015] Black box attacks on time series classification models have also been studied. In Ding, Daizong, et al. "Black-box adversarial attack on time series classification." Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 37. No. 6. 2023, a method to attack time series classification models with local perturbations is presented. In this research, the focus is on a more realistic black-box setting for adversarial attacks on time series classification (TSC) using deep neural networks. The approach involves theoretical analysis of estimating a black-box gradient, dealing with a non-convexity of TSC models, and constructing adversarial samples with limited perturbations. Yang et al. (Yang, Wenbo, et al. "TSadv: Black-box adversarial attack on time series with local perturbations." Engineering Applications of Artificial Intelligence 114 (2022): 105218) introduce a black-box adversarial attack on a time series with local perturbations, which focuses on black-box adversarial attacks on time series classification data. This research emphasizes the development of adversarial attacks that involve local perturbations, a technique that can be particularly relevant for time series data where global changes might be easily detectable or unrealistic. Detecting these subtle manipulations in time series data, which often contains complex patterns and noise, is particularly challenging, making it difficult to mitigate these input manipulations.

[0016] The studies described above illustrate the sophistication and variety of existing blackbox adversarial strategies and emphasise the need for robust defence mechanisms against such attacks. Practical limitations, such as the need for real-time responses in forecasting applications and limited computational resources, make implementing sophisticated defences against black-box attacks challenging in real-world settings. Furthermore, most existing defence mechanisms against black-box attacks have been developed for domains such as image and text processing. There is a notable gap in defences specifically designed for time series forecasting models. There has been little research on black-box adversarial attacks on time series forecasting models, and the effects of said attacks.

[0017] SUMMARY

[0018] One object of the present disclosure is to improve the performance of a regression model (for example, a KPI forecasting model), both in the presence of an adversarial attack, and in the absence of an adversarial attack.

[0019] According to a first aspect of the present disclosure, there is provided a computer- implemented method for training a first regression model to generate time-series data representing one or more key performance indicators (KPIs) in a communication network at one or more time points. The method comprises obtaining, from a network node in the communication network, first time-series data representing the one or more KPIs at a first one or more past time points. The method further comprises deriving, from the first regression model, a plurality of regression models, wherein each of the plurality of regression models is a respective variant of the first regression model. The method further comprises generating, for each of the plurality of regression models, one or more adversarial samples. The method further comprises training the first regression model based on the generated adversarial samples and the first time-series data.

[0020] According to another aspect of the present disclosure, there is provided a computer program product comprising a computer readable storage medium. The computer readable storage medium comprises instructions which are executable by processing circuitry to cause a network node to perform a method according to any one or more of the aspects or examples of the present disclosure.

[0021] According to another aspect of the present disclosure, there is provided a computer program. The computer program comprises instructions which, when executed by processing circuitry, cause the processing circuitry to perform a method according to any one or more of the aspects or examples of the present disclosure.

[0022] According to another aspect of the present disclosure, there is provided a network node. The network node comprises processing circuitry configured operate in accordance with the first aspect.

[0023] Aspects of the present disclosure thus provide a method and a node that address the vulnerability of regression models to black box adversarial attacks. Examples of the present disclosure address this vulnerability through the generating of adversarial samples (that are designed to induce a regression model into generating incorrect predictions), and training the regression model based on these generated adversarial samples. In this manner, the regression model is exposed to a range of adversarial conditions (represented by the adversarial samples) in the training stage, which allows the regression model to learn how to mitigate adversarial attacks. Aspects of the present disclosure also provide a method and a node that improve the performance of a regression model even in the absence of an adversarial attack. Examples of the present disclosure improve this performance through the adversarial training of the regression model. The inclusion of adversarial samples in the training dataset for the regression model increases the amount of data that the regression model is being trained on, improving the performance of the regression model both in the presence of, and the absence of, an adversarial attack.

[0024] BRIEF DESCRIPTION OF THE FIGURES

[0025] For a better understanding of the present disclosure, and to show more clearly how it may be carried into effect, reference will now be made, by way of example, to the following drawings in which:

[0026] Figure 1 shows a normalised traffic KPI calculated for a selected cells for a period of 6 days;

[0027] Figure 2 shows a process for evaluating the transferability of a black box attack;

[0028] Figure 3 shows an example adversarial sample generation process;

[0029] Figure 4 is a flow chart illustrating process steps in a computer implemented method for training a first regression model to generate time-series data representing one or more key performance indicators in a communication network at one or more time points;

[0030] Figures 5a to 5d show a flow chart illustrating process steps in a computer implemented method for training a first regression model to generate time-series data representing one or more key performance indicators in a communication network at one or more time points;

[0031] Figure 6 is a block diagram illustrating an example network node;

[0032] Figure 7 illustrates a computer program product; and

[0033] Figure 8 shows a process for training a forecasting model with Ensemble Adversarial Training (EAT).

[0034] DETAILED DESCRIPTION

[0035] Generally, all terms used herein are to be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is clearly given and / or is implied from the context in which it is used. All references to a / an / the element, apparatus, component, means, step, etc. are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless a step is explicitly described as following or preceding another step and / or where it is implicit that a step must follow or precede another step. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, wherever appropriate. Likewise, any advantage of any of the embodiments may apply to any other embodiments, and vice versa. Other objectives, features and advantages of the enclosed embodiments will be apparent from the following description.

[0036] Some of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. Other embodiments, however, are contained within the scope of the subject-matter disclosed herein, the disclosed subject-matter should not be construed as limited to only the embodiments set forth herein; rather, these embodiments are provided by way of example to convey the scope of the subject-matter to those skilled in the art.

[0037] In some instances, detailed descriptions of well-known methods, entities, interfaces, circuits, and devices are omitted so as not obscure the description with unnecessary detail. Those skilled in the art will appreciate that the functions described may be implemented in one or more entities using hardware circuitry (e.g., analogue and / or discrete logic gates interconnected to perform a specialized function, ASICs, PLAs, etc.) and / or using software programs and data in conjunction with one or more digital microprocessors or general purpose computers. Entities that communicate using the air interface also have suitable radio communications circuitry. Moreover, where appropriate the technology can additionally be considered to be embodied entirely within any form of computer-readable memory, such as solid-state memory, magnetic disk, or optical disk containing an appropriate set of computer instructions that would cause a processor to carry out the techniques described herein.

[0038] Embodiments of the present disclosure propose methods for training a first regression model to generate time-series data representing one or more key performance indicators (KPIs) in a communication network at one or more time points. The proposed methods address the challenges described above, that is, the vulnerability of regression models to black box adversarial attacks. These challenges are addressed through the generating of adversarial samples (that are designed to induce a regression model into generating incorrect predictions), and training the regression model based on these generated adversarial samples. In this manner, the regression model is exposed to a range of adversarial conditions (represented by the adversarial samples) in the training stage, which allows the regression model to learn how to mitigate adversarial attacks.

[0039] An example of how an ensemble of adversarial samples may be generated, and how said ensemble of adversarial samples may be used to evaluate the resilience of a forecasting model, is now described for the specific use case of traffic forecasting. In this example, the impact of the adversarial samples on the predictions generated by the base forecasting model is assessed. The base model is treated as a black box, which means that a potential attacker would have no knowledge of its architecture, parameters, or the specifics of its training data. The assessment is solely based on the model's input-output relationship, mimicking a real-world situation where an attacker would aim to exploit the model without internal knowledge.

[0040] In this example, data is firstly obtained from a communication network (for example, from a network node in the communication network). In this example, the obtained data comprises Radio Access Network (RAN) data, such as Performance Management (PM) data. The PM data is time-series data that may be used to gauge base-station observability. The PM data is recorded in ROP files, which are obtained every ROP (15 minutes). In this example, data is collected from 100 randomly selected cells in the communication network over a period of 2 months. Figure 1 shows a normalised traffic KPI calculated for one of these selected cells for a period of 6 days.

[0041] Figure 2 shows a process for evaluating the transferability of a black box attack. Firstly, an ensemble of forecasting models 202a, 202b, 202c, ... 202n is created. The ensemble of forecasting models comprises multiple variants of the forecasting model that may be selected by an attacker. In this example, each variant in the ensemble is a Long Short- Term Memory (LSTM) model. A LSTM model is a type of recurrent neural network (RNN) known for its ability to remember long-term dependencies, making it particularly suited for time-series forecasting tasks. Each of the LSTM models in the ensemble are designed with unique architectural nuances and are trained on different subsets of data, such that the ensemble encapsulates a diverse range of learning patterns and predictive behaviours. In this example, the variant LSTM models are individualized through the alteration of parameters such as the number of layers, hidden units, dropout rates, and learning rates, as well as through the use of different activation functions and optimization algorithms. By varying these elements, each model in the ensemble exhibits particular strengths and weaknesses in terms of prediction. This then enables the ensemble to subsequently generate a comprehensive set of adversarial samples, as explained in greater detail below.

[0042] Table 1 shows the different configurations of each of the variant forecasting models in this example.

[0043] Table 1

[0044] The results for the average mean squared error (MSE) for the set of ensemble models for a testing dataset is shown in Table 2. The results show that each variant model respectively generates accurate predictions, and thus shows the good performance of each variant model.

[0045] Table 2 An ensemble of adversarial samples 204a, 204b, 204c, ... 204n is then generated, with the aim of challenging the robustness of the deployed forecasting model. In this example, the ensemble of adversarial samples is generated by utilizing a Fast Gradient Sign Method (FGSM) (Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. "Explaining and harnessing adversarial examples." arXiv preprint arXiv: 1412.6572 (2014)). FGSM is utilized across the ensemble of LSTM models. FGSM is an adversarial technique designed to perturb input data in a manner that maximizes the prediction error of a machine learning model. The FGSM has a critical parameter, epsilon, which controls the level of perturbation. In this example, the value of epsilon is 0.05. However, it will be appreciated that, in other examples (for example, in different applications and / or use cases, with different forecasting models), the value of epsilon may be varied as appropriate. By virtue of how the samples are generated, no knowledge of the base model is assumed.

[0046] For each LSTM variant, a distinct set of adversarial samples is produced. These samples are created by introducing small but strategically calculated perturbations to the input data. These perturbations are designed to be imperceptible, or at the very least, to not alter the underlying true patterns that the data represents. However, the perturbations are potent enough to deceive the LSTM model into making incorrect predictions, thereby revealing the model’s susceptibilities.

[0047] In the generation of adversarial samples using the FGSM, the perturbations are derived from the gradient of the loss with respect to the input features, which effectively determines the direction in which the input should be altered so as to maximize the forecasting model's prediction error. In this example, the process of selecting these perturbations involves the following steps:

[0048] In a first step, the gradient of the loss function with respect to the input data is computed. This gradient, VxJ(x, ytrue), indicates the direction in which the input x should be modified in order to increase the loss, where x represents the input features, and ytrue is the correct label.

[0049] In a second step, the sign of the gradient is taken to determine the direction of the perturbation. The use of the gradient sign simplifies the computation and ensures that the perturbations are small but effective enough to mislead the model, while maintaining the perceptual quality of the input data.

[0050] In a third step, the perturbation is calculated as exsign(VxJ(x, ytrue)), where e is a small scalar value that controls the magnitude of the perturbation. This scalar is the critical hyperparameter in FGSM, and in this example, is set to 0.05. In this example, this value was empirically chosen to ensure that the perturbations are effective in inducing misclassifications, while being small enough to keep the adversarial samples within the distribution of legitimate samples in this particular traffic forecasting use case.

[0051] In a fourth step, the adversarial examples are created by adding the calculated perturbations to the original input data: x'=x+€xsign(VxJ(x, ytrue)). This results in new input samples that are only slightly different from the original ones, but are expected to induce incorrect model predictions.

[0052] The FGSM approach ensures that the perturbations are neither arbitrary nor random, but are instead precisely generated so as to probe the model's weaknesses effectively.

[0053] The resulting ensemble of adversarial samples are then stacked together. The ensemble of adversarial samples serves as a comprehensive test suite for evaluating the resilience of the deployed forecasting model. Inputting the stacked ensemble of adversarial samples 206 to the base forecasting model 208 enables the attack’s transferability to be evaluated, and any resulting performance deterioration of the model due to the attack to be evaluated. By systematically exposing the deployed forecasting model to a diverse range of adversarial conditions (as represented by the ensemble of adversarial samples), the defensive capabilities of the deployed forecasting model can be better understood.

[0054] In this example, for each of the 100 models for each node, 6 variant forecasting models are created. For each variant model, 144 adversarial samples are then created to test transferability of the attack. As such 100 x 6 x 144 = 86400 adversarial samples are created over the period of 2 weeks for the 100 nodes of interest.

[0055] Figure 3 shows an example adversarial sample generation process. In this particular use case, for each node, there are M variant models. For each variant model, there are K adversarial samples. The total number of adversarial samples generated for the blackbox attack is therefore N x M x K, where in this example N=100, M=6 and K=144.

[0056] The stack of adversarial test samples 206 is then input to the base model 208, and the performance 210 of the base model 208 is assessed. This is done to observe the effectiveness of the adversarial samples in disrupting the model's output, essentially to test if the perturbations created for the variants can mislead the base model as well. This step tests the black-box transferability on the base forecasting model and tests the vulnerability of the model to an adversarial attack.

[0057] In this example, to quantitatively measure the impact of these adversarial attacks on the forecasting model, various regression metrics are employed. These metrics include the Mean Squared Error (MSE), the Root Mean Squared Error (RMSE), the Mean Absolute Error (MAE), and the coefficient of determination R2.

[0058] The quantitative impact of the black-box adversarial attacks on the base forecasting model is shown in Table 3.

[0059] Table 3

[0060] The evaluation of the robustness of the deployed forecasting model to black-box adversarial attacks reveals a substantial decrease in model performance in the presence of a black-box adversarial attack, with the Mean Squared Error (MSE) almost doubling and the R2value downgrading from -2.596775 to -45.34391. These metrics indicate a significant loss in the predictive accuracy of the model post-attack. These results highlight the vulnerability of the model to adversarial manipulation, and suggest a need to develop and incorporate defence mechanisms to improve the resilience of forecasting models against such attacks, such that said forecasting models to maintain their reliability and accuracy in the presence of such attacks.

[0061] The proposed methods address the challenge of mitigating the risk of black-box attacks on traffic forecasting models. The challenges are addressed through training a regression model (such as a forecasting model) using Ensemble Adversarial Training (EAT). EAT is one method that aims to mitigate black-box attacks. Ensemble Adversarial Training (EAT) is a technique that enhances the robustness of machine learning models, particularly focusing on a base model, by training it with adversarial examples generated from an ensemble of model variants (such as LSTM-based variants). While EAT has been previously introduced by Ian Goodfellow et al. (Tramer, Florian, et al. "Ensemble adversarial training: Attacks and defenses." arXiv preprint arXiv: 1705.07204 (2017)), its application has largely been confined to image processing, particularly on the ImageNet dataset.

[0062] Embodiments of the present disclosure propose the use of EAT for time-series forecasting models, particularly in the context of network traffic prediction.

[0063] Figure 4 is a flow chart illustrating process steps in a computer implemented method 400 for training a first regression model to generate time-series data representing one or more key performance indicators (KPIs) in a communication network at one or more time points. The first regression model may be trained to generate (or predict) time-series data representing one or more key performance indicators in a communication network at one or more future time points, based on time-series data representing the one or more KPIs at a one or more past time points. For example, the first regression model may be trained to forecast future traffic volume in the communications network, based on previous traffic volume in the communications network.

[0064] In the context of the present disclosure, a past (or historical) time point is a time point that is in the past with respect to performance of the method, that is, a time point that occurs at any time before a time instant at which a current iteration of the method is performed. A future time point is a time point that is in the future with respect to performance of the method, that is, a time point that occurs at any time after a time instant at which a current iteration of the method is performed. The method may be performed by a network node, which may comprise a physical or virtual node, and may be implemented in a computer system, computing device or server apparatus and / or in a virtualized environment, for example in a cloud, edge cloud, an Open Radio Access Network, O-RAN, or fog deployment. The network node may for example be instantiated in an rApp of an O-RAN architecture. Examples of a virtual node may include a piece of software or computer program, a code fragment operable to implement a computer program, a virtualised function, or any other logical entity. The network node may for example be implemented in a core network of a communication network, or in a RAN. The communication network may for example comprise an LTE network, a New Radio (NR) network or any other existing or future communication network systems, and the network node may be implemented in a core network node, or in a Radio Access node, which itself may comprise a physical node and / or a virtualized network function that is operable to exchange wireless signals. In some examples, a Radio Access node may comprise a base station node such as a NodeB, eNodeB, gNodeB, or any future implementation of this functionality. The network node may encompass multiple logical entities, as discussed in greater detail below, and may for example comprise a Virtualised Network Function (VNF). In other examples, the network node may be instantiated in a physical or virtual server in a centralised or cloud based deployment.

[0065] Referring to Figure 4, the method 400 comprises, in a first step 402, obtaining, from a network node in the communication network, first time-series data representing the one or more KPIs at a first one or more past time points.

[0066] The network node in the communication network may comprise a node that is operable to transmit, receive, process and / or orchestrate wireless signals. The network node may comprise a physical node and / or a virtualized network function. The term network node may therefore refer to Long Term Evolution (LTE) or New Radio (NR) technology and may be one of eNB, gNB, en-gNB, ng-eNB, CU-CP, CU-UP, DU, gNB-CU, gNB-DU, gNB-CU-UP, gNB-CU-CP, eNB-CU, eNB-DU, eNB-CU-UP, eNB-CU-CP, or any future implementation of the above discussed functionality.

[0067] In the context of the present disclosure, time-series data may comprise information that enables the one or more key performance indicators (KPIs) to be determined at the one or more time points, or may comprise the one or more key performance indicators (KPIs) themselves at the one or more time points. In some examples, the first time-series data may comprise RAN data and / or performance management data obtained for and / or measured at each of the first one or more past time points.

[0068] In step 404, the method 400 comprises deriving, from the first regression model, a plurality of regression models, wherein each of the plurality of regression models is a respective variant of the first regression model.

[0069] Each of the plurality of regression models may be derived from the first regression model by altering one or more parameters of the first regression model, for example, by altering one or more of a hidden size of the first regression model and / or a number of layers of the first regression model. Additionally or alternatively, each of the plurality of regression models may be derived from the first regression model by training a new iteration of the first regression model using one or more of a different dropout rate, a different learning rate and / or a different optimisation algorithm than that initially used to train the first regression model. Each of the plurality of regression models may therefore be individualised through said alteration of these parameters and / or training methods. Each of the variant models may therefore feature unique architectural nuances and / or be trained on different subsets of data in order to encapsulate a diverse range of learning patterns and predictive behaviours across the variant models as a whole. The ensemble of variant models can capture a broader spectrum of data features and potential anomalies in comparison to a single model, and therefore can be used generate a comprehensive set of adversarial samples in step 606, that represent a diverse range of adversarial conditions that the first regression model may be exposed to in deployment. This diverse set of adversarial samples may then be used to provide a more robust defence mechanism against adversarial attacks, as explained in greater detail below.

[0070] In step 406, the method 400 comprises generating, for each of the plurality of regression models, one or more adversarial samples.

[0071] An adversarial sample is a sample which causes a respective regression model, on receiving the adversarial sample as an input, to generate incorrect predictions. In this example, an adversarial sample (generated for the respective regression model) will cause the respective regression model to incorrectly predict time-series data for a future one or more time points. In the context of the present disclosure, an “incorrect prediction” or an “incorrect generation” refers to predicted or generated time-series data which has an associated performance metric which fails to exceed a threshold. In other words, the accuracy of the incorrectly generated or predicted time-series data fails to exceed a threshold.

[0072] As noted above, each of the plurality of regression models will exhibit unique strengths and weaknesses in terms of the predictions it is able to generate. In some examples, the one or more adversarial samples for each variant model may be generated so as to effectively probe the weaknesses of that variant model (that is, generated so as to induce the particular variant model into generating incorrect predictions), as explained in greater detail with reference to Figure 5.

[0073] By generating one or more adversarial samples for each of the variant models, where each adversarial sample is generated so as to induce the respective variant model into generating incorrect predictions, the generated adversarial samples (as a whole) will therefore represent a diverse range of adversarial conditions that the first regression model may be exposed to in deployment.

[0074] In step 408, the method 400 comprises training the first regression model based on the generated adversarial samples and the first time-series data.

[0075] In some examples, the generated adversarial samples are incorporated into a training data set that was used to train a previous iteration of the first regression model. It will be appreciated that training the first regression model with both the original (first) time-series data and the adversarial examples will enhance the exposure of the first regression model to a variety of perturbations (represented by the adversarial samples). These perturbations may be present, or may be similar to perturbations that would be included, in the input data provided to the first regression model in an adversarial attack.

[0076] Therefore, the method 400 enables the first regression model to be trained using both the first time-series data and the generated adversarial examples, allowing the first regression model to learn to predict accurate time-series data in the presence of adversarial input data. Training the first regression model in this manner enables the first regression model to learn how to mitigate black-box attacks. The method 600 may therefore enable the first regression model to perform in real-world conditions, and maintain its accuracy and reliability in the presence of an adversarial attack. The method 600 may also improve the performance of the first regression model in the absence of an adversarial attack, as explained in greater detail below. Figures 6a to 6d show a flow chart illustrating another example of a computer- implemented method 600 for training a first regression model to generate time-series data representing one or more key performance indicators (KPIs) in a communication network at one or more time points. As for the method 600 discussed above, the method 600 may be performed by a network node, which may comprise a physical or virtual node, and may be instantiated substantially as discussed above with reference to the method 400. The method 600 illustrates examples of how the steps of the method 400 may be implemented and supplemented to provide the above discussed and additional functionality.

[0077] Referring initially to Figure 5a, in step 502, the method 500 comprises obtaining, from a network node in the communication network, first time-series data representing the one or more KPIs at a first one or more past time points.

[0078] As illustrated at 502a, in some examples, the one or more KPIs may comprise one or more of: a traffic volume, a Reference Signals Received Power (RSRP), a Reference Signal Received Quality (RSRQ), a number of active user equipments (UEs) in the downlink direction, and a number of active UEs in the uplink direction.

[0079] As illustrated at 502b, and explained above, in some examples, the time-series data may comprise performance management data and / or radio access network data.

[0080] Referring now to Figure 5b, in step 504, the method 500 comprises deriving, from the first regression model, a plurality of regression models, wherein each of the plurality of regression models is a respective variant of the first regression model.

[0081] As illustrated at 504a, in some examples, each of the plurality of regression models may respectively comprise one or more of: a different hidden size to the first regression model, and a different number of layers to the first regression model. As illustrated at 504b, in some examples, deriving the plurality of regression models may comprise, for each of the plurality of regression models, forming a subset of the first time-series data, and training the regression model using the subset of the first time-series data. As illustrated at 504c, in some examples, deriving the plurality of regression models may comprise, for each of the plurality of regression models, training the regression model using one or more of: a learning rate that differs to a first learning rate used to initially train the first regression model, a dropout rate that differs to a first dropout rate used to initially train the first regression model, an optimization algorithm that differs to a first optimization algorithm used to initially train the first regression model.

[0082] As noted above, varying such properties, training datasets and / or training processes for each of the plurality of regression models will result in each respective variant model exhibiting unique strengths and weaknesses in terms of the predictions it is able to generate. As adversarial samples may then be generated for each of the plurality of regression models, where these adversarial samples probe the different weaknesses present in each of the different variant models, the plurality of regression models as a whole can be utilised to generate a comprehensive set of adversarial samples. This set of adversarial samples may represent a diverse range of adversarial conditions that the first regression model may be exposed to in an adversarial attack.

[0083] As illustrated at 504d, in some examples, the first regression model, and the plurality of regression models, are temporal neural networks. As illustrated at 504e, in some examples, the first regression model, and the plurality of regression models, are recurrent neural networks. Temporal neural networks may be any artificial neural network with temporal characteristics, such as allowing the output from some nodes to affect subsequent input to the same nodes. Recurrent neural networks are an exemplification of temporal neural networks.

[0084] As illustrated at 504f, in some examples, the first regression model and the plurality of regression models are Long Short-Term Memory (LSTM) models.

[0085] Referring now to Figure 5c, in step 506, the method 500 comprises generating, for each of the plurality of regression models, one or more adversarial samples.

[0086] As illustrated at 506a, in some examples, the adversarial samples may be generated based on the first time-series data. As illustrated at 506b, in some examples, generating the one or more adversarial samples for a respective regression model may comprise perturbing the first time-series data to generate the one or more adversarial samples.

[0087] In some examples, perturbing the first time-series data may comprise introducing perturbations into the first time-series data that are imperceptible by the variant model, or that do not alter an underlying true pattern that the first-time series data represents. However, the introduced perturbations are significant enough so as to cause the variant model to generate incorrect predictions, thereby revealing the susceptibilities of the model.

[0088] As illustrated at 506c, in some examples, the one or more adversarial samples for a respective regression model may be generated using a Fast Gradient Sign Method (for example, the FGSM described above). The FGSM may generate perturbations to be introduced into the first-time series data, so as to generate the one or more adversarial samples. Utilising the FGSM approach may enable perturbations to be generated that are neither arbitrary nor random, but instead are precisely generated to probe a model's weaknesses effectively.

[0089] As illustrated in 506d and described above, in some examples, on receiving the one or more adversarial samples as an input, the respective regression model may generate time-series data, wherein a performance metric of the generated time-series data fails to exceed a threshold.

[0090] In step 508, the method 500 comprises training the first regression model based on the generated adversarial samples and the first time-series data.

[0091] Referring now to Figure 5d, in step 510, the method 500 may comprise determining a performance metric of the trained first regression model. The performance of the trained first regression model may be evaluated based on the determined performance metric. In some examples, the performance metric may comprise one or more of a Mean Squared Error (MSE), a Root Mean Squared Error (RMSE), a Mean Absolute Error (MAE) and a coefficient of determination R2. The performance metric may indicate an accuracy of the model (that is, how accurate the predictions generated by the model are).

[0092] In step 512, the method 500 may comprise deploying the trained first regression model in a network node of the communication network. Step 512 may occur after analysing the performance of the trained first regression model, to ensure that the first regression model is robust against black box transferability attacks prior to deployment. The performance of the deployed trained first regression model may then be monitored, to ensure that the model continues to remain robust against black box transferability attacks. In step 514, the method 500 may comprise executing the trained first regression model to generate time-series data representing the one or more KPIs at one or more time points, based on time-series data representing the one or more KPIs at one or more past time points.

[0093] Therefore, the method 500 enables the first regression model to be trained using both the first time-series data and the generated adversarial examples, allowing the first regression model to learn to predict accurate time-series data in the presence of adversarial input data. Training the first regression model in this manner enables the first regression model to learn how to mitigate black-box attacks. The method 700 may therefore enable the first regression model to perform in real-world conditions, and maintain its accuracy and reliability in the presence of an adversarial attack. The method 700 may also improve the performance of the first regression model in the absence of an adversarial attack, as explained in greater detail below.

[0094] As discussed above, the methods 400 and 500 may be performed by a network node, and the present disclosure provides a network node that is adapted to perform any or all of the steps of the above discussed methods. The network node may comprise a physical node such as a computing device, server etc., or may comprise a virtual node. A virtual node may comprise any logical entity, such as a Virtualized Network Function (VNF) which may itself be running in a cloud, edge cloud or fog deployment. The network node may be operable to be instantiated in a cloud based deployment, as an rApp, in a physical or virtual radio access node, control network node, etc.

[0095] Figure 6 is a block diagram illustrating an example network node 400 which may implement the method 400 and / or 500, as illustrated in Figures 4 and 5a to 5d, according to examples of the present disclosure, for example on receipt of suitable instructions from a computer program 650. Referring to Figure 6, the network node 600 comprises a processor or processing circuitry 602, and may comprise a memory 604 and interfaces 606. The processing circuitry 602 is operable to perform some or all of the steps of the method 400 and / or 500 as discussed above with reference to Figures 4 and 5a to 5d. The memory 604 may contain instructions executable by the processing circuitry 602 such that the network node 600 is operable to perform some or all of the steps of the method 400 and / or 500 as discussed above with reference to Figures 4 and 5a to 5d. The instructions may also include instructions for executing one or more telecommunications and / or data communications protocols. The instructions may be stored in the form of the computer program 650. In some examples, the processor or processing circuitry 602 may include one or more microprocessors or microcontrollers, as well as other digital hardware, which may include digital signal processors (DSPs), special-purpose digital logic, etc. The processor or processing circuitry 602 may be implemented by any type of integrated circuit, such as an Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) etc. The memory 604 may include one or several types of memory suitable for the processor, such as read-only memory (ROM), random-access memory, cache memory, flash memory devices, optical storage devices, solid state disk, hard disk drive, etc.

[0096] Figure 7 illustrates a computer program product 702 according to an embodiment. More specifically, there is provided a computer program product 702 comprising a computer readable storage medium 704. The computer readable storage medium 704 comprises instructions (e.g. computer program 706) which are executable by processing circuitry (such as the processing circuitry 602 of the network node 600 described herein) to cause the network node 600 to perform the methods described herein in respect of the network node 600. There is provided a computer program product 702 comprising a carrier 704 containing instructions (e.g. computer program 706) for causing the network node 600 (e.g. the processing circuitry 602 of the network node 600 described herein) to perform at least part of the methods described herein. In some embodiments, the carrier 704 can be any one of an electronic signal, an optical signal, an electromagnetic signal, an electrical signal, a radio signal, a microwave signal, or a computer-readable storage medium.

[0097] There is also provided a computer program 706 comprising instructions which, when executed by processing circuitry (such as the processing circuitry 702 of the network node 700 described herein), cause the processing circuitry to perform at least part of the methods described herein.

[0098] Figures 4 and 5a to 5d discussed above provide an overview of methods which may be performed according to different examples of the present disclosure. These methods may be performed by a network node, as illustrated in Figure 6. These methods enable the efficient training of an improved reinforcement learning agent to adjust or maintain a parameter of a first cell of a communication network. There now follows a detailed discussion of how different process steps illustrated in Figures 4 and 5a to 5d discussed above may be implemented. The functionality and implementation detail described below is discussed with reference to the modules of Figure s performing examples of the methods 500 and / or 600, substantially as described above.

[0099] The example below focuses on a traffic forecasting model. However, it will be appreciated that this example can be applied to many other types of regression and / or forecasting models.

[0100] An example of training a forecasting model with Ensemble Adversarial Training (EAT) according to the methods herein is now described with reference to Figure 8. Figure 8 shows a process for training a forecasting model with Ensemble Adversarial Training (EAT).

[0101] Firstly, an ensemble of LSTM model variants 802a, 802b, ... 802n is created. In this example, each of the variant models differ in configuration aspects such as: a hidden size, a number of layers, a dropout rate, an optimizer, a learning rate. In this example, the model variants are the LTSM variants described in Table 1 above.

[0102] Adversarial samples 804a, 804b, ... 804n for each variant model are then generated using adversarial attack methods. In this example, FGSM is used, and the adversarial samples generated correspond to those described above with respect to Figure 2.

[0103] The generated adversarial samples are then stacked together to form an ensemble of adversarial samples 806, which is then incorporated into the base model's training dataset.

[0104] The base model 808 then undergoes training with both the original data (as described with reference to Figure 1) and the generated adversarial examples. As noted above, this training enhances the exposure of the base model to a variety of perturbations, allowing the base model to learn to predict accurate time-series data in the presence of adversarial input data.

[0105] It will be appreciated that this approach enables the base model, through EAT, to become better equipped to withstand adversarial attacks, through the exposure of the base model to a variety of perturbations (that may be present in an adversarial attack) in the training stage. This training then preserves the integrity and accuracy of the model’s forecasting output in adversarial environments. The performance of the trained base model is then evaluated 810, and following this, the base model is deployed 812. In this example, the performance of the base model when trained with the Ensemble Adversarial Training (EAT) method is compared to the performance of a base model that has been trained without EAT (that is, the base model described with reference to Table 3).

[0106] The performance evaluation for these two models, for predictions based on “clean data” (that is, data that does not include adversarial samples), is shown in Table 4. The data used for this performance evaluation was obtained during the last 2 weeks of the 2 month period described above. These results are the average metrics for the 100 base forecasting models for each of the 100 nodes described above. Each base forecasting model is trained based on network data that has been obtained over the first 6 weeks of the 2 month period described above, with a 15 minute moving window. This corresponds to 3905 datapoints per base model. For each base model that has been trained with the EAT method, each model has 6 replicas, and each replica has 100 adversarial samples. The number of training data points for each base model that has been trained with the EAT method is therefore 3905 x 6 x 100 = 2,343,000 datapoints.

[0107] Table 4

[0108] In the clean data scenario, it is observed that the EAT-trained model consistently outperforms the non-EAT trained model across various performance metrics. Specifically, the EAT-trained model achieves lower Mean Squared Error (MSE), Root Mean Squared Error (RMSE), and Mean Absolute Error (MAE) values, indicating higher predictive accuracy for the EAT-trained model. Additionally, the R-squared (R2) value for the EAT-trained model is significantly higher, signifying an improved model fit to the clean data for the EAT-trained model.

[0109] The performance evaluation for these two models, for predictions based on “adversarial data” (that is, test data that includes adversarial samples), is shown in Table 5. The adversarial test data is generated based on the network data obtained in the last 2 weeks of the 2 month period described above.

[0110] Table 5

[0111] In the adversarial data scenario, the EAT-trained model consistently achieves lower MSE, RMSE, and MAE values compared to the non-EAT trained model, even when facing adversarial challenges. Moreover, the EAT trained model exhibits a significantly higher R-squared (R2) value, demonstrating its ability to maintain model accuracy in the presence of adversarial data.

[0112] EAT not only enhances the robustness of forecasting models against black-box adversarial attacks, but also enhances their performance on clean data, as evidenced by the experimental results across multiple telecom nodes. Notably, models trained with EAT exhibited superior average metrics compared to those trained without, even in the absence of adversarial samples as shown in Table 4.

[0113] Several potential reasons for this behaviour include the following:

[0114] Improved generalization: EAT introduces a form of regularization by training on a more diverse set of data points, including adversarial examples. This diversity may help the model to generalize better to unseen data, thereby improving performance of the model on clean data.

[0115] Robust feature learning: By learning to counter adversarial samples, EAT-trained models may focus on more robust and relevant features within the data, which are less sensitive to small perturbations or noise, enhancing the prediction accuracy of the model on clean datasets.

[0116] Enhanced model capacity: The process of adversarial training could push the model towards exploring a more complex function space to accommodate the adversarial examples, potentially allowing for a better fit to the underlying distribution of clean data. Error surface smoothing: Adversarial training may smooth the error surface of the model, leading to more stable and reliable gradient updates during training, which can contribute to improved model performance on clean data.

[0117] These findings suggest that adversarial training, specifically EAT, extends beyond merely a defensive mechanism against attacks, offering tangible benefits for model performance on clean datasets. This counterintuitive benefit shows the potential of integrating adversarial training techniques in the development of more accurate and robust forecasting models in the telecom domain.

[0118] Example methods according to the present disclosure can improve the performance of regression models (for example, KPI forecasting models), both in clean (without adversarial samples) and adversarial (with adversarial samples) data settings, while also increasing the security and robustness of the model against black-box adversarial attacks.

[0119] Training a regression model according to the methods disclosed herein will provide the model with resilience to a wide range of adversarial attacks, as the diverse nature of the ensemble in EAT allows the model to learn to withstand a wide range of adversarial attack strategies. Such approaches may also be used to secure Al-driven applications in the telecommunications sector, by utilising time series forecasting models that have been trained according to the methods disclosed herein. It will also be appreciated that the methods described herein are scalable and flexible for different telecommunications application, as the modular nature of the ensemble allows for the accommodation of different sizes and types of telecom time series data.

[0120] The methods of the present disclosure may be implemented in hardware, or as software modules running on one or more processors. The methods may also be carried out according to the instructions of a computer program, and the present disclosure also provides a computer readable medium having stored thereon a program for carrying out any of the methods described herein. A computer program embodying the disclosure may be stored on a computer readable medium, or it could, for example, be in the form of a signal such as a downloadable data signal provided from an Internet website, or it could be in any other form. It should be noted that the above-mentioned examples illustrate rather than limit the disclosure, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. The word “comprising” does not exclude the presence of elements or steps other than those listed in a claim, “a” or “an” does not exclude a plurality, and a single processor or other unit may fulfil the functions of several units recited in the claims. Any reference signs in the claims shall not be construed so as to limit their scope.

Claims

CLAIMS1 . A computer-implemented method (400) for training a first regression model to generate time-series data representing one or more key performance indicators (KPIs) in a communication network at one or more time points, the method (400) comprising: obtaining (402), from a network node in the communication network, first timeseries data representing the one or more KPIs at a first one or more past time points; deriving (404), from the first regression model, a plurality of regression models, wherein each of the plurality of regression models is a respective variant of the first regression model; generating (406), for each of the plurality of regression models, one or more adversarial samples; and training (408) the first regression model based on the generated adversarial samples and the first time-series data.

2. The method (400) of claim 1 , wherein, on receiving the one or more adversarial samples as an input, the respective regression model generates time-series data, wherein a performance metric of the generated time-series data fails to exceed a threshold.

3. The method (400) of claim 1 or 2, wherein the first regression model, and the plurality of regression models, are temporal neural networks.

4. The method (400) of claim 1 or 2, wherein the first regression model, and the plurality of regression models, are recurrent neural networks.

5. The method (400) of claim 4, wherein the first regression model, and the plurality of regression models, are Long Short-Term Memory models.

6. The method (400) of any one of the preceding claims, wherein each of the plurality of regression models respectively comprises one or more of: a different hidden size to the first regression model; and a different number of layers to the first regression model.

7. The method (400) of any one of the preceding claims, wherein deriving the plurality of regression models comprises, for each of the plurality of regression models:forming a subset of the first time-series data; and training the regression model using the subset of the first time-series data.

8. The method (400) of any one of the preceding claims, wherein deriving (404) the plurality of regression models comprises, for each of the plurality of regression models: training the regression model using one or more of: a learning rate that differs to a first learning rate used to initially train the first regression model; a dropout rate that differs to a first dropout rate used to initially train the first regression model; an optimization algorithm that differs to a first optimization algorithm used to initially train the first regression model.

9. The method (400) of any one of the preceding claims, wherein the adversarial samples are generated based on the first time-series data.

10. The method (400) of claim 9, wherein generating (406) the one or more adversarial samples for a respective regression model comprises: perturbing the first time-series data to generate the one or more adversarial samples.11 . The method (400) of any one of the preceding claims, wherein the one or more adversarial samples for a respective regression model are generated using a Fast Gradient Sign Method.

12. The method (400) of any one of the preceding claims, wherein the time-series data comprises performance management data and / or radio access network data.

13. The method (400) of any one of the preceding claims, wherein the one or more KPIs comprise one or more of: a traffic volume; a Reference Signals Received Power (RSRP); a Reference Signal Received Quality (RSRQ); a number of active user equipments (UEs) in the downlink direction; and a number of active UEs in the uplink direction.

14. The method (400) of any one of the preceding claims, wherein the method (400) further comprises: determining (510) a performance metric of the trained first regression model.

15. The method (400) of any one of the preceding claims, wherein the method (400) comprises: deploying (512) the trained first regression model in a network node of the communication network; and executing (514) the trained first regression model to generate time-series data representing the one or more KPIs at one or more time points, based on time-series data representing the one or more KPIs at one or more past time points.

16. A network node (600) comprising: processing circuitry (602) configured to operate in accordance with a method of any one of claims 1 to 15.

17. The network node (600) as claimed in claim 16, wherein: the network node (600) comprises: at least one memory (604) for storing instructions which, when executed by the processing circuitry (602), cause the network node (600) to operate in accordance with a method of any one of claims 1 to 15.

18. A computer program (706) comprising instructions which, when executed by processing circuitry of a network node (600), cause the network node to perform the method (400) according to any one of claims 1 to 15.

19. A computer program product (702) comprising a computer readable storage medium (704), wherein the computer readable storage medium (704) comprises instructions which are executable by processing circuitry to cause: a network node (600) to perform the method (400) according to any one of claims1 to 15.

Images