Distributed Anomaly Detection Model Training in 5G Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in 5G communication networks is the availability, security, and resource-intensive process of obtaining and exploiting training data for anomaly detection using machine learning, which is critical but sensitive and can be exploited by malicious third parties, especially in a centralized federated learning approach where the central server is a single point of failure.
Innovation Solution
A collaborative automatic learning method where each node in the network maintains a local behavioral model, updates it with new data, exchanges information with other nodes to aggregate global behavioral models, and updates the global model, ensuring security and reducing data transmission while maintaining high-performance anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized federated learning approach is used where the central server aggregates all training data, then the global behavioral model can be trained comprehensively, but the security of training data is compromised and the central server becomes a single point of failure
Solution Approach 1:
The patent segments the centralized learning process into distributed local learning processes at each network node. Each node independently trains its own behavioral model using local training data, preventing centralization of sensitive data while still achieving comprehensive anomaly detection through distribution of the global model across multiple nodes.
Solution Approach 2:
The patent extracts the training data from the centralized server environment and keeps it localized at each network node. By taking out the sensitive training data from the central aggregation point and maintaining it distributed across nodes, the system eliminates the security vulnerability while preserving the learning capability.
2Measurement precision
If training data is collected and stored centrally for model training, then the behavioral model can be trained effectively, but the resources required and time consumed increase significantly
Solution Approach 1:
The patent divides the training workload into parallel segments executed independently at each network node. Each node trains local models simultaneously using its own data, eliminating the sequential bottlenecks of centralized data collection and processing, thereby improving training efficiency while maintaining model accuracy.
Solution Approach 2:
Each network node performs self-service by independently training its own behavioral model using locally available training data. This eliminates the need for centralized data collection, storage, and processing operations, significantly reducing the resource consumption and time required for model training while maintaining effective anomaly detection capability.
3Adaptability or versatility
If training data is transmitted over the network for centralized processing, then the global model can be trained, but the data exchange volume increases and security risks arise
Solution Approach 1:
The patent extracts the training data transmission step from the learning process by keeping data localized at each node. Instead of transmitting sensitive training data over the network for centralized processing, each node processes its own data locally and only exchanges model parameter information, dramatically reducing network data transmission load while maintaining the ability to detect diverse attacks.
Solution Approach 2:
The patent uses copying by distributing the global behavioral model parameters to each node rather than centralizing the training data. Each node maintains a copy of the global model and updates it locally, eliminating the need for extensive data transmission while preserving the adaptability to detect various attack types across the distributed network.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The invention relates to a collaborative learning method, between a plurality of nodes belonging to a telecommunications network, of a so-called global behavioral model intended to be used by each node to detect anomalies affecting this network, this method being implemented by each node of the plurality of nodes and comprising, when new training data are available at the level of this node (E10): - a step (E70) of updating, from said new training data, a so-called local behavioral model maintained by said node; - a step (E80) of exchanging with the other nodes of said plurality of nodes information representative of the updates of the local behavioral models maintained respectively by said plurality of nodes; and - a step (E90) of updating the global behavioral model from the information exchanged.