NFV Infrastructure Anomaly Detection Using Vector Isolation Forest
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection algorithms for Network Function Virtualization (NFV) infrastructures fail to detect anomalies that fall within the distribution range of regular values or near the extremes of variability, and do not consider the time evolution of metrics, leading to delayed detection and increased computational overhead.
Innovation Solution
A method using a vector-based Isolation Forest algorithm with oblique decision trees and Principal Component Analysis (PCA) to analyze the time evolution of metrics, integrating anomaly detection, data dimension reduction, and categorization techniques to identify both point and temporal anomalies in near real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional threshold-based anomaly detection is used, then simple implementation is achieved, but anomalies within distribution range or near extremes are not detected
Solution Approach 1:
The patent transforms the anomaly detection approach by changing from static threshold parameters to dynamic parameters derived from PCA analysis. The method computes principal components and uses them to define adaptive thresholds that evolve with the data distribution, enabling detection of anomalies within normal ranges while maintaining implementation feasibility through standardized linear algebra operations.
Solution Approach 2:
The patent replaces the simple mechanical threshold comparison mechanism with a more sophisticated statistical mechanism based on PCA. Instead of direct threshold checking, the system projects data onto principal components, computes statistical properties of these projections, and uses them to identify anomalies, substituting a rigid mechanical system with a flexible statistical one.
2Reliability
If Isolation Forest algorithm is used, then temporal anomalies are detected, but values within distribution range are misidentified as anomalies
Solution Approach 1:
The patent applies local quality by analyzing the distribution characteristics of projected values on each principal component separately. Instead of treating all data points uniformly, the method computes local statistical properties (mean, standard deviation) for each principal component's projected values and uses these local characteristics to identify anomalies, thereby improving accuracy by considering local distribution patterns rather than global thresholds.
3Measurement precision
If comprehensive anomaly detection is implemented, then detection accuracy is improved, but computational overhead increases
Solution Approach 1:
The patent implements partial action by focusing computational resources on the most informative principal components rather than analyzing all components equally. The method identifies and prioritizes principal components that contribute most to anomaly detection, applying detailed statistical analysis only to these key components while using simpler methods for others, thereby reducing overall computational overhead while maintaining detection accuracy.
4Loss of time
If real-time anomaly detection is achieved, then response time is reduced, but computational complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-computing the principal components and their statistical properties from historical data before real-time detection is needed. The PCA transformation matrix and initial statistical parameters are calculated in advance, so that during real-time operation, the system only needs to perform simple projections and comparisons rather than full PCA computations, enabling real-time detection with reduced complexity.
Data Source
Figure 1
AI summary
Method for detecting anomalies in an infrastructure for Network Function Virtualization, said method comprising the following steps: providing (1) a database containing historical infrastructure management data, the data being acquired in a plurality of consecutive sampling time windows, each sampling time window comprising a plurality of consecutive data points, the step of providing (1) comprising the sub-step of defining (11) a plurality of metrics relating to the historical infrastructure management data; providing (2) a control unit in signal communication with the database; providing (3) an anomaly detection algorithm based in the control unit; training (4) the anomaly detection algorithm for at least one reference time window; detecting anomalies (5) by performing the anomaly detection algorithm on an evaluation time window, said anomaly detection comprising a deviation between the metrics relating to the evaluation time window and the metrics relating to the at least one reference time window; wherein the anomaly detection algorithm comprises an algorithm of the vector-based Isolation Forest type, and and the step of detecting anomalies (5) comprises the sub-steps of: defining (51) a respective input vector for a first number of consecutive data points of the evaluation time window, each vector comprising a second number of data points representing said metrics; detecting anomalies (52) by means of said anomaly detection algorithm for each input vector; defining (53) an output vector as a function of the anomalies detected.