SDN Host Anomaly Detection Using Random Forest Feature Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting anomalies in software-defined networks (SDN) is challenging due to the large number of components and complex relationships, which can lead to operational downtime and significant business impact.
Innovation Solution
Implementing a random forest model trained with historical metrics from SDN hosts to predict anomalous hosts, generate feature scores based on tree locations, and execute automated actions like migrating virtual machines to healthy hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional monitoring methods are used in SDN, then system complexity is reduced, but anomaly detection precision deteriorates due to the large number of components and complex relationships
Solution Approach 1:
The patent introduces an intermediary anomaly detection system that sits between the complex SDN infrastructure and the monitoring processes. This intermediary layer abstracts the complexity by implementing a standardized monitoring framework that interfaces with various SDN components through common protocols and APIs, thereby improving detection precision without requiring direct management of underlying system complexity
Solution Approach 2:
The monitoring system is segmented into multiple independent modules including data collection agents, analysis engines, and response mechanisms. Each module handles specific aspects of anomaly detection independently, allowing the system to manage complex SDN environments through divided responsibilities while maintaining high detection precision across distributed components
2Reliability
If comprehensive monitoring of all SDN components is implemented, then anomaly detection capability is improved, but processing time increases due to the large volume of metrics to analyze
Solution Approach 1:
The system implements partial monitoring by focusing computational resources on critical SDN components and metrics that have the highest impact on system reliability. Rather than analyzing all metrics equally, the system identifies and prioritizes key performance indicators and anomaly-prone areas, achieving effective anomaly detection with reduced processing time by examining only the most relevant data subsets
3Productivity
If manual anomaly investigation processes are used, then system complexity is minimized, but operational downtime increases due to prolonged detection and response times
Solution Approach 1:
The anomaly detection system implements self-service capabilities through automated root cause analysis and response mechanisms. When anomalies are detected, the system automatically investigates potential causes, correlates metrics, and executes predefined remediation actions without human intervention. This self-service approach eliminates manual investigation delays, significantly reducing operational downtime while maintaining manageable system complexity through automation
Data Source
AI summary
Systems and methods for anomaly detection in software-defined networks from observed host metrics are disclosed. A method may include: (1) training a random forest model comprising a plurality of trees with historical metrics from a software defined network, the software defined network comprising a plurality of hosts; (2) receiving metrics for a plurality of features from the hosts in the software defined network; (3) providing the metrics to the trained random forest model; (4) receiving, from the trained random forest model, a prediction of an anomalous hosts for one of the hosts; (5) identifying a subset of the plurality of trees that contributed to the prediction; (6) generating feature scores for the feature from the subset of trees; (7) generating an anomaly score for the feature based on the feature scores and an explanation; and (8) executing an automated action in response to the anomaly score.