Self-Organizing Map Neural Network for NFV Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing algorithms for managing Network Function Virtualization (NFV) infrastructures are prone to programming errors, leading to unreliable anomaly detection and compromised infrastructure performance.
Innovation Solution
A method using a Self-Organizing Map neural network to identify and classify behavior modes of NFV telephony infrastructure data, incorporating historical monitoring and application data, and employing threshold distances to group and classify current data for anomaly detection and error reduction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional algorithms are used for NFV infrastructure management, then implementation is straightforward, but programming errors occur leading to unreliable anomaly detection
Solution Approach 1:
The patent replaces traditional programming-based algorithms with a Self-Organizing Map (SOM) neural network system. This substitution transforms the anomaly detection mechanism from rule-based software logic to an adaptive neural network that automatically learns and classifies infrastructure behavior patterns, eliminating programming errors while maintaining reliability.
Solution Approach 2:
The SOM neural network performs self-organization and automatic classification of infrastructure data without requiring manual programming of detection rules. The system autonomously learns normal and anomalous behavior patterns from historical data, reducing human intervention and programming complexity while improving detection reliability.
2Measurement precision
If comprehensive historical data is collected for analysis, then anomaly detection accuracy improves, but data processing time increases
Solution Approach 1:
The patent implements preliminary clustering of historical infrastructure data using the SOM neural network before actual anomaly detection. By pre-organizing data into behavior mode clusters during idle periods, the system reduces real-time processing requirements while maintaining high detection accuracy when anomalies need to be identified.
Solution Approach 2:
The patent segments comprehensive historical data into distinct behavior mode clusters using the SOM neural network. This segmentation organizes large volumes of historical data into manageable categories representing different infrastructure states, enabling faster comparison and anomaly detection without processing the entire dataset in real-time.
Data Source
Figure 1
AI summary
A method of identifying and classifying the behavior modes of a plurality of data relative to a telephony infrastructure for Network Function Virtualization comprising the steps of: providing (1) a first database containing historical telephony infrastructure monitoring data concerning the level of use of the telephony infrastructure resources; providing (2) a second database containing historical telephony infrastructure application monitoring data concerning the level of use of the telephony infrastructure application; providing (3) a control unit in signal communication with the first and second databases; providing (4) a neural network of Self-Organizing Map type; extrapolating (5), by the control unit, at least one first subset of historical data from the historical telephony infrastructure monitoring data, said first subset of data being relative to a predetermined time window; extrapolating (6), by the control unit, at least one second subset of historical data from the historical application monitoring data, said second subset of historical data being relative to the predetermined time window; defining (7), by the control unit, at least one historical input vector comprising the historical data of the first and second subsets of historical data; training (8), by the control unit, the neural network to define a weight vector comprising a plurality of weight coefficients for each neuron of the neural network such that by providing the at least one historical input vector as an input to the neural network, the behavior mode of the historical data of the at least one historical input vector is obtained as an output, each weight vector representing a respective behavior mode; acquiring (9), by the control unit, a plurality of current telephony infrastructure monitoring data and current telephony infrastructure application monitoring data, such current data being acquired in real time and being relative to a current window; defining (10), by the control unit, at least one current input vector comprising the current acquired data; providing (11), by the control unit, the at least one current input vector at the input of the trained neural network to obtain, at the output, the neuron of neural network that is most stimulated by the current input vector; analyzing (12) the weight vector associated with the neuron obtained in the previous step to define the behavior mode of the current data of the current input vector.