Network Anomaly Detection and Root Cause Analysis
summary
Uses 4G per‑call measurement (PCMD) logs aggregated into 10‑second windows (≈700k records/min from one MME), one‑hot categorical frequencies and medians for numerics, missing categorical → 0, numerics → mean, then standardization. Runs PCA but excludes leading/noise components and detects anomalies on middle‑principal‑components (components explaining ~2–5% each) with a chi‑square threshold. Root cause analysis compares message finite‑state‑machine subsequences and error codes to pinpoint failing element; method flags two real outages and isolates anomalous message patterns.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:35Motivation Overview
- 3:27Challenges
- 6:05Overview of Anomaly Detection
- 10:33Examples
- 11:44Exploratory Data Analysis
- 15:01Methods of Anomaly Detection
- 16:20Challenges for Anomaly Detection
- 18:55Network Log Data
- 21:04Data Pre-Processing
- 23:40Root Cause Analysis
- 24:12Pre-Processing of the Data
- 26:13Standard Procedures
- 30:59The Pca Model
- 32:10Root Cause Analysis
- 34:08Results
- 38:55Message Patterns
related talks
17mCellDAM: User-Space, Rootless Detection and Mitigation for 5G Data Plane
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
12mCARdea: Two-Phase Plausibility-Based Vehicle-to-Vehicle Anomaly Detection...
50mHunting Supply Chain Threats Using Anomaly Detection
27mCollect All the Data; Protect All the Things
40mUncovering Covert Channels in Your IoT Networks
17mNetVigil: Robust and Low-Cost Anomaly Detection for East-West Data Center Security
18mThe Risk From Power Lines: How to Sniff the G3 and Prime Data and Detect the Interfere Attack