Towards Black-Box Anomaly Detection in Virtual Network Functions

The maturity of hardware virtualization has motivated communication service providers to apply this paradigm to network services. Virtual Network Functions (VNFs) come from this motivation and refer to any virtual execution environment configured to provide a given network service. VNFs constitute a new paradigm and related dependability evaluation mechanisms are still not thoroughly defined. In this paper we propose a preliminary evaluation of an anomaly detection approach applied to VNFs. Our approach uses a supervised machine learning algorithm. It notably relies on data provided by the underlying hypervisor of the VMs hosting the VNF, making it a black-box approach. Such an approach is actually well suited for infrastructure or telecommunication service providers willing to deploy tools that are easily configurable while reducing deployment costs. We validate our approach with the case study of the vIMS (IP Multimedia Subsystem) implemented by the Clearwater project.