Anomaly Detection and Root Cause Localization in Virtual Network Functions

The maturity of hardware virtualization has motivated Communication Service Providers (CSPs) to apply thisparadigm to network services. Virtual Network Functions (VNFs)result from this trend and raise new dependability challengesrelated to network softwarisation that are still not thoroughlyexplored. This paper describes a new approach to detect ServiceLevel Agreements (SLAs) violations and preliminary symptomsof SLAs violations. In particular, one other major objectiveof our approach is to help CSP administrators to identify theanomalous VM at the origin of the detected SLA violation, whichshould enable them to proactively plan for appropriate recoverystrategies. To this end, we make use of virtual machine (VM)monitoring data and perform both a per-VM and an ensembleanalysis. Our approach includes a supervised machine learningalgorithm as well as fault injection tools. The experimental testbedconsists of a virtual IP Multimedia Subsystem developed by theClearwater project. Experimental results show that our approachcan achieve high precision and recall, and low false alarm rateand can pinpoint the root anomalous VNF VM causing SLAviolations. It can also detect preliminary symptoms of highworkloads triggering SLA violations.