Anomaly Detection of Service Function Chain Based on Distributed Knowledge Distillation Framework in Cloud–Edge Industrial Internet of Things Scenarios

Due to the increasingly complex and dynamic network topology, as well as multiple layers in the cloud–edge–end collaboration scenarios in the Industrial Internet of Things (IIoT), service function chains (SFCs) generated from user requests are more prone to anomalies compared to traditional hardware solutions. In order to timely detect anomalies in the SFC and ensure service quality, we propose a time-series anomaly detection model based on a distributed knowledge distillation framework (DTS-KD) in this article. First, to detect each status of virtual network function (VNF) in the SFC, we propose a distributed teacher–student knowledge distillation architecture to perform anomaly detection on each link containing different VNFs. Second, to address the problem of neglecting spatial topology information of feature nodes in traditional SFC anomaly detection schemes, we propose a feature fusion-based spatial–temporal dilated convolution module encoding scheme, which utilizes spatial convolution with dilated convolution to jointly encode and capture spatial–temporal dependencies. Finally, during the knowledge transfer process between the teacher and student networks, we propose a progressive knowledge distillation algorithm, which automatically adjusts the student network learning stages by adjusting task attention weights. After training, the student network measures the presence of anomalies in the links at each moment through the reconstruction data anomaly scores, thereby completing the SFC anomaly detection at that moment. The effectiveness of this proposed method under model compression conditions is validated on the ITU AI/ML in 5G data set using four performance metrics: 1) F1 score; 2) accuracy; 3) precision; and 4) recall.