IFTM - Unsupervised Anomaly Detection for Virtualized Network Function Services

Telecommunication system providers move their IP multimedia subsystems to virtualized services in the cloud. For such systems, dedicated hardware solutions provided a reliability of 99.999% in the past. Although virtualization offers more cost efficient usage of such services, it comes with higher complexity for providing reliable running software components due to the fragile computation stack. In order to hide the impact of such problematic behaviors, automatic mechanisms may help to detect degraded state anomalies in order to execute remediation actions. This work introduces IFTM as a framework for unsupervised anomaly detection in a distributed environment based on real-time monitoring data. The proposed approach consists of two key concepts using an automatic identity function and threshold learning to distinguish between normal and abnormal system behaviors. The evaluation is performed on a testbed running an open source implementation of the IP multimedia subsystem (Clearwater) executed on a replicated Openstack cloud environment. Results show the applicability of IFTM with high detection rates (98%) and low number of false alarms.