AI and Machine Learning for Network and Security Management
Description
Extensive Resource for Understanding Key Tasks of Network and Security Management
AI and Machine Learning for Network and Security Management covers a range of key topics of network automation for network and security management, including resource allocation and scheduling, network planning and routing, encrypted traffic classification, anomaly detection, and security operations. In addition, the authors introduce their large-scale intelligent network management and operation system and elaborate on how the aforementioned areas can be integrated into this system, plus how the network service can benefit.
Sample ideas covered in this thought-provoking work include:
* How cognitive means, e.g., knowledge transfer, can help with network and security management
* How different advanced AI and machine learning techniques can be useful and helpful to facilitate network automation
* How the introduced techniques can be applied to many other related network and security management tasks
Network engineers, content service providers, and cybersecurity service providers can use AI and Machine Learning for Network and Security Management to make better and more informed decisions in their areas of specialization. Students in a variety of related study programs will also derive value from the work by gaining a base understanding of historical foundational knowledge and seeing the key recent developments that have been made in the field.
More details
Other editions
Additional editions
Persons
Yulei Wu, is a Senior Lecturer with the Department of Computer Science, Faculty of Environment, Science and Economy, University of Exeter, UK. His research focuses on networking, Internet of Things, edge intelligence, information security, and ethical AI. He serves as an Associate Editor for IEEE Transactions on Network and Service Management, and IEEE Transactions on Network Science and Engineering, as well as an Editorial Board Member of Computer Networks, Future Generation Computer Systems, and Nature Scientific Reports at Nature Portfolio. He is a Senior Member of the IEEE and the ACM, and a Fellow of the HEA (Higher Education Academy).
Jingguo Ge, is currently a Professor of the Institute of Information Engineering, Chinese Academy of Sciences (CAS), and also a Professor of School of Cyber Security, University of Chinese Academy of Sciences. His research focuses on Future Network Architecture, 5G/6G, Software-defined networking (SDN), Cloud Native networking, Zero Trust Architecture. He has published more than 60 research papers and is the holder of 28 patents. He participated in the formulation of 3 ITU standards on IMT2020.
Tong Li, is currently a Senior Engineer of Institute of Information Engineering at the Chinese Academy of Sciences (CAS). His research and engineering focus on Computer Networks, Cloud Computing, Software-Defined Networking (SDN), and Distributed Network and Security Management. He participated 2 ITU standards on IMT2020 and developed many large-scale software systems on SDN, network management and orchestration.
Content
Author Biographies xiii
Preface xv
Acknowledgments xvii
Acronyms xix
1 Introduction 1
1.1 Introduction 1
1.2 Organization of the Book 3
1.3 Conclusion 6
References 6
2 When Network and Security Management Meets AI and Machine Learning 9
2.1 Introduction 9
2.2 Architecture of Machine Learning-Empowered Network and Security Management 10
2.3 Supervised Learning 12
2.3.1 Classification 12
2.3.2 Regression 15
2.4 Semisupervised and Unsupervised Learning 15
2.4.1 Clustering 17
2.4.2 Dimension Reduction 17
2.4.3 Semisupervised Learning 18
2.5 Reinforcement Learning 18
2.5.1 Policy-Based 21
2.5.2 Value-Based 22
2.6 Industry Products on Network and Security Management 24
2.6.1 Network Management 24
2.6.1.1 Cisco DNA Center 24
2.6.1.2 Sophie 25
2.6.1.3 Juniper EX4400 Switch 25
2.6.1.4 Juniper SRX Series Services Gateway 25
2.6.1.5 H3C SeerAnalyzer 26
2.6.2 Security Management 27
2.6.2.1 SIEM, IBM QRadar Advisor with Watson 27
2.6.2.2 FortiSandbox 27
2.6.2.3 FortiSIEM 28
2.6.2.4 FortiEDR 28
2.6.2.5 FortiClient 29
2.6.2.6 H3C SecCenter CSAP 29
2.7 Standards on Network and Security Management 29
2.7.1 Network Management 29
2.7.1.1 Cognitive Network Management 30
2.7.1.2 End-to-End 5G and Beyond 30
2.7.1.3 Software-Defined Radio Access Network 32
2.7.1.4 Architectural Framework for ML in Future Networks 32
2.7.2 Security Management 33
2.7.2.1 Securing AI 33
2.8 Projects on Network and Security Management 34
2.8.1 Poseidon 34
2.8.2 NetworkML 35
2.8.3 Credential-Digger 36
2.8.4 Adversarial Robustness Toolbox 37
2.9 Proof-of-Concepts on Network and Security Management 38
2.9.1 Classification 38
2.9.1.1 Phishing URL Classification 38
2.9.1.2 Intrusion Detection 39
2.9.2 Active Learning 39
2.9.3 Concept Drift Detection 40
2.10 Conclusion 41
References 42
3 Learning Network Intents for Autonomous Network Management 49
3.1 Introduction 49
3.2 Motivation 52
3.3 The Hierarchical Representation and Learning Framework for Intention Symbols Inference 53
3.3.1 Symbolic Semantic Learning (SSL) 53
3.3.1.1 Connectivity Intention 55
3.3.1.2 Deadlock Free Intention 56
3.3.1.3 Performance Intention 57
3.3.1.4 Discussion 57
3.3.2 Symbolic Structure Inferring (SSI) 57
3.4 Experiments 59
3.4.1 Datasets 59
3.4.2 Experiments on Symbolic Semantic Learning 60
3.4.3 Experiments on Symbolic Structure Inferring 62
3.4.4 Experiments on Symbolic Structure Transferring 64
3.5 Conclusion 66
References 66
4 Virtual Network Embedding via Hierarchical Reinforcement Learning 69
4.1 Introduction 69
4.2 Motivation 70
4.3 Preliminaries and Notations 72
4.3.1 Virtual Network Embedding 72
4.3.1.1 Substrate Network and Virtual Network 72
4.3.1.2 The VNE Problem 72
4.3.1.3 Evaluation Metrics 73
4.3.2 Reinforcement Learning 74
4.3.3 Hierarchical Reinforcement Learning 75
4.4 The Framework of VNE-HRL 75
4.4.1 Overview 75
4.4.2 The High-level Agent 77
4.4.2.1 State Encoder for HEA 77
4.4.2.2 Estimated Long-term Cumulative Reward 78
4.4.2.3 Short-term High-level Reward 78
4.4.3 The Low-level Agent 78
4.4.3.1 State Encoder for LEA 79
4.4.3.2 Estimated Long-term Cumulative Reward 79
4.4.3.3 Short-term Low-level Reward 80
4.4.4 The Training Method 80
4.5 Case Study 80
4.5.1 Experiment Setup 80
4.5.2 Comparison Methods 81
4.5.3 Evaluation Results 81
4.5.3.1 Performance Over Time 81
4.5.3.2 Performance of Various VNRs with Diverse Resource Requirements 82
4.6 Related Work 84
4.6.1 Traditional Methods 84
4.6.2 ML-based Algorithms 84
4.7 Conclusion 85
References 85
5 Concept Drift Detection for Network Traffic Classification 91
5.1 Related Concepts of Machine Learning in Data Stream Processing 91
5.1.1 Assumptions and Limitations 91
5.1.1.1 Availability of Learning Examples 91
5.1.1.2 Availability of the Model 92
5.1.1.3 Concept to be Learned 92
5.1.2 Concept Drift and Its Solution 92
5.2 Using an Active Approach to Solve Concept Drift in the Intrusion Detection Field 94
5.2.1 Application Background 94
5.2.2 System Workflow 95
5.3 Concept Drift Detector Based on CVAE 96
5.3.1 CVAE-based Drift Indicator 96
5.3.2 Drift Analyzer 97
5.3.3 The Performance of CVAE-based Concept Drift Detector 98
5.3.3.1 Comparison Drift Detectors 99
5.3.3.2 Experiment Settings 99
5.4 Deployment and Experiment in Real Networks 101
5.4.1 Data Collection and Feature Extraction 101
5.4.2 Data Analysis and Parameter Setting 103
5.4.3 Result Analysis 103
5.5 Future Research Challenges and Open Issues 105
5.5.1 Adaptive Threshold m 105
5.5.2 Computational Cost of Drift Detectors 105
5.5.3 Active Learning 105
5.6 Conclusion 105
References 106
6 Online Encrypted Traffic Classification Based on Lightweight Neural Networks 109
6.1 Introduction 109
6.2 Motivation 109
6.3 Preliminaries 110
6.3.1 Problem Definition 110
6.3.2 Packet Interaction 111
6.4 The Proposed Lightweight Model 111
6.4.1 Preprocessing 112
6.4.2 Feature Extraction 112
6.4.2.1 Embedding 112
6.4.2.2 Attention Encoder 113
6.4.2.3 Fully Connected Layer 115
6.5 Case Study 115
6.5.1 Evaluation Metrics 115
6.5.2 Baselines 116
6.5.3 Datasets 117
6.5.4 Evaluation on Datasets 118
6.5.4.1 Evaluation on Dataset A 118
6.5.4.2 Evaluation on Dataset B 120
6.6 Related Work 121
6.6.1 Encrypted Traffic Classification 122
6.6.2 Packet-Based Methods 122
6.6.3 Flow-Based Methods 122
6.6.3.1 Traditional Machine Learning-Based Methods 123
6.6.3.2 Deep Learning-Based Methods 124
6.7 Conclusion 124
References 125
7 Context-Aware Learning for Robust Anomaly Detection 129
7.1 Introduction 129
7.2 Pronouns 133
7.3 The Proposed Method - AllRobust 135
7.3.1 Problem Statement 135
7.3.2 Log Parsing 135
7.3.3 Log Vectorization 138
7.3.4 Anomaly Detection 142
7.3.4.1 Implementation of SSL 143
7.4 Experiments 145
7.4.1 Datasets 145
7.4.1.1 HDFS Dataset 145
7.4.1.2 BGL Dataset 146
7.4.1.3 Thunderbird Dataset 146
7.4.2 Model Evaluation Indicators 147
7.4.3 Supervised Deep Learning-based Log Anomaly Detection on Imbalanced Log Data 148
7.4.3.1 Data Preprocessing 148
7.4.3.2 Hyperparameters and Environmental Settings 149
7.4.3.3 Training on Multiclass Imbalanced Log Data 149
7.4.3.4 Training on Binary Imbalanced Log Data 150
7.4.4 Semisupervised Deep Learning-based Log Anomaly Detection on Imbalanced Log Data 152
7.4.4.1 The Methods of Enhancing Log Data 152
7.4.4.2 Anomaly Detection with a Single Log 153
7.4.4.3 Anomaly Detection with a Log-based Sequence 156
7.5 Discussion 157
7.6 Conclusion 158
References 159
8 Anomaly Classification with Unknown, Imbalanced and Few Labeled Log Data 165
8.1 Introduction 165
8.2 Examples 167
8.2.1 The Feature Extraction of Log Analysis 167
8.2.1.1 Statistical Feature Extraction 168
8.2.1.2 Semantic Feature Extraction 170
8.2.2 Few-Shot Problem 170
8.3 Methodology 172
8.3.1 Data Preprocessing 172
8.3.1.1 Log Parsing 172
8.3.1.2 Log Enhancement 173
8.3.1.3 Log Vectorization 174
8.3.2 The Architecture of OpenLog 174
8.3.2.1 Encoder Module 174
8.3.2.2 Prototypical Module 177
8.3.2.3 Relation Module 178
8.3.3 Training Procedure 179
8.3.4 Objective Function 180
8.4 Experimental Results and Analysis 180
8.4.1 Experimental Design 181
8.4.1.1 Baseline 181
8.4.1.2 Evaluation Metrics 181
8.4.2 Datasets 183
8.4.2.1 Data Processing 184
8.4.3 Experiments on the Unknown Class Data 185
8.4.4 Experiments on the Imbalanced Data 188
8.4.5 Experiments on the Few-shot Data 188
8.5 Discussion 190
8.6 Conclusion 191
References 192
9 Zero Trust Networks 199
9.1 Introduction to Zero-Trust Networks 199
9.1.1 Background 199
9.1.2 Zero-Trust Networks 200
9.2 Zero-Trust Network Solutions 201
9.2.1 Zero-Trust Networks Based on Access Proxy 201
9.2.2 Zero Trust Networks Based on SDP 203
9.2.3 Zero-Trust Networks Based on Micro-Segmentation 204
9.3 Machine Learning Powered Zero Trust Networks 206
9.3.1 Information Fusion 208
9.3.2 Decision Making 210
9.4 Conclusion 212
References 212
10 Intelligent Network Management and Operation Systems 215
10.1 Introduction 215
10.2 Traditional Operation and Maintenance Systems 215
10.2.1 Development of Operation and Maintenance Systems 215
10.2.1.1 Manual Operation and Maintenance 216
10.2.1.2 Tool-Based Operation and Maintenance 216
10.2.1.3 Platform Operation and Maintenance 217
10.2.1.4 DevOps 217
10.2.1.5 AIOps 218
10.2.2 Open-Source Operation and Maintenance Systems 218
10.2.2.1 Nagios 219
10.2.2.2 Zabbix 221
10.2.2.3 Prometheus 223
10.2.3 Summary 224
10.3 Security Operation and Maintenance 225
10.3.1 Introduction 225
10.3.2 Open-Source Security Tools 226
10.3.2.1 Access Control 226
10.3.2.2 Security Audit and Intrusion Detection 227
10.3.2.3 Penetration Testing 227
10.3.2.4 Vulnerability Scanning 231
10.3.2.5 CI/CD Security 234
10.3.2.6 Deception 234
10.3.2.7 Data Security 234
10.3.3 Summary 237
10.4 AIOps 238
10.4.1 Introduction 238
10.4.2 Open-Source AIOps and Algorithms 239
10.4.2.1 Research Progress of Anomaly Detection 239
10.4.2.2 Metis 242
10.4.2.3 UAVStack 244
10.4.2.4 Skyline 244
10.4.3 Summary 247
10.5 Machine Learning-Based Network Security Monitoring and Management Systems 248
10.5.1 Architecture 248
10.5.2 Physical Facility Layer 248
10.5.3 Virtual Resource Layer 249
10.5.4 Orchestrate Layer 250
10.5.5 Policy Layer 250
10.5.6 Semantic Description Layer 251
10.5.7 Application Layer 251
10.5.8 Center for Intelligent Analytics of Big Data 251
10.5.9 Programmable Measurement and Auditing 252
10.5.10 Overall Process 252
10.5.11 Summary 253
10.6 Conclusion 253
References 254
11 Conclusions, and Research Challenges and Open Issues 257
11.1 Conclusions 257
11.2 Research Challenges and Open Issues 258
11.2.1 Autonomous Networks 258
11.2.2 Reinforcement Learning Powered Solutions 259
11.2.3 Traffic Classification 259
11.2.4 Anomaly Detection 260
11.2.5 Zero-Trust Networks 261
References 262
Index 263
1
Introduction
1.1 Introduction
Networking systems have been experiencing rapid advancement in recent years, due to the fast development of 5G (Cheng et al., 2018, 2020b, Wu et al., 2021b), Internet of Things (IoT) (Wu et al., 2021c, Wu, 2021), Cloud/Edge Computing (Zhang et al., 2020, Wu, 2020), and Industry 4.0 (Wu et al., 2021a, Turner et al., 2021). On the one hand, many advanced networking techniques have been developed, such as software-defined networking (SDN) (Miao et al., 2016, Wang et al., 2018, Yang et al., 2020), network functions virtualization (NFV) (Miao et al., 2019, Cheng et al., 2020b), and network slicing (Wang et al., 2019, 2020) to facilitate network and service deployment and management. On the other hand, cybersecurity is a major concern for networking systems due to the increase in system exposure to the Internet (Wu et al., 2021a, Garg et al., 2020, Culot et al., 2019). Many security mechanisms, e.g. intrusion detection, traffic classification, and anomaly detection, have been developed to facilitate the security management of networking systems (Huang et al., 2017, 2018, Zuo et al., 2020, Sun et al., 2020).
Telecommunication networks such as 5G have received significant attention in the past few years because of their capabilities of accommodating diverse vertical industry applications (Wang et al., 2019, 2020). Along with the diversified services as well as their changing and/or stringent service requirements, 5G networks have become a complex system that requires advanced artificial intelligence (AI) and machine-learning (ML) techniques to manage and maintain high-standard services to users (Yan et al., 2020). From the perspective of network operators, it is important to maximize the resource utilization of 5G infrastructure, while minimizing the violation of service-level agreement (SLA) (Wang et al., 2019). The research of next-generation telecommunication networks, the so-called 6G (Wu et al., 2021d), has been initiated by many countries, such as United Kingdom, USA, China, Finland, just to name a few. "AI Everywhere" is an important component for 6G to ensure an automatic, healthy, and secure networking system.
The fast advancement of IoT and Industrial Internet of Things (IIoT) is transforming many traditional industries (many of them are critical infrastructures), such as energy, healthcare, factory, and transportation, toward the goal of Industry 4.0 (Wu et al., 2021a). Such a complex networking system, connecting tens of billions of devices to the Internet, is collecting a huge amount of data every day. AI and ML techniques can leverage the knowledge learned from the data to automate many tasks for these industries (Lin et al., 2021), resulting in the so-called "smart energy, smart factory, smart transportation," to name a few. Such an automation remarkably increases the efficiency of system operation of industries. However, since traditional form of these industries is much more isolated, the exposure of these industries to the Internet as a result of the transformation, calls for significant security management to ensure the safety of these critical infrastructures (Culot et al., 2019, Wu et al., 2021a).
In order to properly apply AI and ML technologies into the field of network and security management, many real-world conditions and challenges need to be considered. For example, network intent is a key piece of information to enable autonomous network management (Lin et al., 2021). How to gain accurate network intent from network big data and how to ensure that the learned network intent can be readily used across different network environments is nontrivial. Reinforcement learning (RL) is a useful tool for autonomous network management (Yan et al., 2020). Successfully applying RL in various network management tasks is challenging. In many real-world conditions, such as IoT/IIoT, lightweight learning models are required (Cheng et al., 2020a). How to devise such models while maintaining the model performance is still worth to investigate for the field of network and security management. In addition, learning from encrypted data, e.g. encrypted traffic, is crucial, due to the increase in the volume of such traffic enforced by data regulations like the general data protection regulation (GDPR) (Liu et al., 2020). Further, because of the changing condition of real-world networking systems, network data are not ideal in many cases. They are usually evolving, changing, and imbalanced, and new data that have not been seen before may present from time to time. Besides, network data are usually hard to label, resulting in few-shot issues. How to effectively learn useful information from such "noisy" data is of paramount importance to ensure the success of AI-enabled network and security management (Sun et al., 2020).
In this book, we provide our insights and potential solutions to the above issues and challenges and consider various applications to network and security management including autonomous networks, resource allocation, traffic processing, traffic classification, anomaly detection, anomaly classification, and zero trust networks (ZTNs). In Section 1.2, we will explain the rationale under which the chapters in this book are organized.
1.2 Organization of the Book
There are two strands in this book. The first strand is in Chapter 2, where we provide a comprehensive review of potential AI and ML techniques for network and security management, the existing industry products, standards, projects, and proof-of-concepts. The second strand is across Chapters 3-9, where we elaborate the application of AI and ML techniques in various network and security management tasks. In Chapter 10, we elaborate an intelligent network management and operation system and discuss the deployment of the proposed solutions in this book. In Chapter 11, we conclude this book and provide potential research challenges and open issues that will be useful for future research in this area. Figure 1.1 shows the chapter organization of this book. In what follows, we briefly introduce each chapter to facilitate readers understand the content of this book.
- Chapter 2. This chapter discusses the status and limitations of current network and security management and proposes an architecture for ML-empowered network and security management. Well-known AI and ML techniques that are useful for network and security management are reviewed and discussed. We also investigate existing industry products, standards, and proof-of-concepts for network and security management.
- Chapter 3. The realization of network autonomy requires network knowledge to manage the network. The abstract intent of network management tasks can be considered as part of network knowledge. In this chapter, we treat abstract intents of network management tasks as a composite structure of symbols. Each symbol expresses the intention of the network management task in a certain aspect. The combinations of symbols, representing a network management task, should be able to be transferred and implemented across different networks. In this regard, we design a reference mechanism for learning intention symbols and their structures from network data. Taking path selection as an example, we describe in detail how to implement this mechanism to obtain the intent structure of the path selection task. It has been proved by experiments that the knowledge learnt by the proposed solution can be transferred and effectively leveraged in different network environments.
- Chapter 4. Due to the outstanding performance of automatic exploration and quick development, RL methods have been applied to the virtual network embedding (VNE) problem. In this chapter, we find that a proactive VNE algorithm can benefit from hierarchical reinforcement learning (HRL). In this algorithm, a two-level agent is responsible for executing the VNE task, considering both the long-term impact and short-term impact. At the high level, the agent selects a feasible request from a batch, which aims to maximize the long-term revenue. At the low level, the agent manages to embed the selected request with the minimum cost.
- Chapter 5. Although network traffic classification algorithms based on machine learning can alleviate the limitations imposed by traditional techniques, most of them are carried out by learning an underlying concept (i.e. data distribution) from a static dataset. Due to the exponential increase in the available network data, considerable attention has been received on processing network data as a stream. In this scenario, due to unforeseen circumstances in the network, the phenomenon of concept drift will degrade the performance of the classifier. In this chapter, after measuring the impact of concept drift on network traffic classifiers, we present a concept drift detector based on conditional variational...
