PaperlayerView exact revision on arXiv

Source-linked AI summary

Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges

Muhammad Usama, Junaid Qadir, Aunn Raza, Hunain Arif, Kok-Lim Alvin Yau, Yehia Elkhatib, Amir Hussain, Ala Al-Fuqaha

arXiv:1709.06599v1cs.NIcs.LG

TL;DR

Operational networking has relatively few unsupervised-learning applications despite substantial research and applications in other fields. This paper surveys unsupervised learning techniques and networking applications, synthesizes prior surveys with recent advances, and discusses future directions and pitfalls.

  • Problem

    Operational networks have relatively few practical machine-learning applications, with challenges including costly errors, limited training data, a semantic gap, variable inputs, and difficult evaluation.

  • Method

    The paper provides a comprehensive survey of unsupervised-learning tasks, techniques, trends, and networking applications while synthesizing prior surveys and contemporary advances.

  • Results

    The survey describes unsupervised-learning applications across networking tasks and discusses future directions, open research issues, and potential pitfalls.

  • Takeaways & Limitations

    The survey addresses the scarcity of networking literature by organizing recent unsupervised-learning advances and their applications for networking tasks.

  • Takeaways & Limitations

    Because of the versatility and evolving nature of computer networks, the survey could not cover every application.

Abstract

from arXiv · show

While machine learning and artificial intelligence have long been applied in networking research, the bulk of such works has focused on supervised learning. Recently there has been a rising trend of employing unsupervised machine learning using unstructured raw network data to improve network performance and provide services such as traffic engineering, anomaly detection, Internet traffic classification, and quality of service optimization. The interest in applying unsupervised learning techniques in networking emerges from their great success in other fields such as computer vision, natural language processing, speech recognition, and optimal control (e.g., for developing autonomous self-driving cars). Unsupervised learning is interesting since it can unconstrain us from the need of labeled data and manual handcrafted feature engineering thereby facilitating flexible, general, and automated methods of machine learning. The focus of this survey paper is to provide an overview of the applications of unsupervised learning in the domain of networking. We provide a comprehensive survey highlighting the recent advancements in unsupervised learning techniques and describe their applications for various learning tasks in the context of networking. We also provide a discussion on future directions and open research issues, while also identifying potential pitfalls. While a few survey papers focusing on the applications of machine learning in networking have previously been published, a survey of similar scope and breadth is missing in literature. Through this paper, we advance the state of knowledge by carefully synthesizing the insights from these survey papers while also providing contemporary coverage of recent advances.

I. INTRODUCTION

Networking is increasingly too dynamic and complex for manual management, while supervised ML is constrained by costly, quickly outdated labels. This survey introduces unsupervised ML techniques and reviews their networking applications, future opportunities, and pitfalls.

  • Motivation: Growing network complexity makes manual administration less amenable to managing and optimizing modern networks.Internet and mobile telecom networks are described as increasingly dynamic, heterogeneous, and complex.
  • Motivation: Supervised ML methods are limited by their need for labeled data, which is expensive to curate and can become outdated quickly.Networking data is increasingly voluminous, with a disproportionate rise in unstructured unlabeled data.
  • Networking applications: Unsupervised ML is presented as a complement to supervised ML for more efficient network management, monitoring, and self-optimization with administrators kept in the loop.Routing is one example where models can account for real-time congestion and application QoS requirements.
  • Unsupervised learning: Unsupervised ML can analyze raw unlabeled network data for feature learning, clustering, dimensionality reduction, anomaly detection, and related tasks.The approach is motivated by advances in hierarchical learning, clustering, factor analysis, latent models, and outlier detection.
  • Scope and organization: The paper surveys hierarchical learning, clustering, latent variable models, outlier detection, and reinforcement learning, then reviews their networking applications.The survey also discusses future work and opportunities and identifies major pitfalls.

1) Unsupervised Multilayer Feed Forward NN:

The paper presents unsupervised neural-network families that learn representations, remove redundancy, preserve topology, or incrementally form clusters. These include feed-forward networks with autoencoders, competitive methods such as SOM, and ART models.

  • Unsupervised Multilayer Feed Forward NN: Unsupervised multilayer feed-forward neural networks use directed acyclic topologies to approximate nonlinear mappings between inputs and required outputs.Autoencoders are identified as prime examples of this network family.
  • Unsupervised Multilayer Feed Forward NN: Autoencoders learn compressed, encoded representations by reconstructing input data, supporting dimensionality reduction and unsupervised pre-training.Variants include variational, sparse, and denoising autoencoders for clustering, visualization, feature extraction, manifold learning, and reconstruction.
  • Unsupervised Competitive Learning NN: Competitive-learning neural networks use winner-take-all competition to remove redundancies from unstructured data.Self-organizing maps and adaptive resonance theory networks are the two major techniques described.
  • Unsupervised Competitive Learning NN: Self-organizing maps represent high-dimensional data in lower-dimensional topological spaces while preserving input-data topology.Their training proceeds through competition, cooperation among neighboring neurons, and adaptation.
  • Unsupervised Competitive Learning NN: Adaptive resonance theory performs incremental clustering by automatically discriminating and creating new multidimensional categories as new information arrives.Its operation compares top-down expectations with bottom-up sensory information using a vigilance threshold and reset mechanism.

3) Unsupervised Deep NN:

Unsupervised deep neural networks learn representations from unlabeled data through architectures including deep belief networks, autoencoders, convolutional networks, recurrent networks, and related models. These methods support networking tasks such as traffic classification, anomaly and intrusion detection, DDoS detection, resource management, and QoE/QoS optimization.

  • Architectures: Unsupervised deep neural networks include deep belief networks, deep autoencoders, and convolutional neural networks.Deep belief networks use hierarchical stochastic latent variables; autoencoders encode and reconstruct inputs; convolutional networks extract transformation-invariant features.
  • Architectures: Deep autoencoders compress inputs into a central feature vector by encoding and then reconstructing the input.The encoder and decoder are formed from two symmetric deep belief networks.
  • Networking applications: Convolutional architectures can support QoE and QoS optimization for multimedia delivery, while scalable generative models learn hierarchical representations from high-dimensional unlabeled data.The cited CDBN combines properties of deep belief and convolutional networks and is presented as a promising scalable model.
  • Recurrent and recurrent-derived models: Recurrent neural networks model sequential inputs using internal memory, enabling them to learn temporal behaviors.Unlike feed-forward networks, recurrent networks are stateful and incorporate prior events into subsequent processing.
  • Recurrent and recurrent-derived models: Unsupervised recurrent neural networks lack a single widely adopted training approach, motivating diverse training methods including LSTM-based approaches.One cited approach trains LSTM recurrent networks using Binary Information Gain Optimization and Non-Parametric Entropy.
  • Networking applications: Hierarchical neural models are applied to traffic classification, anomaly and intrusion detection, DDoS detection, and cognitive-radio resource management.A hybrid ART–RNN model learns and predicts network traffic volume in real time, supporting adaptive flow control without retraining the entire network.

B. Data Clustering

Data clustering discovers meaningful groupings in unlabeled network data by maximizing within-cluster similarity and separating clusters from one another. Networking applications include traffic analysis, packet tracing, and anomaly detection, while clustering taxonomies distinguish hierarchical, Bayesian, partitional, density-based, and grid-based approaches.

  • Clustering concepts: Clustering organizes unlabeled data into natural groups with high intra-cluster and low intercluster similarity.The resulting structured representation is termed a data-concept.
  • Networking applications: Clustering is widely used in networking for traffic analysis and anomaly detection across wireless sensor, mobile ad hoc, and other networks.These applications exploit clustering to identify structure in network data.
  • Networking applications: Expectation-Maximization probabilistic clustering groups network flows into a small number of representative clusters for traffic analysis.The packet-tracing approach uses representative clusters to analyze network traffic efficiently.
  • Clustering taxonomy: The taxonomy distinguishes hierarchical, Bayesian, and partitional clustering, with Bayesian methods modeling test-point assignments probabilistically.Hierarchical methods decompose data, whereas partitional methods construct multiple partitions evaluated by a criterion.
  • Clustering taxonomy: Density-based clustering separates densely populated regions from low-density areas, and is treated separately because of its networking applications.Grid-based clustering is also identified as a distinct technique before the main taxonomy discussion.
  • Hierarchical clustering: Hierarchical clustering avoids specifying the number of clusters beforehand but commonly has at least quadratic complexity and can mishandle messy high-dimensional data.Common agglomerative hierarchical algorithms are described as NP-hard, whereas K-means and EM have linear complexity.
  • Bayesian clustering: Bayesian clustering learns posterior data distributions from prior probabilities and is divided into parametric and non-parametric strategies.The distinction concerns whether the parameter space has finite or otherwise unrestricted dimensionality.

3) Partitional Clustering:

Partitional clustering decomposes observations into disjoint clusters, principally through K-means and mixture models. K-means supports intrusion detection with reported detection above 96% and false alarms below 4%, while mixture models address heuristic design limitations and support network-structure inference.

  • Partitional clustering: Partitional clustering partitions n observations into k < n disjoint clusters and includes K-means clustering and mixture models.Each observation is assigned within a decomposition into separate groups.
  • K-means clustering: K-means assigns observations to the nearest cluster using cluster means as reference points.It takes statistical vectors as input to derive classification models or classifiers.
  • K-means clustering: Detection rate stays above 96% while false alarm rate stays below 4% for a K-means intrusion-detection algorithm on a KDD-99 subset.The experiments also reported better ability to search clusters globally.
  • K-medoids clustering: K-medoids uses the most centrally located data point rather than the cluster mean as its reference point.The method has applications in anomaly detection.
  • Mixture models: Mixture models infer sub-population properties from pooled observations and naturally model data generated by alternative random sources.Finite mixtures infer source parameters from observations, producing clusters without relying solely on heuristic clustering choices.
  • Mixture models: Mixture-model clustering addresses drawbacks of heuristic methods and can efficiently classify nodes in large-scale networks.K-means and hierarchical agglomerative methods rely on design decisions such as the number of clusters or model validity.
  • Mixture models: Combining EM with mixture models helps decipher the structure and topology of vertices connected through multidimensional networks.A Gaussian mixture model is reported to outperform signature-based anomaly detection in network traffic data.

3) Blind Signal Separation:

Blind signal separation identifies independent source signals from mixed inputs with little information about the mixing process. Related latent-variable methods—including PCA, ICA, NMF, HMMs, Bayesian models, and probabilistic graphs—support dimensionality reduction, feature extraction, anomaly detection, and traffic classification in networking.

  • Blind Signal Separation: Blind Signal Separation identifies and separates independent source signals from mixed inputs without or with very little mixing-process information.The process extracts source signals from a mixture and is used across multidimensional data processing.
  • PCA: PCA orthogonally transforms n correlated variables into k uncorrelated principal components ordered by descending variability.The first component captures the greatest variability and the last captures the least.
  • PCA: PCA reduces n-dimensional input data to k dimensions while retaining critical information, with one cited design retaining 99% of variance.The number of components is a design decision and may be selected using methods such as cross-validation approximations.
  • ICA: ICA separates multivariate inputs into additive components under the assumption that components are non-Gaussian and statistically independent.Unlike PCA’s variance-based approach, ICA exploits non-Gaussian features and maximizes the fourth moment of linear combinations.
  • NMF: NMF factorizes a large nonnegative matrix into smaller nonnegative matrices whose product approximately reconstructs the original.This decomposition exposes hidden patterns and intrinsic features and supports exploratory analysis.
  • Temporal and probabilistic models: HMMs model temporal or dynamic processes when actual states are not directly observable, including primary-user arrivals in cognitive-radio networks.They represent Markovian stochastic processes without direct access to the underlying states.
  • Temporal and probabilistic models: Bayesian learning estimates posterior distributions over parameter settings, while probabilistic graph models represent random variables and their dependencies through nodes and edges.These methods are applied to traffic classification, host-level intrusion detection, and anomaly-related feature selection.
  • Networking applications: Networking applications of PCA and NMF include Internet traffic classification, intrusion detection, anomaly detection, and wireless-sensor-network clustering.PCA is also used for probabilistic anomaly confidence, while NMF factorizes flow features before clustering anomalies and intrusions.

D. Dimensionality Reduction

Dimensionality reduction extracts lower-dimensional representations from high-dimensional data, supporting visualization, modeling, compression, and feature extraction. The section surveys linear and nonlinear approaches, including manifold-preserving methods.

  • Dimensionality reduction seeks essential patterns by extracting intrinsic dimensions from datasets with potentially thousands or millions of correlated dimensions.It creates representative functional dimensions rather than selecting a subset of original features.
  • Dimensionality reduction supports data modeling, compression, visualization, and learning by eliminating redundant dimensions and simplifying data representation.
  • Linear methods such as PCA and ICA may miss nonlinear structure because they assume high-dimensional points lie on a linear subspace.
  • Isomap combines PCA and MDS features to learn low-dimensional nonlinear manifold structure using geodesic distances along shortest paths.
  • Other nonlinear techniques include GTM, LLE, and principal curves for probabilistic mapping, manifold visualization, feature extraction, and dataset summarization.GTM models latent points through reference vectors, LLE preserves higher-dimensional embeddings, and principal curves summarize multidimensional data with smooth curves.

5) Nonlinear Multi-dimensional Scaling:

The section presents nonlinear representation methods and unsupervised outlier-detection approaches, then introduces reinforcement learning for optimization in dynamic network environments. These methods address structure discovery, anomaly scoring, and adaptive decisions.

  • 5) Nonlinear Multi-dimensional Scaling:: NMDS finds low-dimensional configurations that preserve similarities and dissimilarities without imposing factor analysis’s multivariate-normal assumption.
  • 5) Nonlinear Multi-dimensional Scaling:: t-SNE represents high-dimensional data in 2 or 3 dimensions by minimizing the KL divergence between high- and low-dimensional probability distributions.
  • Unsupervised outlier detection commonly uses nearest-neighbor or clustering-based techniques to identify samples distant from surrounding data.
  • Outlier detection estimates distances and densities in non-annotated data and supports intrusion detection, fraud detection, leakage prevention, surveillance, and anomaly analysis.
  • Reinforcement learning learns actions for dynamic operating environments by having an agent observe states and rewards and progressively improve decisions.
  • Deep reinforcement learning combines reinforcement learning with deep neural networks and can operate where handcrafted features are unavailable.

1) Multi-agent Reinforcement Learning:

Multi-agent reinforcement learning extends individual-agent reinforcement learning by sharing information among agents to learn joint actions that maximize global network performance. The section also covers scalability, convergence, Q-learning, and networking applications.

  • 1) Multi-agent Reinforcement Learning:: MARL enables agents to exchange information such as Q-values and rewards, learning joint actions that maximize global rather than local performance.
  • Tabular reinforcement learning becomes storage-intensive because the number of state-action pairs grows exponentially as states and actions increase.
  • Function approximation reduces this burden by representing state-action Q-values with features and a weight vector instead of a full table.
  • Increasing the learning rate can accelerate convergence but may cause Q-value fluctuations when current rewards change substantially in dynamic environments.
  • Q-learning is a model-free approach that maps environmental states to actions and incrementally improves Q-value estimates without constructing a stochastic environment model.
  • Networking applications include multi-agent target tracking, channel-state representation, malicious-node detection, and fuzzy Q-learning for QoS-oriented cell association.
  • The review identifies reinforcement learning for network management and optimization as a potential research area.

A. Internet Traffic Classification

Unsupervised learning supports Internet traffic classification and anomaly or intrusion detection by extracting structure from unlabeled, complex, and evolving network traffic. The surveyed methods include feature selection, clustering, neural models, and anomaly profiling.

  • A. Internet Traffic Classification: Internet traffic classification helps providers understand quality of service, user behavior, network security, and broader network characteristics.
  • A. Internet Traffic Classification: Unknown intrusions are increasingly difficult to address because evolving malware can use dynamic port negotiation, making traditional port-based classification obsolete.
  • A. Internet Traffic Classification: Traffic classification recognizes packet destinations and enables flow control actions such as prioritizing one flow over another.
  • A. Internet Traffic Classification: Feature selection is a complex first step affected by large datasets and imbalanced traffic classes; proposed methods include ensemble and information-theoretic schemes.
  • A. Internet Traffic Classification: An unsupervised autoencoder learned latent feature representations that improved state-of-the-art results for malware classification and anomaly detection.
  • A. Internet Traffic Classification: Unsupervised traffic-classification approaches include EM clustering, first-five-packet analysis, correlation-based methods, K-means flow clustering, and neural generative models.
  • A. Internet Traffic Classification: A deep belief network combined with a Gaussian model outperformed the previous maximum-likelihood estimation technique for wireless mesh backbone traffic prediction.
  • B. Anomaly/Intrusion Detection: Signature-based detection identifies known attacks from stored signatures but cannot feasibly maintain signatures for all evolving attacks.

C. Network Operations, Optimizations and Analytics

The survey presents unsupervised learning applications for network operations, optimization, QoS/QoE, and throughput improvement, using unlabeled data and adaptive models.

  • Network management covers initializing, monitoring, and managing network functions, while optimization studies apply unsupervised learning to operational tasks.
  • QoS/QoE Optimization: QoS measures quantitative service performance, whereas QoE captures qualitative end-user experience, making both important for Internet service optimization.
  • QoS/QoE Optimization: Unsupervised feature learning can be combined with supervised classification to adapt Internet services to changing real-time network conditions.
  • QoS/QoE Optimization: 43% of bit overhead on average can be reduced per web-delivered image using VoQS and unsupervised clustering of large image datasets.
  • Model-based and multi-agent reinforcement learning improve throughput by modeling environments, generating virtual rewards, and collaboratively selecting next-hop nodes.

2) TCP Optimization:

The survey reviews dimensionality reduction and visualization methods for networking applications, including anomaly detection, fault prediction, reliability analysis, and routing.

  • TCP Optimization: TCP congestion-control algorithms can be sub-optimal in hybrid wired/wireless networks, motivating optimization research.
  • Dimensionality Reduction & Visualization: Dimensionality reduction reduces network variables to support anomaly detection, intrusion detection, reliability analysis, fault prediction, and visualization.
  • Dimensionality Reduction & Visualization: Unsupervised autoencoders, PCA, multi-scale PCA, wavelet analysis, and robust PCA have been applied to extract features and separate anomalous traffic.
  • Dimensionality Reduction & Visualization: Autoencoders and deep belief networks support cellular-network fault prediction and reliability analysis for self-organizing networks.
  • Dimensionality Reduction & Visualization: PCA and t-SNE extract structure from high-dimensional networking data for lower-dimensional visualization and human decision-making.
  • Dimensionality Reduction & Visualization: A deep-learning routing technique outperforms conventional OSPF in throughput and average delay per hop.

E. Emerging Networking Applications of Unsupervised Learning

Emerging networking architectures use unsupervised learning to support programmable, self-organizing, and large-scale intelligent networks. The survey also identifies operator-facing automation and several open research directions.

  • Software Defined Networks: SDN simplifies network operation by making networks programmable and decoupling data-forwarding and control or decision planes.
  • Software Defined Networks: Unsupervised learning in SDN includes intrusion detection, security-attack mitigation, and prediction of unknown anomalies in cloud environments.
  • Self Organizing Networks: SONs learn from their surroundings to support self-configuration, self-healing, and self-optimization as connected devices and femtocells expand.
  • Internet of Things: IoT requires machine learning to analyze data and make intelligent decisions at the extremely large scale of billions of future devices.
  • Lessons Learnt: The review recommends clustering with autoencoder-based latent representations for unsupervised Internet traffic classification and identifies generative and transfer learning as underexplored.
  • Simplified Network Management: The semantic gap between machine-learning results and actionable operator insights must be overcome to shift network management from reactive monitoring toward proactive reports and notifications.

B. Semi-Supervised Learning for Computer Networks

The section surveys related learning approaches that extend or complement unsupervised learning in networking, including semi-supervised, transfer, federated, and adversarial methods. It also introduces shortcomings and practical considerations associated with unsupervised learning.

  • Semi-Supervised Learning: Semi-supervised learning combines unlabeled data with a small set of labeled examples and is used partly for anomaly detection and traffic classification.It is also identified as having potential with deep unsupervised architectures such as generative adversarial networks.
  • Transfer Learning: Transfer learning applies knowledge learned from one problem to a different but related problem and has potential in networking despite limited observed implementation.The passage gives wireless caching for backhaul offloading in 5G networks as an example.
  • Federated Learning: Federated learning distributes processing across machines without centralized training data, with stated benefits for user-data privacy and reduced cloud computation.The section also cites applications involving network address management, federated healthcare, and federated cloud and IoT security.
  • Pitfalls and Caveats: The section emphasizes that unsupervised learning has shortcomings, including technique-selection risks, feature or parameter-selection problems, and interpretability barriers.Deep neural networks may operate as black boxes, creating a trade-off between prediction accuracy and simplicity.

C. Lack of Operational Success of ML in Networking

Operational networking has adopted relatively few practical ML solutions despite substantial research and applications elsewhere. The section attributes this gap to costly errors, limited training data, operational interpretation challenges, variable inputs, evaluation difficulties, and several modeling pitfalls.

  • Lack of Operational Success of ML in Networking: Operational networks have relatively few practical ML solutions, particularly for intrusion detection, despite substantial academic research and applications in other fields.The cited challenges include high error costs, limited training data, semantic gaps, variable inputs, and difficult evaluations.
  • Lack of Operational Success of ML in Networking: Researchers should verify that ML offers value beyond simpler non-ML solutions, because ignoring operational realities can undermine effectiveness.The paper frames ML solutions as augmenting and supplementing, rather than automatically replacing, existing approaches.
  • Overfitting: Overfitting occurs when an unsupervised model represents noise or random error instead of the actual data pattern.Performance is expected to improve with more data but deteriorate after model complexity becomes excessive; unoptimized out-of-the-box algorithms can also worsen with increasing data.
  • Data Dependence and Quality: ML performance depends strongly on data nature, volume, quality, and representation, while class imbalance can seriously affect results.A dataset is imbalanced when one class has substantially fewer or more samples than other classes.
  • Model and Evaluation Challenges: Accurate generic unsupervised models are difficult to build because algorithm suitability is application-specific and clustering often lacks known cluster counts or ground truth.Hierarchical clustering may also have an unclear stopping point, increasing process time complexity.
  • Adversarial Settings and Safeguards: Adversarial anomaly-detection settings can defeat models trained on historical data when attackers deliberately craft inputs to circumvent previously learned schemes.The paper recommends context-appropriate safeguards including pipeline testing, visualization, regularization, dropout, and human sanity checks.
  • Conclusions: The survey covers major unsupervised networking applications and techniques, while acknowledging that evolving networks make exhaustive coverage impossible.It also discusses future work, open research areas, pitfalls, and challenges.
Loading 1709.06599v1…