PaperlayerView exact revision on arXiv

Source-linked AI summary

AoI-driven Anomaly Detection Framework for Communication Networks

Zia Ul Islam Nasir, Alper Kose, Berna Ozbek

arXiv:2609.11432v1eess.SP

TL;DR

Communication-network anomaly detectors often overlook information freshness, despite its relevance to time-sensitive settings. The paper combines ePAoI-based feature selection with machine-learning models, reporting improved detection performance and reduced input dimensionality relative to a benchmark study.

  • Problem

    Many communication-network anomaly detectors use conventional attributes such as packet loss, delay, and throughput while leaving information freshness out as an explicit behavioral feature.

    Source: §I · p. 1

  • Method

    The framework uses ePAoI-driven feature selection to select a reduced feature set for machine-learning anomaly detection, complementing conventional network-centric features.

    Source: §I · p. 1, C. ePAoI-based Feature Selection · p. 3

  • Results

    More than 50% lower input dimensionality—11 features versus 23 in benchmark study —and the authors report that ePAoI incorporation improves detection performance while maintaining effective performance.

    Source: §III · p. 5

  • Takeaways & Limitations

    The age-aware feature provides additional insight into the freshness of information used for decision making.

    Source: §III · p. 5

Abstract

from arXiv · show

Anomaly detection in communication networks remains a challenge, particularly in time-sensitive environments where stale information can affect system reliability. In this work, we propose an anomaly detection framework that leverages Age of Information (AoI) as a temporal indicator for identifying abnormal network behaviors. The AoI has been studied for network performance optimization, however, its applicability to anomaly detection remains unexplored. The proposed framework integrates a feature selection technique based on the estimated Peak Age of Information (ePAoI) with multiple machine learning models for communication networks as a complementary indicator. The evaluation results demonstrate that ePAoI-based feature selection enhances the performance of the anomaly detection framework while significantly reducing the computational complexity.

I. INTRODUCTION

Time-sensitive networks need reliable monitoring and fresh information, but anomaly detectors often overlook information freshness. The paper introduces AoI-driven feature selection with machine-learning models and validates the framework on an Industrial Control System dataset.

  • Anomaly detection in time-sensitive communication networks is important for safety, stability, and operational efficiency, while resource limits, traffic changes, and link disruptions can degrade information freshness.The motivating settings include industrial systems, smart cities, and cyber-physical environments.Source: §I · p. 1
  • Age of Information (AoI), elapsed time since the latest received update was generated at its source, captures information freshness.Peak Age of Information (PAoI) describes the maximum age immediately before a fresh update arrives.Source: §I · p. 1
  • Existing network anomaly detectors often rely on packet loss, delay, and throughput while overlooking freshness as an explicit behavioral feature.The paper notes that staleness itself may reflect abnormal behavior in dynamic industrial environments.Source: §I · p. 1
  • The paper addresses the unexplored use of AoI-inspired features for communication-network anomaly detection with a framework combining AoI-driven feature selection and multiple machine-learning models.The freshness features complement conventional network-centric features.Source: §I · p. 1
  • The framework is validated using an Industrial Control System dataset.Source: §I · p. 1

II. PROPOSED FRAMEWORK

The proposed framework combines data preparation, ePAoI calculation, feature selection, and machine-learning-based anomaly detection. Its schematic is identified as Fig. 1.

  • Data source and preprocessing are included as stages in the framework architecture.Source: §II · p. 1
  • The framework covers data sourcing and preprocessing, estimated PAoI calculation, feature selection, and machine-learning-based anomaly detection.Source: §II · pp. 1–2
  • Fig. 1 is the schematic of the proposed anomaly detection framework.Source: Figure 1 · p. 2

A. Data Source and Preprocessing

The study considers Industrial Control Systems where timely communication supports safe and efficient operation. It preprocesses heterogeneous device data and represents samples with feature vectors and binary anomaly labels.

  • In Industrial Control Systems, delayed communication can leave controllers acting on outdated information, with potential performance degradation or safety risks.Information freshness is as important as transmission reliability in this setting.Source: A. Data Source and Preprocessing · p. 2
  • The dataset contains streams from sensors, actuators, and controllers; preprocessing handles missing values, normalizes relevant features, and organizes data by source, destination, and protocol.Source: A. Data Source and Preprocessing · p. 2
  • Each sample is represented by a D-feature vector and an associated binary anomaly label indicating whether an anomaly occurred.Source: A. Data Source and Preprocessing · p. 2

B. Estimated Peak Age of Information Calculation

The section presents ePAoI as an estimate of temporal freshness when source-side update-generation times are unavailable. It derives the estimate from observable communication chronology and uses it in the subsequent feature-selection and anomaly-detection process.

B. Estimated Peak Age of Information Calculation

  • PAoI is the maximum AoI immediately before a new update arrives, capturing prolonged reliance on stale information.The section relates larger PAoI values to delayed, disrupted, or irregular communication exchanges in industrial networks.Source: B. Estimated Peak Age of Information… · p. 2
  • ePAoI estimates freshness from observable communication chronology because real datasets lack explicit source-side update-generation times.The earliest observable transmission event in the previous communication record serves as a surrogate reference.Source: B. Estimated Peak Age of Information… · p. 2
  • The resulting ePAoI representation is incorporated into subsequent feature selection and anomaly detection.Source: B. Estimated Peak Age of Information… · p. 2

C. ePAoI-based Feature Selection

The ePAoI-based selector ranks features by their joint predictive contribution with ePAoI, then retains a reduced feature set for anomaly detection. It estimates these relationships from discretized feature and label distributions.

C. ePAoI-based Feature Selection

  • Features are discretized into B equal-frequency bins, with B determined by Sturges’s rule using the total sample count N.Empirical bin probabilities use an indicator that is 1 when a sample falls in the specified bin and 0 otherwise.Source: C. ePAoI-based Feature Selection · p. 3
  • The collaborative score measures joint mutual information between a feature, ePAoI, and the anomaly label, capturing joint relevance when label correlations are weak or heterogeneous.Higher scores indicate greater predictive relevance; the top-ranked features form a reduced vector with K < D.Source: C. ePAoI-based Feature Selection · p. 3
  • The workflow handles missing values, cleans and normalizes the data, computes ePAoI per communication stream, and evaluates models using accuracy, precision, recall, and F1-score.Feature scores are computed and ranked before reduced vectors are constructed and models trained.Source: C. ePAoI-based Feature Selection · p. 3
  • The method ranks features by collaborative score, selects the top K with K < D, and constructs a compact reduced feature vector for model training.The reduced representation is trained alongside ePAoI in the proposed workflow.Source: C. ePAoI-based Feature Selection · p. 3

D. ML based Anomaly Detection

Five machine-learning models are trained on the reduced feature space and evaluated on test data. Their training complexity depends on the model, with kernel-based SVM scaling as O(N^3k).

D. ML based Anomaly Detection

  • Random Forest, Decision Tree, ANN, SVM, and XGBoost are trained on the reduced feature space and evaluated on test data using standard metrics.The models are assessed with effective hyperparameter values.Source: D. ML based Anomaly Detection · p. 3
  • Training complexity scales as O(Nk log N) for DT, O(TNk log N) for RF, O(RNk) for XGBoost, O(ENkH) for ANN, and O(N^3k) for kernel-based SVM.T is the number of trees, R boosting rounds, E epochs, and H hidden layers.Source: D. ML based Anomaly Detection · pp. 3–4

III. PERFORMANCE RESULTS

The evaluation compares machine-learning models using ePAoI-driven feature selection and reports model performance, an ePAoI ablation, and a benchmark comparison of F1-score and inference time.

  • The selected input set combines the top 10 ranked features with ePAoI, reducing dimensionality and training overhead.Source: §III · p. 4, Figure 3 · p. 4
  • XGBoost achieves the highest performance overall, with the highest TPR and lowest FPR among the models.Source: Table II · p. 4, §III · p. 4, Table III · p. 4
  • The ROC curves are concentrated near the top-left corner, indicating accurate anomaly detection with very few false positives.Source: Figure 4 · p. 4, §III · p. 4
  • The ablation results demonstrate the effectiveness of incorporating ePAoI, which also provides insight into information freshness for decisions.Source: Table IV · p. 5, §III · p. 5
  • Compared with benchmark study, the framework uses 11 versus 23 features (>50% fewer); Table V compares F1-score and inference time, supporting efficient detection with effective performance.Source: §III · p. 5, Table V · p. 5

IV. CONCLUSION

The framework combines operational-state and information-timeliness signals for network anomaly detection, with the authors reporting improved accuracy, generalization, and computational efficiency.

IV. CONCLUSION

  • The framework captures both operational state and data timeliness, and the authors report enhanced anomaly-detection accuracy and improved model generalization.The conclusion describes the work as an anomaly-detection framework in an ICS environment.Source: §IV · p. 5
  • The authors report high anomaly sensitivity, computational efficiency, and scalability, and describe the approach as suited to real-time monitoring in complex, data-driven environments.The conclusion also states that the ablation study demonstrates the role of ePAoI.Source: §IV · p. 5
  • Future work will investigate adaptive AoI computation and environment-specific parameterization, while freshness-induced-anomaly datasets would enable more direct and rigorous evaluation.The conclusion identifies robustness across diverse operational settings as a goal of the proposed future strategies.Source: §IV · p. 5
Loading 2609.11432v1…