End-to-end anomaly detection of service function chain through multi-source data in cloud-native systems

Abstract

Cloud native technology enables Network Functions Virtualization (NFV) to dynamically provide and deploy network services to meet specific requirements in Industrial Internet of Things (IIoTs). However, compared to traditional hardware solutions, Service Function Chains (SFCs) are more prone to faults in complex and dynamically changing cloud environments. Existing anomaly detection methods exhibit several shortcomings, including high overhead, low accuracy, and limited detection scope. To address these challenges and ensure service quality, we propose an end-to-end SFC anomaly detection architecture, cSFCAD. First, to overcome the limitations of detection range and single-function detection, the cSFCAD architecture integrates multi-source data from both the data plane and control plane, enabling the effective detection of various types of SFC anomalies. Second, to better capture the spatial relationships of Cloud-Native Network Functions (CNFs) within the SFC, we adopt an encoder based on the self-attention mechanism, which models the behaviour of CNFs and their interdependencies. Finally, to improve the stability of model in dynamic cloud environment, we use adversarial training in order to achieve self-conditioning for robust multi-modal feature extraction and enhanced stability. Additionally, through data reconstruction, we can precisely identify the key metrics contributing most to the anomalies. The difference between the input data and its reconstructed output helps in analysing the underlying causes of the anomalies. Extensive experimental research on two public datasets demonstrates that cSFCAD architecture outperforms existing anomaly detection algorithms.