When smartphones become the enemy: unveiling mobile apps anomalies through clustering techniques

The ever-increasing number of mobile devices connected to cellular networks is heavily modifying the traffic observed in these networks. The traffic volumes and patterns generated by smartphones pose novel challenges to cellular network operators. One of these challenges relates to the automatic detection and diagnosis of unforeseen network traffic anomalies caused by specific devices and apps. Synchronized apps generating flashcrowds, device-specific traffic misbehaviors impacting network performance and end-users Quality of Experience (QoE), and other similar anomalies need to be rapidly detected and diagnosed. In this paper we characterize a new type of anomalies impacting cellular networks, caused by the multiple, constantly-connected apps running in smartphones and other end-user devices. We additionally devise a novel detection and classification technique based on semi-supervised Machine Learning (ML) algorithms to automatically detect and diagnose anomalies of this class with minimal training, and compare its performance to that achieved by other well-known supervised learning classifiers. The proposed solution is evaluated using synthetically generated data from an operational cellular ISP, drawn from real traffic statistics to resemble both the real cellular network traffic and the characterized type of anomalies.