@article { TNSM2022,
	title = {AI Anomaly Detection for Cloudified Mobile Core Architectures},
	journal = {Transactions on Network and Service Management},
	year = {2022},
	month = {08/2022},
	publisher = { IEEE},
	address = {Los Alamitos, California/U.S.A.},
	abstract = {IT systems monitoring is a crucial process for managing and orchestrating network resources, allowing network providers to rapidly detect and react to most impediment causing network degradation. However, the high growth in size and complexity of current operational networks (2022) demands new solutions to process huge amounts of data (including alarms) reliably and swiftly. Further, as the network becomes progressively more virtualized, the hosting of nfv on cloud environments adds a magnitude of possible bottlenecks outside the control of the service owners. In this paper, we propose two deep learning anomaly detection solutions that leverage service exposure and apply it to automate the detection of service degradation and root cause discovery in a cloudified mobile network that is orchestrated by ETSI OSM. A testbed is built to validate these AI models. The testbed collects monitoring data from the OSM monitoring module, which is then exposed to the external AI anomaly detection modules, tuned to identify the anomalies and the network services causing them. The deep learning solutions are tested using various artificially induced bottlenecks. The AI solutions are shown to correctly detect anomalies and identify the network components involved in the bottlenecks, with certain limitations in a particular type of bottlenecks. A discussion of the right monitoring tools to identify concrete bottlenecks is provided.},
	keywords = {5G, AI, Anomaly detection, Autoencoders, deep learning, Mobile networks, Smart Networks},
	issn = {1932-4537},
	doi = {10.1109/TNSM.2022.3203246},
	author = {Foivos Ioannis {Michelinakis} and Joan Sebasti{\`a} {Pujol-Roig} and Malacarne, Sara and Xie, Min and Dreibholz, Thomas and Majumdar, Sayantini and Wint Yi {Poe} and Patounas, Georgios and Guerrero, Carmen and Elmokashfi, Ahmed and Theodorou, Vasileios}
}
@misc { OSMHackfest13,
	title = {Detecting Issues with In-Band Telemetry in OSM-Orchestrated Core Networks},
	howpublished = {ETSI, Virtual},
	year = {2022},
	publisher = {ETSI},
	type = {Demo presentation},
	address = {Virtual},
	abstract = {Open Source MANO is a helpful tool to manage and orchestrate the instantiation of core network setups, like Network Service (NS) instances of our SimulaMet OpenAirInterface Virtual Network Function (VNF) for Enhanced Packet Cores (EPC). We furthermore extended our NS with VNF instances of Programming Protocol-independent Packet Processors (P4) switches, in order to allow for in-band telemetry. With in-band telemetry, it is possible to flexibly add, process, and remove telemetry information to traffic within the packet core, in order to allow for fine-granular evaluation of the system performance and the users{\textquoteright} experienced quality of service. In our presentation and demo, we would like to provide an overview of our ongoing work on P4-based in-band telemetry in an OSM-orchestrated 4G core, which is used for detecting performance problems and anomalies in the network based on machine learning. We would furthermore like to demonstrate the details of our setup to the audience in a live demo.},
	keywords = {Anomaly detection, Network Function Virtualisation (NFV), Open Source MANO (OSM), P4, Telemetry},
	url = {http://osm-download.etsi.org/ftp/osm-11.0-eleven/OSM13_Ecosystem_Day/OSM\%2313\%20Ecosystem\%20Day\%20-\%20SIMULA.pdf},
	author = {Dreibholz, Thomas and Azza Hassan Moh {Ahmed} and Fida, Mah-rukh and Andr{\'e}s Felipe {Ocampo} and Foivos Ioannis {Michelinakis}}
}
@inproceedings { LCN2022-DemoPaper,
	title = {A Live Demonstration of In-Band Telemetry in OSM-Orchestrated Core Networks},
	journal = {Proceedings of the 47th IEEE Conference on Local Computer Networks~(LCN)},
	year = {2022},
	month = {09/2022},
	pages = {245{\textendash}247},
	publisher = { IEEE},
	address = {Edmonton, Alberta/Canada},
	abstract = {Network Function Virtualization is a key enabler to building future mobile networks in a flexible and cost-efficient way. Such a network is expected to manage and maintain itself with least human intervention. With early deployments of the fifth generation of mobile technologies {\textendash} 5G {\textendash} around the world, setting up 4G/5G experimental infrastructures is necessary to optimally design Self-Organising Networks~(SON). In this demo, we present a custom small-scale 4G/5G testbed. As a step towards self-healing, the testbed integrates four Programming Protocol-independent Packet Processors (P4) virtual switches, that are placed along interfaces between different components of transport and core network. This demo not only shows the administration and monitoring of the Evolved Packet Core (EPC) VNF components, using Open Source MANO, but also as a proof of concept for the potential of P4-based telemetry in detecting anomalous behaviour of the mobile network, such as a congestion in the transport part.},
	keywords = {Anomaly detection, Network Function Virtualisation (NFV), Open Source MANO (OSM), P4, Telemetry},
	isbn = {978-1-6654-8001-7},
	author = {Dreibholz, Thomas and Fida, Mah-rukh and Azza Hassan Moh {Ahmed} and Andr{\'e}s Felipe {Ocampo} and Foivos Ioannis {Michelinakis}}
}
@inproceedings {naqvi:2021:adaptive,
	title = {Adaptive Immunity for Software: Towards Autonomous Self-healing Systems},
	journal = { 28th IEEE International Conference on  Software Analysis, Evolution and Reengineering (SANER)},
	year = {2021},
	pages = {521-525},
	publisher = {IEEE},
	abstract = {Testing and code reviews are known techniques to improve the qualityand robustness of software.\&nbsp; Unfortunately, the complexity of modernsoftware systems makes it impossible to anticipate all possibleproblems that can occur at runtime, which limits what issues canbe found using testing and reviews.\&nbsp; Thus, it is of interest toconsider autonomous self-healing software systems, which canautomatically detect, diagnose, and contain unanticipated problemsat runtime.\&nbsp; Most research in this area has adopted a model-drivenapproach, where actual behavior is checked against a model specifyingthe intended behavior, and a controller takes action when the systembehaves outside of the specification.\&nbsp; However, it is not easy todevelop these specifications, nor to keep them up-to-date as thesystem evolves.\&nbsp; We pose that, with the recent advances in machinelearning, such models may be learned by observing the system.Moreover, we argue that artificial immune systems (AISs) areparticularly well-suited for building self-healing systems, becauseof their anomaly detection and diagnosis capabilities.\&nbsp; We presentthe state-of-the-art in self-healing systems and in AISs, surveyingsome of the research directions that have been considered up tonow.\&nbsp; To help advance the state-of-the-art, we develop a researchagenda for building self-healing software systems using AISs,identifying required foundations, and promising research directions.},
	keywords = {Anomaly detection, artificial immune systems, dependability, fault containment, runtime diagnosis, Self-Healing},
	isbn = {978-1-7281-9630-5},
	doi = {10.1109/SANER50967.2021.00058},
	url = {https://ieeexplore.ieee.org/abstract/document/9425979},
	author = {Moeen Ali {Naqvi} and Astekin, Merve and Malik, Sehrish and Moonen, Leon}
}
@misc {28053,
	title = {Anomaly Detection in Optical Links Using State of Polarization Monitoring},
	year = {2021},
	address = {2021 Joint European Conference on Networks and Communications \& 6G Summit, Porto, Portugal},
	keywords = {Anomaly detection, Machine learning, Optical Fibre, State of Polarization},
	url = {https://www.eucnc.eu/poster-a/},
	author = {Bj{\o}rnstad, Steinar and Gulistan, Aamir}
}
@inbook {28006,
	title = {Artificial Intelligence in Gastroenterology},
	booktitle = {Artificial Intelligence in Medicine},
	year = {2021},
	month = {09/2021},
	pages = {1 - 20},
	publisher = {Springer International Publishing},
	organization = {Springer International Publishing},
	address = {Cham},
	abstract = {The holy grail in endoscopy examinations has for a long time been assisted diagnosis using Artificial Intelligence (AI). Recent developments in computer hardware are now enabling technology to equip clinicians with promising tools for computer-assisted diagnosis (CAD) systems. However, creating viable models or architectures, training them, and assessing their ability to diagnose at a human level, are complicated tasks. This is currently an active area of research, and many promising methods have been proposed. In this chapter, we give an overview of the topic. This includes a description of current medical challenges followed by a description of the most commonly used methods in the field. We also present example results from research targeting some of these challenges, and a discussion on open issues and ongoing work is provided. Hopefully, this will inspire and enable readers to future develop CAD systems for gastroenterology.},
	keywords = {Anomaly detection, artificial intelligence, Gastrointestinal endoscopy, Hand-crafted features, Neural Networks, Performance, Semantic segmentation},
	isbn = {978-3-030-58080-3},
	doi = {10.1007/978-3-030-58080-3_163-2},
	url = {https://link.springer.com/referenceworkentry/10.1007\%2F978-3-030-58080-3_163-2},
	author = {Str{\"u}mke, Inga and Hicks, Steven and Thambawita, Vajira and Jha, Debesh and Parasa, Sravanthi and Riegler, Michael and Halvorsen, P{\r a}l},
	editor = {Lidstr{\"o}mer, Niklas and Ashrafian, Hutan}
}
@article {42749,
	title = {DILAF: A framework for distributed analysis of large-scale system logs for anomaly detection},
	journal = {Software: Practice and Experience},
	volume = {49},
	year = {2019},
	month = {02/2019},
	pages = {153-170},
	publisher = { Wiley},
	abstract = {System logs constitute a rich source of information for detection and prediction of anomalies. However, they can include a huge volume of data, which is usually unstructured or semistructured. We introduce DILAF, a framework for distributed analysis of large-scale system logs for anomaly detection. DILAF is comprised of several processes to facilitate log parsing, feature extraction, and machine learning activities. It has two distinguishing features with respect to the existing tools. First, it does not require the availability of source code of the analyzed system. Second, it is designed to perform all the processes in a distributed manner to support scalable analysis in the context of large-scale distributed systems. We discuss the software architecture of DILAF and we introduce an implementation of it. We conducted controlled experiments based on two datasets to evaluate the effectiveness of the framework. In particular, we evaluated the performance and scalability attributes under various degrees of parallelism. Results showed that DILAF can maintain the same accuracy levels while achieving more than 30\% performance improvement on average as the system scales, compared to baseline approaches that do not employ fully distributed processing.\&nbsp;},
	keywords = {Anomaly detection, Big Data, Distributed systems, log analysis, Machine learning, parallel processing, software architecture},
	author = {Astekin, Merve and Zengin, Harun and Sozer, Hasan}
}
@article {lutu2014bgp,
	title = {The BGP Visibility Toolkit: Detecting Anomalous Internet Routing Behavior},
	journal = {IEEE/ACM Transactions on Networking},
	year = {2015},
	month = {04/2015},
	publisher = {IEEE},
	abstract = {In this paper, we propose the BGP Visibility Toolkit, a system for detecting and analyzing anomalous behavior in the Internet. We show that interdomain prefix visibility can be used to single out cases of erroneous demeanors resulting from misconfiguration or bogus routing policies. The implementation of routing policies with BGP is a complicated process, involving fine-tuning operations and interactions with the policies of the other active ASes. Network operators might end up with faulty configurations or unintended routing policies that prevent the success of their strategies and impact their revenues. As part of the Visibility Toolkit, we propose the BGP Visibility Scanner, a tool which identifies limited visibility prefixes in the Internet. The tool enables operators to provide feedback on the expected visibility status of prefixes. We build a unique set of ground-truth prefixes qualified by their ASes as intended or unintended to have limited visibility. Using a machine learning algorithm, we train on this unique dataset an alarm system that separates with 95\% accuracy the prefixes with unintended limited visibility. Hence, we find that visibility features are generally powerful to detect prefixes which are suffering from inadvertent effects of routing policies. Limited visibility could render a whole prefix globally unreachable. This points towards a serious problem, as limited reachability of a non-negligible set of prefixes undermines the global connectivity of the Internet. We thus verify the correlation between global visibility and global connectivity of prefixes.},
	keywords = {Anomaly detection, BGP, Internet measurements, Machine learning},
	doi = {10.1109/TNET.2015.2413838},
	author = {Lutu, Andra and Bagnulo, Marcelo and Pelsser, Cristel and Maennel, Olaf and Cid-Sueiro, Jesus}
}
