Near Real-Time Anomaly Detection in NFV Infrastructures

This paper presents a scalable cloud-based architecture for near real-time anomaly detection in the Vodafone NFV infrastructure, spanning across multiple data centers in 11 European countries. Our solution aims at processing in real-time system-level data coming from the monitoring subsystem of the infrastructure, raising alerts to operators as soon as the incoming data presents anomalous patterns. A number of different anomaly detection techniques have been implemented for the proposed architecture, and results from their comparative evaluation are reported, based on real monitoring data coming from one of the monitored data centers, where a number of interesting anomalies have been manually identified. Part of this labelled data-set is also released under an open data license, for possible reuse by other researchers.