The fault diagnosis in a modern communication system is traditionally supposed to be difficult, or even impractical for a purely data-driven machine learning approach, for it is a humanmade system of intensive knowledge. A few labeled raw packet streams extracted from fault archive can hardly be sufficient to deduce the intricate logic of underlying protocols. In this paper, we supplement these limited samples with two inexhaustible data sources: the unlabeled records probed from a system in service, and the labeled data simulated in an emulation environment. To transfer their inherent knowledge to the target domain, we construct a directed information flow graph, whose nodes are neural network components consisting of two generators, three discriminators and one classifier, and whose every forward path represents a pair of adversarial optimization goals, in accord with the semi-supervised and transfer learning demands. The multi-headed network can be trained in an alternative approach, at each iteration of which we select one target to update the weights along the path upstream, and refresh the residual layer-wisely to all outputs downstream. The actual results show that it can achieve comparable accuracy on classifying Transmission Control Protocol (TCP) streams without deliberate expert features. The solution has relieved operation engineers from massive works of understanding and maintaining rules, and provided a quick solution independent of specific protocols. A telecommunications network is a collection of distributed devices, entirely designed and manufactured by humans for a variety of transmission, control and management tasks, striving to provide a transparent channel between external terminals, via an actual internal relay process node by node. As a typical conversation in the style of client and server, the two linked nodes send their messages in the form of packets, encapsulated the load with miscellaneous attributes in headers to ensure the correctness, consistency, and smoothness of the entire process. A typical header includes packet sequence number, source and destination addresses, control bits, error detection codes, etc.The large-scale network cannot always work ideally, due to its inherent complexity inside massive devices and their interactions. When there is a malfunction of a device, either caused by the traffic overload, or software bugs, or hardware misconfiguration, or malicious attacks, it will be reflected on the packet streams that pass through, such as packet loss, timeout, out of order, etc. System administrators captured those suspicious streams and sent back to the service center for cautious offline analysis, which is time-consuming and domain-specific.The primary challenge of automatic diagnosis is that, it is almost impossible to formalize all the logic inside the system and make them available to artificial intelligence. A typical modern communication system consists of tens of thousands devices end-to-end and runs based on a list of hundreds of protocols layer-by-layer BID6 ). If we could figure out the latent states of protocols by constructing specific features from raw bytes, the subsequent classification tasks would be quite straightforward and easy to implement. For instance, the Transmission Control Protocol (TCP) relies on sequence numbers to judge the receiving order of packets, which may be just big integers roughly linearly growing from the view of machine learning models. Another example is a few critical control bits may reside among much more useless bits, such as checksum codes, which is harmful noises for models. Even we have the patience to dive into all the industrial protocols and build up an exhausted feature library; eventually, we will fail again to achieve the target of automation, one of the main advantages of the modern data-driven approach.Another difficulty is scarce of labeled samples. In spite of there are seemingly numerous packet flows running through the Internet all the time, the real valid faults occur at random and occupy only a tiny portion of whole traffic volume. The actual labeled data are usually collected from the archive of fault cases, which is hard to have enough samples for all possible categories, or cannot at least cover them completely.The previous works on this issue mainly follow two technical routes: 1) a traditional two-phase framework, using expert features and some general-propose classifiers BID1 ); 2) an end-to-end approach based on deep learning for automatic feature extraction (Javaid et al. (2016) ). All these prior arts seldom use the generative models, which is usually more promising for expressing structural relationship among random variables. And they may fuse 1-2 data sources in semi-supervised setting (Javaid et al. (2016) ), but not scale to even more data sources.In this paper, we resort to a generative model to mimic the messages in a terminals conversation and enrich the target data domain from two abundant but different information sources: labeled but from simulation, and genuine but unlabeled. The transfer and semi-supervised demands are integrated into an intuitive framework, composed of a connected graph of multiple simple Generative Adversarial Networks (GANs)' components, trained in an alternative optimization approach. The contribution of this paper includes: 1) combine three kinds of data sources in a generative approach, to solve the small-sample problem with a simulation environment; 2) extend the two players in usual GANs to a system of multiple ones, still keeping its merit of end-to-end training; 3) verify its effect on our practice problem of packet sequence classification.The left of paper is organized as below: first, we introduce the previous work selectively in network anomaly detection and the research frontier in the generative neural network. Next, we present the model and algorithm in detail with feature design at different levels. The results of experiments are followed in Section 4. Finally, we conclude the whole article. In this paper, the widely used semi-supervised and transfer learning requirements have been implemented in an integrated way, via a system of cooperative or adversarial neural blocks. Its effectiveness has been verified in our application of packet flow classification, and it is hopeful to be a widely adopted method in this specific domain. The work also prompts us that, complex machine learning tasks and their compound loss functions can be directly mapped into connected networks, and their optimization process can be designed over an entire graph, rather than each individual's hierarchical layers. In future work, we may study how to apply this approach to even larger scale tasks, and make a theoretical analysis of the existence of equilibrium and why we can always reach it.
semi-supervised and transfer learning on packet flow classification, via a system of cooperative or adversarial neural blocks
{"src": "scitldr-AIC_train", "paper_id": "SJjADecmf"}