Detecting anomalies in real-time networks

Real-time communication networks are gaining increasing importance, particularly in cyber-physical systems in critical areas such as advanced production facilities or smart energy grids. Similarly, the use of machine learning is expected to play an increasing role in timely anomaly detection.

“The detection of anomalies is an example of successful application of machine learning methods. Algorithms independently recognize patterns and regularities in datasets and can derive solutions from them,” says Peter Dorfinger, Head of the Intelligent Connectivity Research Group at Salzburg Research Forschungsgesellschaft.

Machine learning meets real-time networks

Salzburg Research has developed an end-to-end real-time architecture for anomaly detection. This architecture involves the collection and transmission of the required data, the analysis of this data using a machine learning model, and the subsequent response within a defined timeframe. While previous approaches have already utilized machine learning for anomaly detection, the researchers at Salzburg Research Forschungsgesellschaft incorporate their expertise in real-time communication networks into their approach.

The use of so-called “autoencoder neural networks” (ANNs), a special type of artificial neural network, is employed. They can process unstructured data. “The learning process of the neural network is unsupervised, which means that no labeling of the input data is required. This is a significant advantage as data preprocessing is typically very time-consuming,” adds Dorfinger.

Proof-of-Concept: Neural Network Enables Reconfiguration

The proposed solution by Salzburg Research was designed for two use cases: firstly, the detection of anomalies in network data with real-time reconfiguration of the real-time Ethernet network, and secondly, the detection of anomalies in machine data with real-time reconfiguration of industrial machines. A proof-of-concept has been implemented in the laboratory. “Once our ANN detects an anomaly, it triggers a reconfiguration of the network flows, such as shutting down a network path, switching to an alternative network path, or reconfiguring the machines, for example, by adjusting parameter settings,” says Dorfinger.

In the future, measurements will be conducted to evaluate the proposed architecture in terms of the actual response time from anomaly detection to network or machine reconfiguration. The results will then be compared with measurements from existing anomaly detection systems.