Today's network scale and complexity are constantly rising, bringing tremendous challenges to network operation and maintenance. Network anomaly detection plays a significant role in maintaining large-scale computer networks. It aims to discover abnormal behaviors in network traffic and achieve accurate yet rapid failure detection and root positioning. In network anomaly detection, how to obtain the network status and implement the detection algorithm is the main consideration. To address this problem, we propose INT-Detector, an automated network anomaly detection system combining In-band Network Telemetry (INT) and Deep learning (DL). We first build an INT-based telemetry platform, which enables fine-grained monitoring by acquiring hop-by-hop device information. We then introduce Generative Adversarial Active Learning (GAAL) into the anomaly detection module, which can automatically detect anomalies without over reliance on manual work or expert experience. It also solves the problem of the lack of prior information on volatile network traffic patterns. Besides, in order to reduce the disturbance from traffic jitters on accurate anomaly detection, we use Low Pass Filter (LPF) for data preprocessing to filter out the fluctuations and achieve more precise anomaly detection. The extensive evaluation suggests that the INT-Detector with GAAL achieves 0.944 Area Under Curve (AUC). And the system with GAAL and LPF further reaches 0.969 AUC.

The major contributions are summarized as follows:

1. By defining the interactions and interfaces between the network monitoring infrastructure and data analysis intelligence, to our best knowledge, we propose the first closed-loop automated network anomaly detection architecture INT-Detector with INT and ML integrated.

2. We introduce GAAL into the INT-Detector system, which achieves automating rapid network anomaly detection with high efficiency. And for further improving the detection effect, we use Low Pass Filter to distinguish between normal fluctuations and abnormal fluctuations.

3. We implement an INT-Detector prototype available at the git repository. The extensive evaluation proves that INT-Detector is suitable for anomaly detection. INT-Detector achieves 0.944 AUC with GAAL; it further achieves 0.969 AUC with GAAL and LPF.

This is a demo for INT_Detector. The program mainly includes three modules: monitor, detector, and controller.

Perform network monitoring based on INT and P4.

Define the packet processing logic of the switches.

Build the experimental network with mininet.

Anomaly detection based on GAAL.

Perform abnormal detection with GAAL.

Perform low pass filtering for data.

Implement network control, parse the INT metadata, maintain a database of telemetry data.

Create a table for data storage

Header definitions for sending.

Send probing packet.

Receive probing packet.

Decode the received packet.

Upload the parsing data to the table.

• tensorflow
• Mininet
• BMv2
• p4c
• python
• pyod

1. Get the JSON file:

sudo p4c-bm2-ss --p4v 16 -o json/int.json p4src/int.p4

2. Take the JSON file as input and bring up mininet:

sudo python topo/FattreeTopo.py --json int.json

3. Set up forwarding rules in other terminal:

sh topo/FattreeCommands.sh

1. open tensorflow environment you created:

activate tensorflow(environment name)

2. perform detection demo:

python gaal.py