The Promise of Applying Machine Learning Techniques to Network Function Virtualization

1. Introduction

Network Function Virtualization [1–3] has recently gained increading attention as this technology allows for greater network flexibility and time/cost reduction to introduce new services. Thanks to NFV, network functions, like load balancers, WAN optimizers and Intrusion Detection Systems (IDSs), that were traditionally provided by dedicated and special-purpose hardware can now be implemented by software running on virtual machines or containers in a cloud computing infrastructure. In this way, these Virtualized Network Functions (VNFs) can be relocated and instantiated at different regions without requiring the purchase and installation of new hardware [4, 5]. Moreover, by separating the software from the hardware, the infrastructure resources can be shared and reassigned efficiently to allow faster deployment of network services over the same physical platform.

Despite the excessive speed at which NFV is being accepted by both academia and industry, this technology is still in its infancy and faces critical issues. Main challenges concern resource management and orchestration, security and fault tolerance in addition to energy savings [6]. The use of ML techniques to solve such problems is an effervescent and attractive research field. Machine learning is a branch of artificial intelligence that allows computer systems to learn directly from examples and data. It helps making sense of the available data by extracting valuable information. Thanks to recent advances in network architecture and telemetry, the modeling and implementation of ML techniques in the network environment has become easier and more efficient. Specifically, the Software Defined Network (SDN) paradigm [7] decouples the “data plane” from the “control plane” and thus enables central control of the network [8]. Current data plane elements (routers, switches etc.) are equipped with more powerful storage and computing techniques able to gather richer data monitoring view of the network [9]. These conditions ease and ameliorate learning about the network to better supervise it.

The purpose of this paper is to discuss the benefits and limitation of applying such techniques in the NFV ecosystem by surveying existing approaches. The objective is to alert the research community to the potential role that ML could play in resolving problems related to NFV. Note that many good surveys have already investigated the ML applications to different domains linked to NFV like the Cloud Computing in [10–14], the SDN [15], the Big data in [16, 17] the Internet of Things in [18, 19] and for networking in general [20]. However, applying machine learning to NFV and adapting them to this technology still requires further study.

Our study reveals that current ML applications to NFV focus mainly on \( i) \) resource management and \( ii) \) anomaly detection. This paper provides an extensive and comprehensive survey of existing contributions and discusses potential opportunities for ML. We belief that this work can be useful to the research communities of both Machine Learning and Networks.

As showed on the road-map below, this paper is structured in seven parts (Figure 1): After introducing the NFV and machine learning concepts in sections 2 and 3, we move, in sections 4 and 5, to analyzing ML application on two main challenges faced by NFV which are efficient resource management and fault/anomaly detection. Section 6 provides a fruitful discussion on challenges and opportunities on ML for NFV, and section 7 concludes the paper.

Figure 1. The road-map of this paper.

2. Introduction to NFV

In this section, we provide a short background on NFV, including relevant aspects like its architectural framework.

2.1. Principle

Network Function Virtualization decouples the physical network equipments from the functions that run on them. Hence, these network functions can be implemented as an instance of software running on one or more physical servers. Thus, a network service like a Content Delivery Network transporting live and on demand video traffic to end customers can be decomposed into a set of Virtual Network Functions (VNFs) like service classifier, firewall, anti-virus, Video optimize and parental control, that can be implemented on virtual machines running in a cloud infrastructure. These VNFs may then be relocated at different regions without the need to deploy and configure new physical equipments, or may be consolidated into high volume servers and storage. In this way, NFV promises Telecommunication Service Providers (TSPs) capital expenditures (CAPEX) and operational expenditures (OPEX) savings in addition to scalability and high flexibility in the management of the network. It also brings benefits to the users by allowing the on-demand provision and execution of customized network functions.

2.2. Architecture

The NFV concept was born on 2012 from the collaboration of a number of the world’s leading TSPs with the objective of building more dynamic and service aware networks. The European Telecommunications Standards Institute (ETSI) [21] was later selected to be the home of the Industry Specification Group for NFV (ETSI ISG NFV). ETSI aims to produce requirements and potential specifications that TSPs can follow to implement efficient VNF solutions. Namely, ETSI NFV [22] defines the architecture of NFV by means of three functional entities: the Network Function Virtualization Infrastructure (NFVI), the Virtual Network Functions and the NFV Management and Orchestration (NFV MANO). These components displayed in Figure 2 are described down:

● The NFVI is the set of hardware and software components which build up the environment in which the VNFs are deployed. The physical resources provide compute, storage and network components to VNFs. These resources are abstracted through a virtualization layer. The virtualized resources may be represented as virtual machines connected by virtual links.

● A VNF is an implementation of a network function (like DHCP, firewall, etc.) on virtual resources. It may be composed of multiple internal components and thus may be deployed over different VMs. The VNFs are usually connected together to support a required service.

● The MANO is responsible for the management of the NFVI and the life cycle of the instantiated VNFs. It includes the required functionalities for the configuration and orchestration of VNFs respecting the deployment model and the properties of the supported service.

While both industry and academia adopt NFV at remarkable speed, its development is still at early stage and many questions remain open. Different techniques are used to solve these problems and one particularly interesting and promising one is machine learning, introduced below.

Figure 2. A simplified architecture of NFV.

3. Introduction to Machine Learning

Machine learning (ML) is an important area of artificial intelligence. ML tries to construct intelligent algorithms and models able to learn and deal with new situations without being explicitly programmed. This is achieved by extracting valuable information from the data to retrieve knowledge and intelligence. ML has reached unprecedented levels of performance in various applications, including computer vision applications [23–27], cybersecurity [28], robotics [30].

Generally, the field of machine learning is divided into three subdomains, as shown in Figure 3 : \( i) \) supervised learning (SL) \( ii) \) unsupervised learning (USL) and \( iii) \) reinforcement learning (RL). It is worth to say that the majority of practical ML uses supervised learning. Supervised learning and unsupervised learning are often used for data analysis while reinforcement learning is preferred for decision-making problems. Below, we give more detail for each learning mode.

Figure 3. Classification of ML algorithms.

● Supervised learning is commonly used for applications where a labeled dataset is available. Such algorithms require data composed of pre-labeled inputs X and desired outputs Y to learn a mapping function \( f \) from the input to the output Y=f(X). The aim is to approximate the mapping function so that the output variables can be predicted for a query data. Learning stops when the algorithm achieves an accepTable level of performance. Supervised learning problems can be grouped into Regression and Classification taks depending on the output data type. When such data is discrete, we talk about Classification and when it is continuous, it is called Regression. Common types of classification (resp. regression) problems include traffic classification (resp. time series prediction). Popular supervised ML algorithms used for classification problems are Support Vector Machine (SVM) [31] and Naive Bayes [32]. Linear regression (LR) and support vector regression (SVR) [33] can be used for regression problems. Random Forest [34] can be used for both classification and regression.

● Unsupervised Learning This learning is suiTable for problems where no labeled data is available, i.e. only input data X is accessible but not the corresponding output variables. These algorithms are able to discover and extract hidden patterns from unlabeled data without a pre-learning phase. Unsupervised learning problems are usually used for clustering problems. The K-means algorithm and Hierarchical clustering are examples of unsupervised Machine Learning.

● Reinforcement Learning [35, 36] In RL, agents learn to make better decisions directly from experience by interacting with the environment. The agents start without any knowledge about the handled, task and learn by reinforcement learning according to a reward, received based on its performance on the task. For each learning episode, the action taken by the agent leads to a change in the state of the environment, and the desirability of this change is measured by the reward. The agent’s task is to maximize the overall reward it achieves throughout the learning period.

Dealing with complicated problems is one of the most important benefits of ML. Since the network field often sees complex problems that require efficient solutions, it is promising to bring ML algorithms into the network domain to leverage its amazing power for higher network performance. Existing ML applications to networks cover a large scope, ranging from traffic prediction and classification to resource management and network adaptation, including fault tolerance and intrusion detection. Nearly the same domains have been investigated in NFV. Particularly, our study reveals that resource management and anomaly detection using traffic classification are the most examined domains. In the following, we present each problem, argue the potential of ML techniques to manage it and then survey existing ML based approaches. Next, in section 6, we discuss these contributions and gives recommendations.

4. ML for Resource Management in NFV

4.1. Description of the Problem

The application of NFV introduces the problem of efficient resource management. The physical resources used to host the VNFs have a finite amount of compute, memory and storage capacity. Physical links connecting these resources have also limited amount of bandwidth. Therefore, these physical resources should be managed conveniently to gain the economical benefits promised by NFV. The resource management problem in NFV can be divided into two sub-problems: initial VNFs placement and chaining and dynamic resource scaling/allocation.

● The initial VNFs placement and chaining: In NFV, services are composed of one or more VNFs connected in a specific order to create a Service Function Chain (SFC) supporting the service. The top of Figure 4 shows an example of SFC composed of three VNFs (Firewall, Intrusion Detection System, Proxy). Each VNF requires an amount of resources to process the traffic passing through it. To deploy a SFC, an operator needs to find the right placement of VNFs into the nodes (virtual machine, container, etc.) of the physical network having enough available resources. Once the hosts are selected, the required virtual resources are created and booted to instantiate the VNFs. Then, optimal physical paths having enough bandwidth should be identified to chain the VNFs and steer the traffic between them. These two steps \( i) \) VNFs placement and \( ii) \) chaining can be tackled separately or in one shot for greater efficiency. The VNF placement and chaining is often studied with respect to different objectives like load balancing, energy conservation, compliance with the service Level of Agreement (SLA), etc. Different metrics like the mapping cost, the algorithm rapidity and complexity can be used to evaluate the efficiency of the placement process. An example of such a mapping is displayed in Figure 4.

Figure 4. An example of service function chain mapping.

● Dynamic resource scaling/allocation One essential objective of NFV is to achieve dynamic resource scaling of VNFs. The traffic flowing between VNFs can fluctuate dynamically during service lifetime. To continue processing it, VNFs resource needs may vary (increase or decrease) over time. Elastic resource allocation to VNFs in accordance with the varying workloads is required to continuously meet the VNF performance needs. Such elasticity can be achieved either by performing vertical scaling (increase or reduce the resources allocated to already deployed VNF instances), or horizontal scaling (increase or reduce the number of VNF instances by creating or removing instances). Allocated resources are finally freed when the lifetime of the service expires.

4.2. Motivation for the Use of ML

As highlighted in the survey [37, 38], the resource allocation problem in NFV is an NP-hard optimization problem widely addressed using exact, heuristic or meta-heuristic optimization strategies [39]. However, in the complex and dynamic VNF environment, the effectiveness of such strategies is heavily correlated with the right understanding and interpretation of the environment to complete appropriate on-line decisions. But the VNF ecosystem is very hard to explain due to the various and complicated synergies between its components, like the interaction between the VNFs, between each VNF and the hosting infrastructures, between a VNF and the processed traffic, etc. This makes the comprehension and prediction of the different factors and components behavior difficult. In this context, ML is proposed as a powerful tool able to capture all complicated and correlated synergies between various elements by extracting meaningful knowledge from data describing them. Thus, ML can be well suiTable to this problem. The following section surveys existing attempts to leverage the ML power in this domain.

4.3. Survey of Existing Approaches

The are a handful of research works that applied ML for resource management in NFV. They all used a supervised algorithm to predict one or more parameters influencing the VNF placement, to enhance and accelerate the resource allocation process. Below, we give more details about these contributions. These details are summarized in Table 1.

Reinforcement learning (RL) and deep reinforcement learning (DRL) have been used to successfully manage network function virtualization (NFV) resources. Reference [40] describes a DQN-based framework that dynamically orchestrates service function chains (SFCs). This framework decides where to place VNFs (in the cloud or at the edge) and how to connect them to meet real-time traffic demands. The DQN agent takes into account the traffic flow rate of services and the status of VNFs when making decisions. The framework defines the action space as the number of VNFs to activate and the traffic flow to schedule. The performance of the framework was evaluated using heterogeneous NFV/MEC-enabled IoT network scenarios emulated with the network tool. These scenarios were used to create a synthetic dataset that was helpful in training the framework's algorithms.

In [41], the authors propose an Attention mechanism-based Deep [26] Deterministic Policy Gradients (A-DDPG) framework to solve the VNF placement problem. The proposed framework utilizes the Actor-Critic network structure, where both the Actor and Critic networks employ double networks (i.e., the main network and the target network). The Actor network is responsible for learning the optimal VNF placement policy, while the Critic network evaluates the policy’s performance. The Attention mechanism is integrated into the Actor network to enhance its ability to capture the complex relationships between VNFs and network resources.

Mijumbi et al. [42, 43] focused on dynamic resource scaling for already mapped VNFs during their lifetime. To do so, they designed a Graphic Neural Network (GNN) [44] based model to predict the VNFs resource needs. Determining resource needs ahead of time would avoid system outages and QoS degradation due to the non-negligible delay in spinning-up (create, boot and instantiate) new resources. The authors argue that resource requirements of a VNF depend on those of its neighboring VNF since traffic flows between them. This dependency motivated them to use the GNN to predict each VNF requirements by observing its historical resource utilization and those of its neighbors. GNN is a novel connectionist approach suited for problems whose domain can be represented by a set of patterns and relationships between them. In those problems, a prediction about a given pattern can be carried out by exploiting all the related information, which includes the pattern features, and the pattern relationships. To achieve this, the authors described each VNF by a vector feature representing its actual and past required resources (memory \( m_{n} \), CPU \( c_{n} \), and processing delay \( d_{n} \)) included in a finite time horizon \( \text{π} \):

A GNN model is then designed to reflect the topology of the star connecting the VNF to its neighbors. Feed forward Neural Network functions (FNN) are applied in different GNN layers to compute the VNF demand. To validate their proposal, the authors used a deployment of a virtualized IP Multimedia Subsystem (IMS) provided by the open source "Clearwater project" [45] and real VoIP traffic traces to construct their dataset. Results showed good prediction accuracy and an increase of the calls acceptance rate that proves that resource prediction enhanced the resource allocation process.

In our previous work [46], we applied a Support Vector Regression (SVR) based approach to estimate VNFs needs in term of CPU as a function of the processed traffic. We explained that studying the behavior of a VNF as a function of its environment helps modeling its resource requirements and favors its dynamic allocation. The SVR model was trained using a dataset provided by [47], composed of pairs \( ({{\bf{TRF}}_{\bf{i}}},CPU_i) \), where \( {{\bf{TRF}}_{\bf{i}}} \) is a vector describing the entering traffic, and \( CPU_i \) is the amount of CPU used by the VNF to process the traffic. Experimental results showed the efficiency of the SVR model and superiority over a neural network based solution.

An interesting recent contribution is proposed in [48, 53] where the authors designed ENVI, an elastic VNF resource allocation scheme. ENVI uses neural network (NN) model to detect resource flexing events (increase or decrease of resource requirements) during the VNF chain lifetime. The goal is to determine the appropriate time when a VNF needs to be scaled and allocate new required resources. To construct the initial NN model, ENVI uses a combination of VNF-level features and infrastructure-level features. VNF-level features describe the VNF capacity/performance specifications like the request queue size, maximum throughput, etc. Infrastructure level features describes the resource utilization information. These features are collected periodically by the VNF monitor using internal statistics reports. The initial model is used to predict scaling events during the online resource allocation. To cope with workload variations that were not captured during offline training, ENVI continues collecting and labeling new operational data and updating the initial model periodically. The used NN model comprises four layers: an input layer, two hidden layers and an output layer to extract the dependence relationship among all features. The authors evaluated their proposal over a dataset they constructed using two VNFs and synthetically generated entering workload.

In [50], the authors dealt with the cost effective resource allocation problem in NFV. They applied a Bayesian learning method [51] to predict the reliability of cloud resources based on their historical usage. Reliability represents the ability of a resource to ensure constant system operation without disruption. The reliability prediction result was used to improve the performance of a Markov Decision Process applied to allocate VNFs on demand. BL is a probabilistic approach to inference, able to track the changes of resource reliability in an evolving environment. In BL, each observed training example can incrementally decrease or increase the estimated probability that a hypothesis is correct. Prior knowledge can be combined with observed data to determine the final probability of a hypothesis. In [50], the BL algorithm is triggered when an NFV component is created and allocated to cloud resources. The algorithm captures resource reliability and continues the training as the time goes. Simulations were used to generate the data and evaluate the model.

The authors of [52] examined the VNF placement and chaining while minimizing the end-to-end latency. They used a SVR model to forecast the delay on different paths of the physical infrastructure. They argued that the solution of VNF placement based on calculations at time t can be inappropriate for time (t+1) where the VNF are effectively placed. This is due to the resources spinning-up process that can take a long time; thus the physical network state (particularly the physical paths delay) may change meanwhile. The authors proposed to predict the state at (t+1) so that the placement remains consistent with the requirements. They used a training vector that captures the parameters affecting the delay: \( i) \) the inference caused by resource sharing on end nodes, \( ii) \) the length of link connecting them and \( iii) \) the traffic passing through it. To assess their approach, the authors generated a training dataset using a stochastic modeling for delay analysis of a VoIP network [54]. The results showed that the system predicts the delay rapidly and increases the number of successful service chains embedding.

Conclusion: Most of research works focused on using a supervised ML algorithm to predict an output parameter influencing the resource allocation process. The predicted parameters fall into one of the two following criteria categories: \( i) \) VNF future resource requirements [40, 41, 43, 46, 48] or \( ii) \) physical resource characteristics (reliability [50], path delay [52]). Different features were used to predict future resource requirements, namely the historical resource usage of a VNF and its neighbors [40, 41, 42, 43, 48], the workload/traffic patterns [46] and the VNF internal characteristics [48]. To validate their approach, most authors generate their own dataset by implementing a prototype as in [48], monitoring an open source VNF environment like the Clearwater project [45] or creating a synthetic dataset using the RL environment [40, 41].

5. ML for anomaly Detection in NFV

5.1. Description of the problem

Anomaly detection is an old problem, well investigated in the literature [55]. In NFV, the anomaly/fault detection has become a top priority for achieving the benefits promised by this technique. In fact, network function chains are more performance stringent than common IT applications. Detecting preliminary symptoms of service degradation is thus crucial to avoid Service Level Agreement (SLA) violation. Anomaly detection in a NFV environment consists on reporting in a timely manner any abnormal condition in an NFV service. This requires continuous examination and classification of traffic patterns related to that service.

The first step in this process is to identify the set of features which best illustrate the VNF status. This can include CPU and RAM usage, I/O operations of different partitions and network interfaces and protocols. Next, these features should be extracted from the monitoring data collected continuously from hardware components of the system and the operation system of the VNFs. These metrics are then analyzed overtime to decide whether an anomaly should be reported if the operating conditions are abnormal. In this case, the root cause of the failure is determined and adequate countermeasures are planned.

The anomalies/failures that can occur in the NFV environment are numerous and can be divided into three failure types [56] : process failure, network failure and throughput degradation.

● The process failures are caused by abnormal behavior of CPU and memory usage (eg. memory leak)

● The network failuressuch as network congestion are generally caused by traffic overload due to misconfiguration or unexpected traffic.

● The throughput degradations are due to surges in the number of TCP sessions processed by the OS on the virtualization environment and lead to packet loss and delay affecting the VNF application performance.

Traffic classification [57] is an efficient approach commonly used to detect intrusions and resolve network management problems. It consists in identifying and categorizing network data flows by examining relevant traffic features. Traffic classification is very important in NFV-based networks where a considerable amount of hidden traffic communicates among virtual machines [58].

Note that the anomaly detection and traffic classification in NFV are challenging for many reasons. The first is the softwarization of the network functions which exposes them to anomalies present in IT applications and others specific to virtualized infrastructures, related to resource sharing, scheduling and Virtual Machine (VM) live migration. Second, unlike traditional network functions, commonly provided by single vendor specific hardware, VNFs can share infrastructure resources from several vendors which makes anomaly detection and localization harder. And finally, due to the dynamic changes in the service and network configurations and the high availability performance required by VNF, traffic classification and failure detection should be performed on a real-time basis and at an early stage before the occurrence of a critical degradation.

5.2. Motivation for the Use of ML

As outlined above, anomaly detection in NFV is very difficult, especially with the expansion of the network scale and functionality in virtualized environments witch leads to an increase in the number and amount of managed resources and data. This calls for solutions able to deal with huge amount of data to scale with the NFV environment. ML has the potential to face these challenges as demonstrated in its successful applications in Big Data [16].

Due to the lack of information about the VNFs, either for privacy issues or simply because vendors can not provide it, anomaly detection systems should perform without requiring specific information about the VNFs. VNF's performance depends on many factors like the underlying NFV infrastructure, resource sizing and workload dynamics, which makes it challenging for VNF vendors to provide complete capacity information [59]. ML models, proposed as a powerful tool to capture the unknown synergies between the VNF and its environment, are shown to be suiTable for the anomaly detection problem in NFV.

5.3. Survey of Existing Approaches

The use of ML to classify Internet traffic and detect anomalies in Network is widely studied [60, 61]. This survey covers the research works that have adapted the ML techniques to suit the VNF environment requirements. A handful of research papers addressed this problem. They can be classified into supervised and unsupervised approaches as presented below.

5.3.1. Supervised Approaches

Supervised ML algorithms enable learning from historical observations to get predictions about the future. Applied to anomaly detection, this means to first observe the VNFs behavior both during normal and anomalous operations, and then to construct an estimation model, off-line using the observed data. The model is subsequently used to estimate the VNF system behavior at runtime (Table 2).

Formally, using the same notation as in section 3, the set \( {X}=\left \{x_1, x_2,...x_n\right \} \) of input features are the observation samples describing the VNFs system behavior. The desired output is \( {Y} \in \left \{normal, abnormal\right \} \) classifying the behavior to normal and abnormal. \( Y \) can be extended to \( Y \in \left \{nrm, abnrm\_type\_1, abnrm\_type\_2,\dots,abnrm\_type\_m \right \} \) to describe the types of the anomaly causing the abnormal behavior.

The authors of [62] propose a black-box anomaly detection and localization approach applied to VNF. They first define different fault campaigns and inject them into a VNF execution environment. The monitoring data periodically collected from the VNF virtual machine hypervisor, called black-box source, is used to train a Random Forest (RF) based model [34]. The model anomaly detection is then applied in each single VM to detect the anomalous behavior and localize the faulty one. The approach was validated on the IMS Clearwater project platform [45].

In [63], the same authors enhanced the previous work to detect and localize Service Lever Agreements (SLAs) violations. They use the RF based model and train it with richer data collected from the Operating System (OS) of the VNF virtual machines, a grey-box monitoring source. Experiments demonstrate that the grey-box monitoring source achieves better classification results compared to the black-box source based approach.

The authors of [64, 67] focused on traffic classification in NFV. In [64], the authors performed a benchmarking of the behavior of supervised ML algorithms in the IP traffic classification in NFV regarding their efficiency in terms of response time and precision. Their experiments, conducted on a simulation prototype reflecting a small VNF environment, demonstrated that the Naive Bayes [32] algorithm is a good traffic classifier. In [67], the authors demonstrated that the effectiveness of different ML based classification models depends on the protocol types and the features collected from network data. They designed VTC, a Virtual Traffic Classifier network function that automatically selects and applies the best ML learning classifier at run time. The proposal was evaluated using KDD flow traces [72], which do not reflect traffic in an NFV environment in our opinion, as it was constructed before the emergence of the NFV concept.

The authors of [73] argue that traditional anomaly detection methods, such as RF, gradient boosting machine, and deep NN, are not well-suited for capturing the temporal dependencies and sequential patterns inherent in network data. As a result, these methods often fail to detect anomalies in complex NFV networks. To address this limitation, the authors proposed several sequential DL models that are specifically designed to learn time-series and sequential patterns of VNFs in SFCs (Service Function Chains). These models overcome the shortcomings of traditional methods by effectively capturing temporal dependencies and adapting to SFCs with varying lengths. The authors evaluated the proposed models on a real-world dataset of network traffic from an SDN and NFV environment. The results show that the proposed models significantly outperform traditional methods in terms of detection accuracy.

The authors of [74] proposed a ML-based anomaly detection framework for VNFs in SDN and NFV environments. The framework is designed to detect anomalies specifically related to SLA violations, which are critical for ensuring the quality of service (QoS) experienced by end-users. The framework utilizes datasets collected from VNF service function chain (SFC) scenarios implemented on an OpenStack environment. As ML algorithms, the authors evaluated four algorithms including Deep Learning and XGBoost.

In [75], the authors proposed to combine Generative Adversarial Network (GAN) and Federated Learning (FL) to effectively detect anomalies in virtual machines (VMs) in a virtualized network slicing environment. The algorithm utilizes a hierarchical cooperation mechanism among VM monitors, network slice managers, and the network controller to achieve global VM anomaly detection. After training generators and encoders on network slice managers, their updated parameters are sent to the network controller for aggregation using the FL framework. This collaboration, among VM monitors, network slice managers, and the network controller, allows to create a global VM anomaly detection model.

5.3.2. Unsupervised approaches

VNF applications can be exposed to unexpected failures resulting from software bugs and resource exhaustion. Therefore, the anomaly detection is expected to catch unknown behavior in a virtualization environment without experience and knowledge in the past. Unsupervised approaches can support anomaly detection without previously learning them. Unsupervised techniques are also commonly used for traffic classification (Table 3).

The authors of [77] designed a scalable distributed fault detection framework for NFV called vNMF. vNMF uses a self-orgalizing map algorithm (SOM) [78] to analyze and classify the physical layer statistical data collected from the VMs. A network testbed simulating memory-leak and network congestion faults was used to evaluate the proposal. The results showed that SOM compared favorably with the k-means clustering algorithm. Unfortunately, the solution relies upon manually configuring the SOM clustering parameters and selecting the statistics for each failure type in advance, which results in a high maintenance load.

In [56], the same authors enhanced their previous work by proposing a more universal solution where a small set of local statistics and SOM clustering parameters can be used to detect different types of faults. To do so, they evaluated the SOM approach and determined the best set of clustering parameters that should be used to detect the faults. The effectiveness of the selected parameters was evaluated on a testbed simulating a virtualized residential gateways service.

Due to the scarcity of labeled faulty data, Unsupervised Learning (UL) methods have gained significant traction for detecting and localizing anomalies in NFV systems. In a UL approach, training is exclusively conducted on normal data to learn normal data patterns, and any deviation from the norm is considered an anomaly. However, it has been demonstrated that even small percentages of anomalous samples in the training data can substantially degrade the performance of UL methods. To address this issue, the aurhors of [79] proposed an anomaly detection approach based on the \( NoisyStudent \) technique, initially introduced to leverage unlabeled datasets in computer vision classification problems.

Conclusion: Research works applying ML to detect anomalies in NFV are very scare. As discussed in next section, this may be due to the lack of public datasets to evaluate such algorithms. Constructing one's own dataset requires implementing artificial fault injection techniques to emulate widespread faults existing in common computing systems, like the increase of resource consumption, misuse of memory, network packet loss, heavy workload, etc. Moreover, observations related to a VNF VMs behavior should be collected periodically from different monitoring sources. Note that these sources can be classified as black-box or grey-box sources. Black-box sources, commonly hypervisor, do not need any tool to be installed to the VMs. Grey-box sources, by contrast, require the installation of monitoring agents in VMs. Grey-box sources generally provide richer information.

6. Discussion and Recommendation

Current ML applications to NFV encompasses scare but significant contributions. To encourage researchers to implement ML solutions for NFV, many important challenges need to be addressed and new ML opportunities should be explored. In the following, we discuss the most relevant ones.

6.1. Challenges

Lack of public datasets: The availability of standardized datasets, where researchers can test and validate their algorithms, have a huge influence on the evolution of ML techniques and applications. The need to publish datasets is very high, especially in networks where collecting a large amount of high quality labeled data is expensive and labor intensive, as discussed previously.

Although the publication of datasets is already a common practice in several popular ML applications, such as the PRID dataset [82] for person re-identification, public datasets in NFV, describing the NFV ecosystem components and synergies between them, are unfortunately scare or even nonexistent. As described in the survey presented above, most existing contributions using ML in NFV generated their own traces, either by conducting simulations, on after implementing a realistic NFV scenario like Clearwater [45].

The use of Clearwater is very popular in NFV. Clearwater is an open source implementation of an IMS (IP Multimedia Subsystem) for cloud platforms. It provides SIP-based (Session Initiation Protocol) voice and video calling, and messaging applications. It implements six VNFs, dynamically chained together, each one hosted on a VM, making it thereby well suited for NFV related studies. However, even if Clearwater is open source, implementing it and monitoring its components to generate data is labor intensive and requires software engineering skills and expensive hardware material, as most researchers used at least 3 high performance servers for their experiments [48, 62].

Regarding public datasets, there are few datasets proposed in the literature. As part of a scientific challenge, a dataset has been suggested to allow researchers to compare their algorithms in various applications related to the NFV domain [81].

Authors of [47] published a small dataset describing the evolution of CPU resource requirements of three NFVs as a function of the entering traffic. Unfortunately, the size of such data is not sufficient to evaluate many ML algorithms like deep learning where abundant data is required.

Recently, the authors of [83] published a dataset representing traffic passing through VNF chains and how it affects the network functions (NF) scaling. Again, due to the scarcity of public traffic for VNF chains, the traffic data was derived from empirical analyses and some assumptions. The authors randomly selected NF types composing the chains, then distributed web traffic traces among the chains. To study the auto scaling, the authors assumed that the NF resource requirement is proportionate to the traffic flowing through it. However, in real situations, the connections between traffic flow and VNF resource needs is much more complex as demonstrated in [46], and thus the dataset does not describe real synergism between the VNF and its environment.

Through this paper, we would like to attract the attention of the research community to the scarcity of public data describing the NFV environment and encourage them to publish such datasets where researchers can develop, test and compare ML based solutions. This is an essential step towards fully exploiting the potential of applying ML to NFV.

Evolution of ML techniques: The progress of ML is significantly driven by ML applications like computer vision, anomaly detection, etc. Similarly, applying ML to control networks requires adapting existing ML schemes and developing new ones. For example, modeling the systems as graphs [44], which is the most common representation of the network are required. Moreover, new dynamic and scalable learning techniques, more suiTable to the new generations of networks (Cloud, 5G etc) are desired. In the following section, we present some of such emerging techniques.

6.2. Opportunities

We believe that the following learning models can be very useful to resolve research issues related to NFV and networks.

Deep learning [84] is one of the hottest research trends in ML. It is attractive for its capacity to extract high-level, complex hidden patterns from large amounts of input data. It often outperforms the state of the art relying on hand-made features. Deep belief networks (DBNs) [85] and convolutional neural networks (CNNs) [86] are examples of deep learning approaches. To ensure the effectiveness of deep learning models, it is essential to invest in the creation of, diverse, and large datasets.

Distributed learning [87] is different from classical learning requiring the collection of data in a dataset for central processing. Even if a centralized and global view based network control can be achieved with SDN, learning in a distributed manner can be useful if a distributed control of the network is designed.

Online learning [88] is a learning technique proposed as an alternative to batch learning where the entire dataset should be available to create the model, which can no longer be modified. Conversely, online learning takes an initial prediction model and then uses available data streams to update and enhance the predictor accuracy. Thus, online learning is more suiTable to dynamic networks where the prediction models should adapt with new situations.

Transfer learning [89] is the transfer of knowledge from a related task already learned to another task to improve learning in a particular domain, referred to as the target domain, where the data size is insufficient or the learning task is difficult. An example in NFV is the resource requirement prediction for a specific service chain, for which no sufficient data is available for learning the model from scratch. In such a case, other datasets collected from other similar services, with comparable consumption patterns, could be leveraged through transfer learning.

6.3. Exploring the Use of ML in Other Network Applications

In addition to the use of ML in the field of virtualization, ML is also utilized in other networking applications. In cloud computing, ML is employed for resource optimization [13], enabling dynamic allocation that enhances efficiency and reduces costs [14]. For performance analysis, ML can be used to continuously monitor the performance of cloud services, detect anomalies or service degradations [90], and trigger automatic alerts or corrective actions. Furthermore, with the increasing use of containers and microservices, ML aids in optimizing orchestration by predicting resource needs and dynamically adjusting allocation [91].

In the Internet of Things (IoT), ML is used to optimize the energy consumption of devices by learning and predicting their usage patterns [92]. Additionally, ML analyzes sensor data to predict failures before they occur, enabling proactive maintenance that can prevent costly downtimes [93]. ML also helps adjust network settings to maintain quality of service, especially in scenarios where networks are overloaded or undergoing dynamic changes [94].

In the realm of communication protocols, ML is used to analyze and optimize parameters of protocols such as WSN (Wireless Sensor Networks) [95]. In mobile network optimization, ML can optimize handover processes in cellular networks to ensure a smooth transition and maintain quality of service [96]. In mobile networks, ML helps analyze and optimize the use of frequencies to avoid interference and maximize coverage [97].

7. Conclusion

NFV promises operating expenditure savings and high flexibility in managing networks. However, some challenges still need to be overcome, namely for resource allocation, security and anomaly detection. In this paper, we discussed the potential of ML to overcome these problems. We included a survey of existing contributions and highlighted some opportunities and research directions. Our study reveals that the use of ML is a promising solution to control the NFV environment. However, some issues need to be addressed, essentially the lack of public datasets describing the VNF environment. In this context, the construction of public datasets become of utmost importance, as they are not only necessary for the evaluation and comparison of different ML techniques in the VNF context, but also for the developement of advanced deep learning models for VNF modeling. Another challenge is that the AI algorithm should be robust to uncertain environments [29, 98−102].

Author Contributions: Houda Jmila: Elaboration of the structure of the paper, Investigation, Methodology, Writing-original draft, Writing—review & editing; Mohamed Ibn Khedher: Elaboration of the structure of the paper, Investigation, Methodology, Writing-original draft, Writing—review & editing; Mounim A. El Yacoubi: Elaboration of the structure of the paper, Writing some parts, Reading and correction of the whole paper. All authors have read and agreed to the published version of the manuscript. 

Funding: This research received no external funding.

Data Availability Statement: Not applicable.

Conflicts of Interest: The authors declare no conflicts of interest.