This work proposes a real-time anomaly detection scheme that leverages the
multi-step ahead prediction capabilities of encoder-decoder (ED) deep learning
models with recurrent units. Specifically, an encoder-decoder is used to model
soft-failure evolution over a long future horizon (i.e., for several days
ahead) by analyzing past quality-of-transmission (QoT) observations. This
information is subsequently used for real-time anomaly detection (e.g., of
attack incidents), as the knowledge of how the QoT is expected to evolve allows
capturing unexpected network behavior. Specifically, for anomaly detection, a
statistical hypothesis testing scheme is used, alleviating the limitations of
supervised (SL) and unsupervised learning (UL) schemes, usually applied for
this purpose. Indicatively, the proposed scheme eliminates the need for labeled
anomalies, required when SL is applied, and the need for on-line analyzing
entire datasets to identify abnormal instances (i.e., UL). Overall, it is shown
that by utilizing QoT evolution information, the proposed approach can
effectively detect abnormal deviations in real-time. Importantly, it is shown
that the information concerning soft-failure evolution (i.e., QoT predictions)
is essential to accurately detect anomalies.

本研究提出使用编码器 - 解码器深度学习模型，结合实时质量传输观测信息进行软故障演化模拟，用于网络攻击等异常检测。该模型在无需标记异常情况和分析整个数据集缺陷的前提下，实时有效地检测网络异常波动。