DDoS Attack Identification
uplink noise as an anomaly . The block diagram of the self-supervised anomaly detection from uplink noise rise is shown in Figure 3-3 .
Figure
3-3 : Block diagram of the self-supervised approach for anomaly detection from uplink noise rise .
We can then formulate the next occurrence of an anomaly as a Markov Decision Process ( MDP ), where state , action , and rewards are as described below :
a ) State : In our case , the state is the quantized values of sequential interference that the cell is experiencing . Higher interference could lead to call drop , service degradation , etc . b ) Action : Actions are quantized interference values that led to a positive affirmation of the presence of an anomaly . c ) Reward : The reward can be defined as per domain knowledge . Reward is dependent on Radio Access Networks ( RAN ) KPI values and their thresholds . Some of the important RAN KPIs that we have considered identifying anomalies are CDR ( call drop rate ), CSSR ( call set-up success rate ), HSR ( handover success rate ), TCH ( traffic channel congestion rate ), call completion rate , speech quality index & signal strength . e . g ., if the signal strength is below threshold i . e ., signal strength is not falling between the required dBm range then reward will be positive as interference leads to poor signal strength .
Depending on the “ action ”, the reward can be either positive or negative . Reward is positive if interference is observed and negative if there is no interference at that state . For example , it is known that anomaly will be prominent for cells to experience higher traffic . So , traffic could be a trigger to give more reward . To promote recommendation diversity , in addition to traffic other factors that can be considered , include but are not limited to , path loss , time of the day , etc . The
IIC Journal of Innovation 61