  Virtualized network slicing allows a multitude of logical networks to be
created on a common substrate infrastructure to support diverse services. A
virtualized network slice is a logical combination of multiple virtual network
functions, which run on virtual machines (VMs) as software applications by
virtualization techniques. As the performance of network slices hinges on the
normal running of VMs, detecting and analyzing anomalies in VMs are critical.
Based on the three-tier management framework of virtualized network slicing, we
first develop a federated learning (FL) based three-tier distributed VM anomaly
detection framework, which enables distributed network slice managers to
collaboratively train a global VM anomaly detection model while keeping metrics
data locally. The high-dimensional, imbalanced, and distributed data features
in virtualized network slicing scenarios invalidate the existing anomaly
detection models. Considering the powerful ability of generative adversarial
network (GAN) in capturing the distribution from complex data, we design a new
multi-discriminator Bidirectional Wasserstein GAN with Gradient Penalty
(BiWGAN-GP) model to learn the normal data distribution from high-dimensional
resource metrics datasets that are spread on multiple VM monitors. The
multi-discriminator BiWGAN-GP model can be trained over distributed data
sources, which avoids high communication and computation overhead caused by the
centralized collection and processing of local data. We define an anomaly score
as the discriminant criterion to quantify the deviation of new metrics data
from the learned normal distribution to detect abnormal behaviors arising in
VMs. The efficiency and effectiveness of the proposed collaborative anomaly
detection algorithm are validated through extensive experimental evaluation on
a real-world dataset.
