Anomaly Detection in Satellite Communications Networks using Support Vector Machines

Many network monitoring tools use simple thresholding techniques of single parameter measurements to alert the operator to unusual events. For satellite communications, signal levels, bit error rates, and lock status are some of the primary metrics used. This approach, however, fails to detect more nuanced anomalies. These occur when a number of variables present in a rare combination. In such a scenario each variable in isolation may appear normal, yet the data as a whole indicates that the system is in an anomalous state. This paper describes how a One Class Support Vector Machine (OCSVM) was trained to detect anomalies using historical multivariate data from a satellite communications network. The advantage of the OCSVM is that the training data does not need to include anomalies, nor is the labelling of 'normal' versus 'anomalous' data required. Moreover, the trained OCSVM examines multiple variables simultaneously, rather than looking at each in isolation, and is able to perform real-time outlier detection and quantify how abnormal the outliers are. The latter is obtained by measuring the distance of the outlier to the decision plane of the OCSVM. The technique has been applied to alert satellite communiction network operators to unusual conditions requiring their attention.