Ref. | ML Technique | Network | Dataset | Features | Output | Evaluation | |
---|---|---|---|---|---|---|---|
 |  | (location) |  |  | (training) | Settings | Results |
Chen et al. [91] | DT (C4.5) | Network systems | Snapshots of logs from eBay | A complete request trace ·Request type ·Request name ·Pool ·Host ·Version ·Status of each request | Different faulty elements | 10 one hour snapshots with 14 faults in total | ·Precision: 92% ·Recall: 93% |
Ruiz et al. [393] | BN | Optical network | Synthetically generated time series | Quality of Transmission (QoT) parameters ·Received power ·Pre-forward error correction bit error rate (pre-FEC BER) | Detect one of the two fault scenarios ·Tight filtering ·Inter-channel interference | 5,000 and 500 time series for training and testing, respectively | Accuracy: 99.2% |
Khanafer et al. [237] | BN and EMD | Cellular network | Synthetically generated from a simulated and a real UMTS network | ·Causes of faults ·Symptoms, i.e., alarms and KPIs | Identify the cuase of the fault | 77 and 42 faulty cells for training and testing, respectively | Accuracy: 88.1% |
Kiciman and Fox [241] | Supervised: · DT (ID3) | Three-tier enterprise applications | Generated using small testbed platform | Paths classified as normal or anomalous | Hardware and software components that are correlated with the failures | Three different DTs were evaluated | Correctly detect 89% to 96% of major failures |
Johnsson et al. [225] | Unsupervised: discrete state-space particle filtering | IP network | Discrete event simulator | ·Active network measurements ·Probabilistic inference ·Change detection | Probability mass function indicating the location of the faulty components | Operations per filter: O(|G|), where |G| is the number of edges in a graph G | Found the location of faults and performance degradations in real time |
Barreto et al. [40] | Unsupervised: · Winner-Take-All (WTA) · Frequency-Sensitive Competitive Learning (FSCL) · SOM ·Neural-Gas algorithm (NGA) | Cellular network | Simulation study | State vectors representing the normal functioning of a network | State vector causing the abnormally | 400 vectors were used for training and 100 vectors were used for testing | False alarm: · WTA: 12.43 · FSCL: 10.20 · SOM: 8.75 ·NGA: 9.50 |