{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T16:02:48Z","timestamp":1782835368868,"version":"3.54.5"},"reference-count":47,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2023,8,28]],"date-time":"2023-08-28T00:00:00Z","timestamp":1693180800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,8,28]],"date-time":"2023-08-28T00:00:00Z","timestamp":1693180800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001809","name":"Joint Funds of the National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["U21B2022"],"award-info":[{"award-number":["U21B2022"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"Joint Funds of the National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["U21B2022"],"award-info":[{"award-number":["U21B2022"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"CMCC and BUPT cooperative program","award":["A2022256"],"award-info":[{"award-number":["A2022256"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cloud Comp"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>As the cloud services market grows, cloud management tools that detect network anomalies in a non-intrusive manner are critical to improve users\u2019 experience of cloud services. However, some network anomalies, such as Microburst, in cloud systems are very discreet. Network monitoring methods, e.g., SNMP, Ping, are of coarse temporal granularity or low-dimension metrics, have difficulty to identify such anomalies quickly and accurately. Network telemetry is able to collect rich network metrics with fine temporal granularity, which can provide deep insight into network anomalies. However, the rich features in the telemetry data are insufficient exploited in existing research. This paper proposes a Multi-feature Fusion Graph Deep learning approach driven by the In-band Network Telemetry, shorted as MFGAD-INT, to efficiently extract and process the spatial-temporal correlation information in telemetry data and effectively identify the anomalies. The experimental results show that the accuracy performance of the proposed method improves about 10.56% compared to the anomaly detection method without network telemetry and about 9.73% compared to the network telemetry-based method.<\/jats:p>","DOI":"10.1186\/s13677-023-00492-w","type":"journal-article","created":{"date-parts":[[2023,8,28]],"date-time":"2023-08-28T09:04:40Z","timestamp":1693213480000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["MFGAD-INT: in-band network telemetry data-driven anomaly detection using multi-feature fusion graph deep learning"],"prefix":"10.1186","volume":"12","author":[{"given":"Yunfeng","family":"Duan","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chenxu","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guotao","family":"Bai","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guo","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fanqin","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiaxing","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zehua","family":"Gao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chun","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2023,8,28]]},"reference":[{"key":"492_CR1","doi-asserted-by":"crossref","unstructured":"He Q, Dong Z, Chen F, Deng S et al (2022) Pyramid: Enabling hierarchical neural networks with edge computing. In: Proceedings of the ACM Web Conference 2022. Association for Computing Machinery. New York, NY, USA. pp 1860\u20131870","DOI":"10.1145\/3485447.3511990"},{"issue":"16","key":"492_CR2","doi-asserted-by":"publisher","first-page":"12588","DOI":"10.1109\/JIOT.2021.3077449","volume":"8","author":"X Zhou","year":"2021","unstructured":"Zhou X, Xu X, Liang W et al (2021) Deep-learning-enhanced multitarget detection for end-edge-cloud surveillance in smart IoT. IEEE Internet Things J 8(16):12588\u201312596","journal-title":"IEEE Internet Things J"},{"issue":"1","key":"492_CR3","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1186\/s13677-023-00406-w","volume":"12","author":"P Krishnan","year":"2023","unstructured":"Krishnan P, Jain K, Aldweesh A, Prabu P, Buyya R (2023) Openstackdp: a scalable network security framework for SDN-based OpenStack cloud infrastructure. J Cloud Comput 12(1):26\u201326","journal-title":"J Cloud Comput"},{"issue":"8","key":"492_CR4","doi-asserted-by":"publisher","first-page":"1873","DOI":"10.1109\/TPDS.2021.3131680","volume":"33","author":"L Yuan","year":"2021","unstructured":"Yuan L, He Q, Chen F, Zhang J, Qi L, Xu X, Xiang Y, Yang Y (2021) CSEdge: Enabling collaborative edge storage for multi-access edge computing based on blockchain. IEEE Trans Parallel Distrib Syst 33(8):1873\u20131887","journal-title":"IEEE Trans Parallel Distrib Syst"},{"issue":"2","key":"492_CR5","doi-asserted-by":"publisher","first-page":"281","DOI":"10.1109\/TPDS.2020.3016344","volume":"32","author":"X Xia","year":"2020","unstructured":"Xia X, Chen F, He Q, Grundy J, Abdelrazek M, Jin H (2020) Online collaborative data caching in edge computing. IEEE Trans Parallel Distrib Syst 32(2):281\u2013294","journal-title":"IEEE Trans Parallel Distrib Syst"},{"issue":"16","key":"492_CR6","doi-asserted-by":"publisher","first-page":"14988","DOI":"10.1109\/JIOT.2021.3077937","volume":"9","author":"X Zhou","year":"2021","unstructured":"Zhou X, Yang X et al (2021) Energy-efficient smart routing based on link correlation mining for wireless edge computing in Iot. IEEE Internet Things J 9(16):14988\u201314997","journal-title":"IEEE Internet Things J"},{"key":"492_CR7","doi-asserted-by":"crossref","unstructured":"Dai H, Yu J, Li M, Wang W, Liu AX, et al (2022) Bloom filter with noisy coding framework for multi-set membership testing. IEEE Trans Knowl Data Eng 35(7):6710\u20136724","DOI":"10.1109\/TKDE.2022.3199646"},{"key":"492_CR8","doi-asserted-by":"crossref","unstructured":"Wu S, Shen S, Xu X, et al (2022) Popularity-aware and diverse web APIs recommendation based on correlation graph. IEEE Trans Comput Soc Systems 10(2):771\u2013782","DOI":"10.1109\/TCSS.2022.3168595"},{"key":"492_CR9","doi-asserted-by":"crossref","unstructured":"Qi L, Lin W, Zhang X, et al (2022) A correlation graph based approach for personalized and compatible web APIs recommendation in mobile APP development. IEEE Trans Knowl Data Eng 35(6):5444\u20135457","DOI":"10.1109\/TKDE.2022.3168611"},{"issue":"9","key":"492_CR10","doi-asserted-by":"publisher","first-page":"6300","DOI":"10.1109\/TII.2022.3154473","volume":"18","author":"Y Jia","year":"2022","unstructured":"Jia Y, Liu B, Dou W et al (2022) CroApp: a CNN-based resource optimization approach in edge computing environment. IEEE Trans Ind Inform 18(9):6300\u20136307","journal-title":"IEEE Trans Ind Inform"},{"key":"492_CR11","doi-asserted-by":"crossref","unstructured":"Sulaiman Alhaidari MA Ali Alharbi, et al (2019) Network traffic anomaly detection based on Viterbi algorithm using SNMP MIB data. In: Proceedings of the 2019 3rd International Conference on Information System and Data Mining.  Association for Computing Machinery. New York, NY, USA. pp 92\u201397","DOI":"10.1145\/3325917.3325928"},{"key":"492_CR12","doi-asserted-by":"crossref","unstructured":"Smie\u0161ko J, Kont\u0161ek M, Hajtmanek R (2021) Anomaly recognition in bursty IP traffic models. In: 2021 19th International Conference on Emerging eLearning Technologies and Applications (ICETA). pp 351\u2013358","DOI":"10.1109\/ICETA54173.2021.9726543"},{"issue":"1","key":"492_CR13","doi-asserted-by":"publisher","first-page":"21","DOI":"10.1186\/s13677-022-00379-2","volume":"12","author":"J Tang","year":"2023","unstructured":"Tang J, Chen M, Chen H, Zhao S, Huang Y (2023) A new dynamic security defense system based on TCP_REPAIR and deep learning. J Cloud Comput 12(1):21\u201321","journal-title":"J Cloud Comput"},{"key":"492_CR14","unstructured":"Yang Y, Yang X, Heidari M, et al (2022) Astream: Data-stream-driven scalable anomaly detection with accuracy guarantee in IIoT environment. IEEE Transactions on Network Science and Engineering. pp 1\u20131"},{"key":"492_CR15","doi-asserted-by":"crossref","unstructured":"Zhou X, Liang W, Yan K, et al (2022) Edge enabled two-stage scheduling based on deep reinforcement learning for Internet of everything. IEEE Internet of Things Journal 10(4):3295\u20133304","DOI":"10.1109\/JIOT.2022.3179231"},{"key":"492_CR16","doi-asserted-by":"crossref","unstructured":"Kong L, Wang L, Gong W, Yan C, Duan Y, Qi L (2021) LSH-aware multitype health data prediction with privacy preservation in edge environment. World Wide Web. Kluwer Academic Publishers. USA. 25(5):1793\u20131808.","DOI":"10.1007\/s11280-021-00941-z"},{"key":"492_CR17","unstructured":"Wang F, Li G, Wang Y, et al (2022) Privacy-aware traffic flow prediction based on multi-party sensor data with zero trust in smart city. ACM Trans Internet Technol (TOIT). Association for Computing Machinery. New York, NY, USA. online (just accepted):1533\u20135399"},{"key":"492_CR18","unstructured":"Veli\u010dkovi\u0107 P, Cucurull, et al (2017) Graph attention networks. In: Proceedings of the 6th International Conference on Learning Representations({ICLR}). OpenReview.net. Vancouver, BC, Canada. pp 1\u201312"},{"key":"492_CR19","doi-asserted-by":"crossref","unstructured":"Li Z, Xu X, Hang T, et al (2022) A knowledge-driven anomaly detection framework for social production system. IEEE Trans Comput Soc Systems. early access (2022):1\u201314","DOI":"10.1109\/TCSS.2022.3217790"},{"key":"492_CR20","doi-asserted-by":"crossref","unstructured":"Cho K, Van Merri\u00ebnboer B, Gulcehre, et al (2014) Learning phrase representations using RNN Encoder-Decoder for statistical machine translation. In Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing ({EMNLP}). Association for Computational Linguistics. Doha, Qatar. pp 1724\u20131734","DOI":"10.3115\/v1\/D14-1179"},{"key":"492_CR21","doi-asserted-by":"crossref","unstructured":"Chen X, Feibish SL, et al (2018) Catching the microburst culprits with snappy. In: Proceedings of the Afternoon Workshop on Self-Driving Networks. Association for Computing Machinery. New York, NY, USA. pp 22\u201328","DOI":"10.1145\/3229584.3229586"},{"key":"492_CR22","doi-asserted-by":"crossref","unstructured":"de Almeida LC, Pasquini R, Verdi FL (2021) Using machine learning and in-band network telemetry for service metrics estimation. In: 2021 IEEE 10th International Conference on Cloud Networking (CloudNet). IEEE. Cookeville, TN, USA. pp 33\u201339","DOI":"10.1109\/CloudNet53349.2021.9657155"},{"key":"492_CR23","doi-asserted-by":"crossref","unstructured":"Xu X, Gu J, Yan H, et al (2022) Reputation-aware supplier assessment for blockchain-enabled supply chain in Industry 4.0. IEEE Transactions on Industrial Informatics. 19(4):5485\u20135494","DOI":"10.1109\/TII.2022.3190380"},{"issue":"1","key":"492_CR24","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s13677-023-00391-0","volume":"12","author":"H Zhang","year":"2023","unstructured":"Zhang H, Wang D, Zhang W, Tan L, Kibalya G, Zhang P, Igorevich KK (2023) QoS prediction in intelligent edge computing based on feature learning. J Cloud Comput 12(1):1\u201316","journal-title":"J Cloud Comput"},{"key":"492_CR25","unstructured":"Tan SC, Ting KM, Liu TF (2011) Fast anomaly detection for streaming data. In: Twenty-second international joint conference on artificial intelligence. AAAI Press. Barcelona, Catalonia, Spain. pp 1511\u20131516"},{"key":"492_CR26","doi-asserted-by":"crossref","unstructured":"Sathe S, Aggarwal CC (2016) Subspace outlier detection in linear time with randomized hashing. In: 2016 IEEE 16th International Conference on Data Mining (ICDM). IEEE. Piscataway, NJ. pp 459\u2013468","DOI":"10.1109\/ICDM.2016.0057"},{"key":"492_CR27","doi-asserted-by":"crossref","unstructured":"Said Elsayed M, Le-Khac NA, et al (2020) Network anomaly detection using LSTM based autoencoder. In: Proceedings of the 16th ACM Symposium on QoS and Security for Wireless and Mobile Networks. Association for Computing Machinery. New York, NY, USA.  pp 37\u201345","DOI":"10.1145\/3416013.3426457"},{"key":"492_CR28","first-page":"234","volume":"29","author":"J Liu","year":"2020","unstructured":"Liu J, Li X (2020) Anomaly detection algorithm for industrial control networks based on graph neural networks. Comput Syst Appl 29:234\u2013238","journal-title":"Comput Syst Appl"},{"key":"492_CR29","doi-asserted-by":"crossref","unstructured":"Deng A, Hooi B (2021) Graph neural network-based anomaly detection in multivariate time series. In: Proceedings of the AAAI conference on artificial intelligence.  AAAI Press, Palo Alto, California USA. pp 4027\u20134035","DOI":"10.1609\/aaai.v35i5.16523"},{"key":"492_CR30","doi-asserted-by":"crossref","unstructured":"Joshi R, Qu T, Chan MC, Leong B, Loo BT (2018) Burstradar: Practical real-time microburst monitoring for data center networks. In: Proceedings of the 9th Asia-Pacific Workshop on Systems. Association for Computing Machinery. New York, NY, USA. pp 1\u20138","DOI":"10.1145\/3265723.3265731"},{"key":"492_CR31","doi-asserted-by":"crossref","unstructured":"Teixeira R, Harrison R, Gupta A, Rexford J (2020) Packetscope: Monitoring the packet lifecycle inside a switch. In: Proceedings of the Symposium on SDN Research. Association for Computing Machinery. New York, NY, USA. pp 76\u201382","DOI":"10.1145\/3373360.3380838"},{"key":"492_CR32","doi-asserted-by":"crossref","unstructured":"Jia C, Pan T, Bian Z, et al (2020) Rapid detection and localization of gray failures in data centers via in-band network telemetry. In: NOMS 2020-2020 IEEE\/IFIP Network Operations and Management Symposium. Budapest, Hungary. pp 1\u20139","DOI":"10.1109\/NOMS47738.2020.9110326"},{"key":"492_CR33","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1109\/LNET.2021.3130573","volume":"4","author":"Y Zhang","year":"2021","unstructured":"Zhang Y, Pan T, Zheng Y et al (2021) Automating rapid network anomaly detection with in-band network telemetry. IEEE Netw Lett 4(1):39\u201342","journal-title":"IEEE Netw Lett"},{"key":"492_CR34","doi-asserted-by":"publisher","first-page":"4151","DOI":"10.1109\/TNSM.2021.3125012","volume":"18","author":"L Tan","year":"2021","unstructured":"Tan L, Su W, Zhang W et al (2021) A packet loss monitoring system for in-band network telemetry: detection, localization, diagnosis and recovery. IEEE Trans Netw Serv Manag 18(4):4151\u20134168","journal-title":"IEEE Trans Netw Serv Manag"},{"key":"492_CR35","doi-asserted-by":"publisher","first-page":"839","DOI":"10.1109\/TNSM.2020.3037019","volume":"18","author":"A Putina","year":"2020","unstructured":"Putina A, Rossi D (2020) Online anomaly detection leveraging stream-based clustering and real-time telemetry. IEEE Trans Netw Serv Manag 18(1):839\u2013854","journal-title":"IEEE Trans Netw Serv Manag"},{"key":"492_CR36","doi-asserted-by":"crossref","unstructured":"Wang R, Nie K, Chang, et al (2020) Deep learning for anomaly detection. In: Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. Association for Computing Machinery. New York, NY, USA.  pp 3569\u20133570","DOI":"10.1145\/3394486.3406481"},{"key":"492_CR37","doi-asserted-by":"crossref","unstructured":"Qi L, Yang Y, Zhou X, et al (2021) Fast anomaly identification based on multiaspect data streams for intelligent intrusion detection toward secure Industry 4.0. IEEE Trans Ind Inf 18(9):6503\u20136511","DOI":"10.1109\/TII.2021.3139363"},{"key":"492_CR38","doi-asserted-by":"crossref","unstructured":"Ramirez JM, Rojo P, et al (2022) Cleaning matters! preprocessing-enhanced anomaly detection and classification in mobile networks. In: 2022 20th Mediterranean Communication and Computer Networking Conference (MedComNet).  IEEE. Piscataway, NJ. pp 103\u2013112","DOI":"10.1109\/MedComNet55087.2022.9810378"},{"key":"492_CR39","doi-asserted-by":"crossref","unstructured":"Ting KM, Zhou GT, Liu, et al (2010) Mass estimation and its applications. In: Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining. Association for Computing Machinery. New York, NY, USA.  pp 989\u2013998","DOI":"10.1145\/1835804.1835929"},{"key":"492_CR40","doi-asserted-by":"crossref","unstructured":"Xu L, Xu Z (2020) One-class classification with deep adversarial learning. In: Proceedings of the 2019 3rd International Conference on Computer Science and Artificial Intelligence. Association for Computing Machinery. New York, NY, USA.  pp 103\u2013106","DOI":"10.1145\/3374587.3374609"},{"key":"492_CR41","unstructured":"Burnaev E, Ishimtsev V (2016) Conformalized density- and distance-based anomaly detection in time-series data. arXiv preprint arXiv:1608.04585"},{"key":"492_CR42","unstructured":"Ester M, Kriegel HP, Sander J, Xu X, et al (1996) A density-based algorithm for discovering clusters in large spatial databases with noise. In: kdd. AAAI Press. Palo Alto, California USA. pp 226\u2013231"},{"key":"492_CR43","doi-asserted-by":"crossref","unstructured":"Breunig MM, Kriegel HP, et al (2000) LOF: identifying density-based local outliers. In: Proceedings of the 2000 ACM SIGMOD international conference on Management of data. Association for Computing Machinery. New York, NY, USA. pp 93\u2013104","DOI":"10.1145\/342009.335388"},{"key":"492_CR44","unstructured":"Guha S, Mishra N, Roy G, Schrijvers O (2016) Robust random cut forest based anomaly detection on streams. In: International conference on machine learning. JMLR.org. New York, NY, USA. pp 2712\u20132721"},{"key":"492_CR45","doi-asserted-by":"crossref","unstructured":"Angiulli F, Fassetti F (2007) Detecting distance-based outliers in streams of data. In: Proceedings of the sixteenth ACM conference on Conference on information and knowledge management. Association for Computing Machinery. New York, NY, USA.  pp 811\u2013820","DOI":"10.1145\/1321440.1321552"},{"key":"492_CR46","doi-asserted-by":"crossref","unstructured":"Kontaki M, Gounaris A, et al (2011) Continuous monitoring of distance-based outliers over data streams. In: 2011 IEEE 27th International Conference on Data Engineering. IEEE. Piscataway, NJ. pp 135\u2013146","DOI":"10.1109\/ICDE.2011.5767923"},{"issue":"1","key":"492_CR47","doi-asserted-by":"publisher","first-page":"570","DOI":"10.1109\/TII.2022.3170149","volume":"19","author":"X Zhou","year":"2022","unstructured":"Zhou X, Hu Y, Wu J et al (2022) Distribution bias aware collaborative generative adversarial network for imbalanced deep learning in industrial IoT. IEEE Trans Ind Inf 19(1):570\u2013580","journal-title":"IEEE Trans Ind Inf"}],"container-title":["Journal of Cloud Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-023-00492-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s13677-023-00492-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-023-00492-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,18]],"date-time":"2023-11-18T00:49:36Z","timestamp":1700268576000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofcloudcomputing.springeropen.com\/articles\/10.1186\/s13677-023-00492-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,28]]},"references-count":47,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,12]]}},"alternative-id":["492"],"URL":"https:\/\/doi.org\/10.1186\/s13677-023-00492-w","relation":{},"ISSN":["2192-113X"],"issn-type":[{"value":"2192-113X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,8,28]]},"assertion":[{"value":"6 April 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 July 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 August 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"The authors declare no competing interests.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"126"}}