# RADIUS session anomalies — Autoencoder

## What it detects

The same thing as the [Isolation Forest plan](../radius_isolation_forest/): data sessions of the SIM
subscriptions of one APN whose traffic profile does not match the APN's usual behaviour. What changes is how
*usual* is learned.

An **autoencoder** is a neural network trained to compress each session into a few numbers and rebuild it from
them. It only sees normal traffic while training, so it becomes good at rebuilding normal sessions — and bad at
rebuilding anything else. The **reconstruction error** of a new session is its anomaly score.

## Data it needs

Identical to the Isolation Forest plan: RADIUS session records with `APN`, `SessionState`, `IP_GGSN`,
`IP_Device`, `sbytes`, `dbytes`, `spkts`, `dpkts` and `dur`, filtered to the configured `apn`, with the same
cleaning and the same `minDataToTrain` check. A time series that feeds one plan feeds the other unchanged.

## How it trains

The same thirteen features and scaling as the forest, then a symmetric network of five hidden layers
(60 · 30 · 25 · 30 · 60 neurons) trained with the Adam optimiser on mean squared error, with early stopping and
L2 regularisation. The decision threshold is again the **95th percentile** of the training reconstruction
errors, and the same two metrics are recorded:

| Metric | Meaning |
|---|---|
| `calculated_threshold` | The reconstruction error above which a session is called anomalous |
| `training_max_score` | The highest error seen in training, used to normalise `anomaly_score` |

Training a network takes longer than growing a forest. Give the trainer a generous execution `timeout`.

## The prediction request

Same request, same answer as the forest:

```json
{ "sbytes": 18234, "dbytes": 1203991, "spkts": 210, "dpkts": 980, "dur": 3600 }
```

```json
{
  "prediction": 1,
  "anomaly_score": 1.42,
  "explanation": [
    { "dbytes": 0.213, "received_bytes_rate": 0.187, "total_bytes": 0.171 }
  ]
}
```

`anomaly_score` is the reconstruction error divided by the training maximum. `explanation`, present only for
anomalies, lists the features whose individual reconstruction error is in the top quarter — the parts of the
session the network could not make sense of.

## The rule it creates

The same rule as the Isolation Forest plan: triggered by the GPRS presence turning `STOP` on a subscription of
the configured APN, collecting `withAnomaly`, `score` and `explanation`, and opening and closing the
`deviceWithAnomaly` alarm. Because both plans share the request and the answer, an organization can train both on
the same data and compare them side by side, each with its own model name.