What it detects

The same thing as the Isolation Forest plan: data sessions of the SIM subscriptions of one APN whose traffic profile does not match the APN’s usual behaviour. What changes is how usual is learned.

An autoencoder is a neural network trained to compress each session into a few numbers and rebuild it from them. It only sees normal traffic while training, so it becomes good at rebuilding normal sessions — and bad at rebuilding anything else. The reconstruction error of a new session is its anomaly score.

Data it needs

Identical to the Isolation Forest plan: RADIUS session records with APN, SessionState, IP_GGSN, IP_Device, sbytes, dbytes, spkts, dpkts and dur, filtered to the configured apn, with the same cleaning and the same minDataToTrain check. A time series that feeds one plan feeds the other unchanged.

How it trains

The same thirteen features and scaling as the forest, then a symmetric network of five hidden layers (60 · 30 · 25 · 30 · 60 neurons) trained with the Adam optimiser on mean squared error, with early stopping and L2 regularisation. The decision threshold is again the 95th percentile of the training reconstruction errors, and the same two metrics are recorded:

Metric Meaning
calculated_threshold The reconstruction error above which a session is called anomalous
training_max_score The highest error seen in training, used to normalise anomaly_score

Training a network takes longer than growing a forest. Give the trainer a generous execution timeout.

The prediction request

Same request, same answer as the forest:

{ "sbytes": 18234, "dbytes": 1203991, "spkts": 210, "dpkts": 980, "dur": 3600 }
{
  "prediction": 1,
  "anomaly_score": 1.42,
  "explanation": [
    { "dbytes": 0.213, "received_bytes_rate": 0.187, "total_bytes": 0.171 }
  ]
}

anomaly_score is the reconstruction error divided by the training maximum. explanation, present only for anomalies, lists the features whose individual reconstruction error is in the top quarter — the parts of the session the network could not make sense of.

The rule it creates

The same rule as the Isolation Forest plan: triggered by the GPRS presence turning STOP on a subscription of the configured APN, collecting withAnomaly, score and explanation, and opening and closing the deviceWithAnomaly alarm. Because both plans share the request and the answer, an organization can train both on the same data and compare them side by side, each with its own model name.