{'fraction_non_alphanumeric': 0.034488156349991944, 'fraction_numerical': 0.01109550885108538, 'mean_word_length': 5.013788138878121, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 1, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 11, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Deep Neural Mobile Networking

The next generation of mobile networks is set to become increasingly complex, as these struggle to accommodate tremendous data traffic demands generated by ever-more connected devices that have diverse performance requirements in terms of throughput, latency, and reliability. This makes monitoring and managing the multitude of network elements intractable with existing tools and impractical for traditional machine learning algorithms that rely on hand-crafted feature engineering. In this context, embedding machine intelligence into mobile networks becomes necessary, as this enables systematic mining of valuable information from mobile big data and automatically uncovering correlations that would otherwise have been too difficult to extract by human experts. In particular, deep learning based solutions can automatically extract features from raw data, without human expertise. The performance of artificial intelligence (AI) has achieved in other domains draws unprecedented interest from both academia and industry in employing deep learning approaches to address technical challenges in mobile networks. This thesis attacks important problems in the mobile networking area from various perspectives by harnessing recent advances in deep neural networks.

School of Informatics (MTD) technique to break the aggregated mobile traffic measurements into the service level measurement using a deep learning based frameworks called MICROSCOPE. MI-CROSCOPE can capture the spatio-temporal correlations in mobile traffic and deliver precise per-service traffic estimates, which can be an important complement of (DPI).
Deep neural networks are becoming increasingly popular for network intrusion detection systems, as they can achieve high detection accuracy with limited feature engineering. However, such sophisticated models are vulnerable to adversarial attacks, which can compromise the detectors by introducing dedicated subtle perturbation to time-based traffic features. We introduce TIKI-TAKA, to study the robustness of deep anomaly detectors against a realistic black-box adversarial attack threat model, and propose defense solutions which help minimize to risk of those attacks.
We lastly conclude this thesis and pinpoint future research directions which are promising to pursue. Overall, this thesis explores a new territory that empowers the future mobile networks with deep neural network based machine intelligence.  [9]. Given the shift in user preference towards wireless connectivity, Internet Service Providers (ISPs) must develop intelligent heterogeneous architectures and tools that can serve the 5 th generation of mobile systems (5G) and gradually meet more stringent end-user application requirements [10,11].
The growing diversity and complexity of mobile network architectures has made monitoring and managing the multitude of network elements intractable. Therefore, embedding versatile machine intelligence into future mobile networks is drawing unparalleled research interest [12,13]. This trend is reflected in machine learning (ML) based solutions to problems ranging from radio access technology (RAT) selection [14] to malware detection [15]. ML enables systematic mining of valuable information from traffic data and automatically uncover correlations that would otherwise have been too complex to extract by human experts [16]. As the flagship of machine learning, deep learning has achieved remarkable performance in areas such as computer vision [17] and natural language processing (NLP) [18]. Networking researchers are also beginning to recognize the power and importance of deep learning, and are exploring its potential to solve problems specific to the mobile networking domain [19,20].

Research Challenges
5G mobile network infrastructures and services have already been deployed in many densely populated areas to support high-speed, low-latency and reliable wireless communication. Though recent progress appears promising, there remain several research challenges to be addressed. Specifically: 1. The rapid uptake of mobile devices and the rising popularity of mobile applications and services pose unprecedented demands on mobile and wireless networking infrastructure. Upcoming 5G systems are evolving to support exploding mobile traffic volumes, real-time extraction of fine-grained analytics, and agile management of network resources, so as to maximize user experience. Fulfilling these tasks is challenging, as mobile environments are increasingly complex, heterogeneous, and evolving.
2. Large-scale mobile traffic analytics is becoming essential to digital infrastructure provisioning, public transportation, events planning, and other domains. Monitoring city-wide mobile traffic is however a complex and costly process that relies on dedicated probes. Some of these probes have limited precision or coverage, others gather tens of gigabytes of logs daily, which independently offer limited insights. Extracting fine-grained patterns involves expensive spatial aggregation of measurements, storage, and post-processing. 3. Network slicing aligns mobile network operation to this emerging context, as it allows operators to isolate and customize network resources on a per-service Defending against such black-box adversarial attacks remains a challenging task.
Embedding deep learning into the 5G mobile and wireless networks is well justified. In particular, data generated by mobile environments are increasingly heterogeneous, as these are usually collected from various sources, have different formats, and exhibit complex correlations [21]. As a consequence, a range of specific problems become too difficult or impractical for traditional machine learning tools (e.g., shallow neural networks). This is because (i) their performance does not improve if provided with more data [22] and (ii) they cannot handle highly dimensional state/action spaces in control problems [23]. In contrast, big data fuels the performance of deep learning, as it eliminates domain expertise and instead employs hierarchical feature extraction. In essence this means information can be distilled efficiently and increasingly abstract correlations can be obtained from the data, while reducing the pre-processing effort. Graphics Processing Unit (GPU)-based parallel computing further enables deep learning to make inferences within milliseconds. This facilitates network analysis and management with high accuracy and in a timely manner, overcoming the run-time limitations of traditional mathematical techniques (e.g., convex optimization, game theory, meta heuristics).

Advantages of Deep Learning in Mobile Networking
With the growth of complexity of future mobile network, we recognize several benefits of employing deep learning to handle and analyze the huge volume of associated mobile data generated per day, thereby improving the services of mobile networks.
1. It is widely acknowledged that, while vital to the performance of traditional ML algorithms, feature engineering is costly [24]. A key advantage of deep learning is that it can automatically extract high-level features from data that has complex structure and inner correlations. The learning process does not need to be designed by a human, which tremendously simplifies prior feature handcrafting [25]. The importance of this is amplified in the context of mobile networks, as mobile data is usually generated by heterogeneous sources, is often noisy, and exhibits non-trivial spatial/temporal patterns [21], whose labeling would otherwise require outstanding human effort.
2. Secondly, deep learning is capable of handling large amounts of data. Mobile networks generate high volumes of different types of data at fast pace. Training traditional ML algorithms (e.g., Support Vector Machine (SVM) [26] and Gaussian Process (GP) [27]) sometimes requires to store all the data in memory, which is computationally infeasible under big data scenarios. Furthermore, the performance of ML does not grow significantly with large volumes of data and plateaus relatively fast [22]. In contrast, Stochastic Gradient Descent (SGD) employed to train NNs only requires sub-sets of data at each training step, which guarantees deep learning's scalability with big data. Deep neural networks further benefit as training with big data prevents model over-fitting. 3. Traditional supervised learning is only effective when sufficient labeled data is available. However, most current mobile systems generate unlabeled or semilabeled data [21]. Deep learning provides a variety of methods that allow exploiting unlabeled data to learn useful patterns in an unsupervised manner, e.g., Variational Autoencoder (VAE) [28], Generative Adversarial Network (GAN) [29].

Compressive representations learned by deep neural networks can be shared
across different tasks, while this is limited or difficult to achieve in other ML paradigms (e.g., linear regression, random forest, etc.). Therefore, a single model can be trained to fulfill multiple objectives, without requiring complete model retraining for different tasks. We argue that this is essential for mobile network engineering, as it reduces computational and memory requirements of mobile systems when performing multi-task learning applications [35]. 5. Deep learning is effective in handing geometric mobile data [36], while this is a conundrum for other ML approaches. Geometric data refers to multivariate data represented by coordinates, topology, metrics and order [37]. Mobile data, such as mobile user location and network connectivity can be naturally represented by point clouds and graphs, which have important geometric properties. These data can be effectively modeled by dedicated deep learning architectures, such as PointNet++ [38] and Graph CNN [39]. Employing these architectures has great potential to revolutionize the geometric mobile data analysis [40].
These advantages make deep learning a powerful tool for addressing problems specific to mobile networking, which have been either considered intractable previously or require significant effort if tackled with existing theoretical methods or heuristics.

Limitations of Deep Learning in Mobile Networking
However, deep learning is not a silver bullet to every application in the mobile networking area, as it also has several shortcomings, which partially restricts its applicability in this domain. Specifically, 1. In general, deep learning (including deep reinforcement learning) is vulnerable to adversarial examples [41,42]. These refer to artifact inputs that are intentionally designed by an attacker to fool machine learning models into making mistakes [41]. While it is difficult to distinguish such samples from genuine ones, they can trigger mis-adjustments of a model with high likelihood. Deep learning, especially CNNs are vulnerable to these types of attacks. This may also affect the applicability of deep learning in mobile systems. For instance, hackers may exploit this vulnerability and construct cyber attacks that subvert deep learning based detectors [43]. Constructing deep models that are robust to adversarial examples is imperative, but remains challenging.
2. Deep learning algorithms are largely black boxes and have low interpretability.
Their major breakthroughs are in terms of accuracy, as they significantly improve performance of many tasks in different areas. However, although deep learning enables creating "machines" that have high accuracy in specific tasks, we still have limited knowledge as of why NNs make certain decisions. This limits the applicability of deep learning, e.g. in network economics. Therefore, businesses would rather continue to employ statistical methods that have high interpretability, whilst sacrificing on accuracy. Researchers have recognized this problem and investing continuous efforts to address this limitation of deep learning (e.g. [44][45][46]).
3. Deep learning is heavily reliant on data, which sometimes can be more important than the model itself. Deep models can further benefit from training data augmentation [47]. This is indeed an opportunity for mobile networking, as networks generates tremendous amounts of data. However, data collection may be costly, and face privacy concern, therefore it may be difficult to obtain sufficient information for model training. In such scenarios, the benefits of employing deep learning may be outweigh by the costs. 4. Deep learning can be computationally demanding. Advanced parallel computing (e.g. GPUs, high-performance chips) fostered the development and popularity of deep learning, yet deep learning also heavily relies on these. Deep NNs usually require complex structures to obtain satisfactory accuracy performance.
However, when deploying NNs on embedded and mobile devices, energy and capability constraints have to be considered. Very deep NNs may not be suitable for such scenario and this would inevitably compromise accuracy. 5. Deep neural networks usually have many hyper-parameters and finding their optimal configuration can be difficult. For a single convolutional layer, we need to configure at least hyper-parameters for the number, shape, stride, and dilation of filters, as well as for the residual connections. The number of such hyperparameters grows exponentially with the depth of the model and can highly influence its performance. Finding a good set of hyper-parameters can be similar to looking for a needle in a haystack. The AutoML platform 1 provides a first solution to this problem, by employing progressive neural architecture search [48].
This task, however, remains costly.
These pitfalls need to be avoided when deploying deep learning in real mobile network systems.

Thesis Contribution
This thesis attacks important problems in the mobile networking domain using deep learning approaches from different perspectives. In particular, we harness the unique advantages of deep learning and tailor those to individual mobile networking problem, which leads the following contributions:

Survey on Deep Learning in Mobile Networking
First, we bridge the gap between deep learning and mobile and wireless networking research, by a survey of the crossovers between the two areas. We provide a review of mobile and wireless networking research based on deep learning, categorized by different applications domains. Part of this work has been published in:

Long-term Mobile Traffic Forecasting on City Grids
Forecasting with high accuracy the volume of data traffic that mobile users will consume is becoming increasingly important for precision traffic engineering, demandaware network resource allocation, as well as public transportation. Measurements collection in dense urban deployments is however complex and expensive, and the post-processing required to make predictions is highly non-trivial, given the intricate spatio-temporal variability of mobile traffic due to user mobility.

Multi-service Mobile Traffic Forecasting on Point-cloud Antennas
The third contribution of the thesis attacks the multi-service mobile traffic forecasting problem on geospatial point-cloud structural antennas, where traditional CNN-based neural networks cannot be directly employed. This is distinct from the forecasting over grids in the previous contribution. To handle the point cloud data structure, we introduces CloudLSTM, a new branch of recurrent neural network models tailored to forecasting over data streams generated by geospatial point-cloud sources. We design a Dynamic Convolution (D-Conv) operator as the core component of CloudLSTMs, which allows performing convolution operations directly over point-clouds and extracts local spatial features from sets of neighboring points that surround different elements of the input. This maintains the permutation invariance of sequence-to-sequence learning frameworks, while enabling learnable neighboring correlations at each time step -an important aspect in spatio-temporal predictive learning. The D-Conv operator resolves the grid-structural data requirements of existing spatio-temporal forecasting models (e.g., ConvLSTM) and can be easily plugged into traditional LSTM architectures with sequence-to-sequence learning and attention mechanisms. We perform antenna-level forecasting of the data traffic generated by mobile services, demonstrat-

Mobile Traffic Super Resolution
Next, we propose an original mobile traffic super-resolution technique that overcomes these problems by inferring narrowly localized traffic consumption from coarse measurements. We draw inspiration from image processing and design a deep-learning architecture tailored to mobile networking, which combines Zipper Network (ZipNet) and Generative Adversarial neural Network (GAN) models. This enables to uniquely capture spatio-temporal relations between traffic volume snapshots routinely monitored over broad coverage areas ('low-resolution') and the corresponding consumption at 0.05 km 2 level ('high-resolution') usually obtained after intensive computation.
Experiments we conduct with a real-world dataset demonstrate that the proposed ZipNet(-GAN) infers traffic consumption with up to 100× higher granularity as compared to standard probing, irrespective of the coverage and the position of the probes.
Importantly, our solutions outperform existing traditional and deep-learning based interpolation methods, as we achieve up to 78% lower reconstruction errors, 40% higher fidelity of reconstructed traffic patterns, and improve the structural similarity by 36.4×.
To our knowledge, this is the first time super-resolution concepts are applied to largescale mobile traffic analysis and our solution is the first to infer fine-grained urban traffic patterns from coarse aggregates. Part of this work has been published in:

Mobile Traffic Decomposition
We present an original approach to service-level demand estimation for network slicing, which hinges on decomposition, i.e., the inference of per-service demands from traffic aggregates. By operating on total traffic volumes only, our approach overcomes the complexity and limitations of legacy traffic classification techniques, and provides an output suitable for recent 'Network Slice as a Service' models. We implement decomposition through MICROSCOPE, a dedicated framework based on novel 3D Deformable Convolutional Neural Networks (3D-DefCNNs) designed to handle spatial distortion in the input data due to irregular radio access deployment and coverage, and to exploit hidden spatio-temporal features in traffic aggregates. Experiments with metropolitan-scale measurements collected in an operational network demonstrate that MICROSCOPE accurately infers per-service traffic demands, with estimation errors be-

Attacking and Defending Deep Learning-based Intrusion Detection Systems
We then introduce TIKI-TAKA, a framework for (i) assessing the robustness of stateof-the-art deep learning-based Network Intrusion Detection Systems (NIDS) against black-box adversarial manipulations, and which (ii) incorporates defense mechanisms that we propose to increase the resistance to attacks employing such evasion techniques. Specifically, we select five different cutting-edge black-box adversarial attack mechanisms to subvert three popular malicious traffic detectors that employ neural networks. We experiment with two publicly available datasets and consider both one-toall and one-to-one classification scenarios, i.e., discriminating illicit vs benign traffic, and respectively identifying a specific type of anomalous traffic among many considered. The results obtained suggest that attackers can fool NIDS with up to 35.7% success rates, by only altering the time-based features of the traffic generated. To counteract these weaknesses, we propose three defense mechanisms, namely model voting ensembling, ensembling adversarial training, and query detection. We demonstrate that when employing our proposed methods, the reinforced NIDS can defend against adversarial attacks with nearly 100% success rates, with most types of malicious traffic. This confirms their effectiveness and makes the case for adoption in more robust and reliable deep anomaly detectors. To the best of our knowledge, our work is the first to propose defenses against adversarial attacks targeting NIDS. The outcome of the research has been summarized into a paper as follows: 1. C. Zhang, X. Costa-Perez and P. Patras . "TIKI-TAKA: Attacking and Defending Deep Learning-based Intrusion Detection Systems", (Under review).

Thesis Organization
We show the high-level overview of the thesis in Chapter 3 focuses on using a dedicated deep neural network architecture to perform long-term aggregated mobile traffic forecasting at city scale on grid structural data. We start with one-step forecasting, then present two important approaches to extend the reliable predicting duration. With our approaches, we further demonstrate that the employed architecture can be trained on dataset collected in one city, while generalizing well on a different area which has different traffic scale and spatial topology.
Chapter 4 investigates the mobile traffic forecasting in multi-service scenarios in the network slicing context. The employed dataset is collected at the antenna level, which are non-uniformly distributed over the city. This form sequences of geospatial point clouds, which differ from the grid structural format handled in Chapter 3. We develop a novel neural model named CloudLSTM tailored to the point cloud data to perform multi-service mobile traffic forecasting. We show that our CloudLSTM can deliver precise prediction and outperform state-of-the-art approaches.
Chapter 5 introduces a mobile traffic super resolution (MTSR) approach to reduce the cost of fine-grained mobile traffic measurements by performing coarse-tofine grained transformation using a generative adversarial network (GAN). By training the generator and discriminator iteratively, our method can improve the granularity of traffic measurement by up to 100× with high accuracy, while remaining robust to anomalous traffic.
Chapter 6 presents an original mobile traffic decomposition (MTD) technique to perform service-level demand estimation given aggregated traffic using deep neural network architectures. This overcomes the complexity and limitations of traditional traffic classification techniques, i.e., deep packet inspection. We test our proposal at different network levels at metropolitan-scale measurements with 10 popular mobile services, and demonstrate its superior effectiveness and efficiency.
Chapter 7 studies the mobile network security with a realistic black-box threat model. We introduce TIKI-TAKA, to first (i) evaluate the robustness of deep learning NIDS against black-box adversarial attacks, and (ii) propose defense mechanisms to protect them from those adversarial intrusion. By employing our proposed defense methods, the successful rates of each adversarial attack drop to nearly 0% on most types of malicious traffic. This enables to construct more robust and reliable deep anomaly detectors against adversarial attacks. 3. Deep Learning Driven Network Security presents work that leverages deep learning to improve network security, which we cluster by focus as infrastructure, software, and privacy related.

Related High-level Articles
Mobile networking and deep learning problems have been researched mostly independently. Only recently crossovers between the two areas have emerged. Several notable works paint a comprehensives picture of the deep learning and/or mobile networking research landscape. We categorize these works into (i) pure overviews of deep learning techniques, (ii) reviews of analyses and management techniques in modern mobile networks, and (iii) reviews of works at the intersection between deep learning and computer networking. We discuss the most representative publications in each class.

Overviews of Deep Learning and its Applications
The era of big data is triggering wide interest in deep learning across different research disciplines [49][50][51][52] and a growing number of surveys and tutorials are emerging (e.g. [53,54]). LeCun et al.
give a milestone overview of deep learning, introduce several popular models, and look ahead at the potential of deep neural networks [25]. Schmidhuber undertakes an encyclopedic survey of deep learning, likely the most comprehensive thus far, covering the evolution, methods, applications, and open research issues [55]. Liu et al. summarize the underlying principles of several deep learning models, and review deep learning developments in selected applications, such as speech processing, pattern recognition, and computer vision [56].
Arulkumaran et al. present several architectures and core algorithms for deep reinforcement learning, including deep Q-networks, trust region policy optimization, and asynchronous advantage actor-critic [57]. Their survey highlights the remarkable performance of deep neural networks in different control problem (e.g., video gaming, Go board game play, etc.). Similarly, deep reinforcement learning has also been surveyed in [58], where the authors shed more light on applications. Zhang et al. survey developments in deep learning for recommender systems [59], which have potential to play an important role in mobile advertising. As deep learning becomes increasingly popular, Goodfellow et al. provide a comprehensive tutorial of deep learning in a book that covers prerequisite knowledge, underlying principles, and popular applications [22].
Surveys on Future Mobile Networks The emerging 5G mobile networks incorporate a host of new techniques to overcome the performance limitations of current deployments and meet new application requirements. Progress to date in this space has been summarized through surveys, tutorials, and magazine papers (e.g. [10,11,[60][61][62]).
Andrews et al. highlight the differences between 5G and prior mobile network architectures, conduct a comprehensive review of 5G techniques, and discuss research challenges facing future developments [60]. Agiwal et al. review new architectures for 5G networks, survey emerging wireless technologies, and point out research problems that remain unsolved [10]. Gupta et al. also review existing work on 5G cellular network architectures, subsequently proposing a framework that incorporates networking ingredients such as Device-to-Device (D2D) communication, small cells, cloud com-puting, and the IoT [11].
Intelligent mobile networking is becoming a popular research area and related work has been reviewed in the literature (e.g. [13,[63][64][65][66][67][68][69]). Jiang et al. discuss the potential of applying machine learning to 5G network applications including massive MIMO and smart grids [13]. This work further identifies several research gaps between ML and 5G that remain unexplored. Li et al. discuss opportunities and challenges of incorporating artificial intelligence (AI) into future network architectures and highlight the significance of AI in the 5G era [66]. Klaine et al. present several successful ML practices in Self-Organizing Networks (SONs), discuss the pros and cons of different algorithms, and identify future research directions in this area [69]. Potential exists to apply AI and exploit big data for energy efficiency purposes [70]. Chen et al. survey traffic offloading approaches in wireless networks, and propose a novel reinforcement learning based solution [71]. This opens a new research direction toward embedding machine learning towards greening cellular networks.
Deep Learning Driven Networking Applications A growing number of papers survey recent works that bring deep learning into the computer networking domain. Alsheikh et al. identify benefits and challenges of using big data for mobile analytics and propose a Spark based deep learning framework for this purpose [21]. Wang and Jones discuss evaluation criteria, data streaming and deep learning practices for network intrusion detection, pointing out research challenges inherent to such applications [72].
Zheng et al. put forward a big data-driven mobile network optimization framework in 5G networks, to enhance QoE performance [12]. More recently, Fadlullah et al.
deliver a survey on the progress of deep learning in a board range of areas, highlighting its potential application to network traffic control systems [73]. Their work also highlights several unsolved research issues worthy of future study.  [77]. Their work surveys state-of-the-art deep learning applications in wireless networks, and discusses research challenges to be solved in the future.

Deep Learning Driven Network-level Mobile Data Analysis
Notably, The development of mobile technology (e.g. smartphones, augmented reality, etc.) are forcing mobile operators to evolve mobile network infrastructures. As a consequence, both the cloud and edge side of mobile networks are becoming increasingly sophisticated to cater for users who produce and consume huge amounts of mobile data daily. These data can be either generated by the sensors of mobile devices that record individual user behaviors (app-level), or from the mobile network infrastructure (network-level), which reflects dynamics in urban environments. Appropriately mining these data can benefit multidisciplinary research fields and the industry in areas such mobile network management, social analysis, public transportation, personal services provision, and so on [78]. Network operators, however, could become overwhelmed when managing and analyzing massive amounts of heterogeneous mobile data [79].
Deep learning is probably the most powerful methodology that can overcoming this burden.
Network-level mobile data refers broadly to logs recorded by Internet service providers, including infrastructure metadata, network performance indicators and call detail records (CDRs). The recent remarkable success of deep learning ignites global interests in exploiting this methodology for mobile network-level data analysis, so as to optimize mobile networks configurations, thereby improving end-uses' QoE. These work can be categorized into four types: network state prediction, network traffic classification, CDR mining and radio analysis. In what follows, we review work in these directions.
Network State Prediction refers to inferring mobile network traffic or performance indicators, given historical measurements or related data. Pierucci and Micheli investigate the relationship between key objective metrics and QoE [80]. They employ MLPs to predict users' QoE in mobile communications, based on average user throughput, number of active users in a cells, average data volume per user, and channel quality indicators, demonstrating high prediction accuracy. Network traffic forecasting is another field where deep learning is gaining importance. By leveraging sparse coding and max-pooling, Gwon and Kung develop a semi-supervised deep learning model to classify received frame/packet patterns and infer the original properties of flows in a WiFi network [81]. Their proposal demonstrates superior performance over traditional ML techniques. Nie et al. investigate the traffic demand patterns in wireless mesh network [82]. They design a DBN along with Gaussian models to precisely estimate traffic distributions.
In addition to the above, several researchers employ deep learning to forecast mobile traffic at city scale, by considering spatio-temporal correlations of geographic mobile traffic measurements. We illustrate the underlying principle in Fig. 2 [84][85][86] and [87], where the authors employ CNNs and LSTMs to perform mobile traffic forecasting. By effectively extracting spatio-temporal features, their proposals gain significantly higher accuracy than traditional approaches, such as ARIMA. Wang et al. represent spatio-temporal dependencies in mobile traffic using graphs, and learn such dependencies using Graph Neural Networks [40]. Beyond the accurate inference achieved in their study, this work also demonstrates potential for precise social events inference.
Traffic Classification is aimed at identifying specific applications or protocols among the traffic in networks. Wang recognizes the powerful feature learning ability of deep neural networks and uses a deep AE to identify protocols in a TCP flow dataset, achieving excellent precision and recall rates [88]. Work in [89] proposes to use a 1D CNN for encrypted traffic classification. The authors suggest that this structure works well for modeling sequential data and has lower complexity, thus being promising in addressing the traffic classification problem. Similarly, Lotfollahi et al. present Deep Packet, which is based on a CNN, for encrypted traffic classification [90]. Their framework reduces the amount of hand-crafted feature engineering and achieves great Lessons learned: Network-level mobile data, such as mobile traffic, usually involves essential spatio-temporal correlations. These correlations can be effectively learned by CNNs and RNNs, as they are specialized in modeling spatial and temporal data (e.g., images, traffic series). An important observation is that large-scale mobile network traffic can be processed as sequential snapshots, as suggested in [5,7], which resemble images and videos [97,98]. Therefore, potential exists to exploit image pro-

Deep Learning Driven Network Security
With the increasing popularity of wireless connectivity, protecting users, network equipment and data from malicious attacks, unauthorized access and information leakage becomes crucial. Cyber security systems guard mobile devices and users through firewalls, anti-virus software, and Intrusion Detection Systems (IDS) [99].  [109].
In order to improve detection performance, their VAE infers missing features associated with incomplete measurements, which are common in IoT environments. The true data labels are embedded into the decoder layers to assist final classification.
Evaluations on the well-known NSL-KDD dataset [110] [117]. The CNN has also been used in [118], where the authors draw inspiration from NLP and take the disassembled byte-code of an app as a text for analysis.  [122]. They employ both under-sampling and over-sampling to address the class imbalance between botnet and normal traffic in the dataset, which is common in anomaly detection problems. Similar issues are also studies in [123] and [124], where the authors use standard MLPs to perform mobile and peer-to-peer botnet detection respectively, achieving high overall accuracy.
User privacy level: Preserving user privacy during training and evaluating a deep neural network is another important research issue [125]. Initial research is conducted in [126], where the authors enable user participation in the training and evaluation of a neural network, without sharing their input data. This allows to preserve individual's privacy while benefiting all users, as they collaboratively improve the model performance. Their framework is revisited and improved in [127], where another group of researchers employ additively homomorphic encryption, to address the information leakage problem ignored in [126], without compromising model accuracy. This significantly boosts the security of the system. More recently, Wang et al. [128] propose a framework called ARDEN to preserve users' privacy while reducing communication overhead in mobile-cloud deep learning applications. ARDEN partitions a NN across cloud and mobile devices, with heavy computation being conducted on the cloud and mobile devices performing only simple data transformation and perturbation, using a differentially private mechanism. This simultaneously guarantees user privacy, improves inference accuracy, and reduces resource consumption.
Osia et al. focus on privacy-preserving mobile analytics using deep learning. They design a client-server framework based on the Siamese architecture [129], which accommodates a feature extractor in mobile devices and correspondingly a classifier in the cloud [130]. By offloading feature extraction from the cloud, their system offers strong privacy guarantees. An innovative work in [131] implies that deep neural networks can be trained with differential privacy. The authors introduce a differentially private SGD to avoid disclosure of private information of training data. Experiments on two publicly-available image recognition datasets demonstrate that their algorithm is able to maintain users privacy, with a manageable cost in terms of complexity, efficiency, and performance. This approach is also useful for edge-based privacy filtering techniques such as Distributed One-class Learning [132].

Tailoring Deep Learning to Mobile Networks
Although deep learning performs remarkably in many mobile networking areas, the No Free Lunch (NFL) theorem indicates that there is no single model that can work univer-sally well in all problems [139]. This implies that for any specific mobile and wireless networking problem, we may need to adapt different deep learning architectures to achieve the best performance. In this section, we look at how to tailor deep learning to mobile networking applications from three perspectives, namely, mobile devices and systems, distributed data centers, and changing mobile network environments.

Tailoring Deep Learning to Mobile Devices and Systems
The  [140], such that the inference process does not violate latency or energy constraints [141,142], nor raise any privacy concern [143]. We outline discuss their key contributions next.  [157]. By using a deep Q learning optimizer, their proposal can achieve appropriate trade-offs between accuracy, latency, storage and energy consumption.
Beyond these works, researchers also successfully adapt deep learning architectures through other designs and sophisticated optimizations, such as parameters quantization [158,159], model slimming [160], sparsification and separation [161], representation and memory sharing [35,162], convolution operation optimization [163], pruning [164], cloud assistance [165] and compiler optimization [166]. These techniques will be of great significance when embedding deep neural networks into mobile systems. As such, one of the challenges facing parallelism, in the context of mobile network-ing, is that of training neural networks on a large number of mobile devices that are battery powered, have limited computational capabilities and in particular lack GPUs.

Tailoring Deep Learning to Distributed Data Containers
The key goal of this paradigm is that of training with a large number of mobile CPUs at least as effective as with GPUs. The speed of training remains important, but becomes a secondary goal. Decentralized methods can also be applied to deep reinforcement learning. In Training Parallelism is also essential for mobile system, as mobile data usually come asynchronously from different sources. Training models effectively while maintaining consistency, fast convergence, and accuracy remains however challenging [172].
A practical method to address this problem is to perform asynchronous SGD. The basic idea is to enable the server that maintains a model to accept delayed information (e.g. data, gradient updates) from workers. At each update iteration, the server only requires to wait for a smaller number of workers. This is essential for training a deep neural network over distributed machines in mobile systems. The asynchronous SGD is first studied in [173], where the authors propose a lock-free parallel SGD named HOGWILD, which demonstrates significant faster convergence over locking counterparts. The Downpour SGD in [167] improves the robustness of the training process when work nodes breakdown, as each model replica requests the latest version of the parameters. Hence a small number of machine failures will not have a significant impact on the training process. A similar idea has been employed in [174]  Deep Lifelong Learning mimics human behaviors and seeks to build a machine that can continuously adapt to new environments, retain as much knowledge as possible from previous learning experience [183]. There exist several research efforts that adapt traditional deep learning to lifelong learning. For example, Lee et al. propose a dual-memory deep learning architecture for lifelong learning of everyday human behaviors over non-stationary data streams [184]. To enable the pre-trained model to retain old knowledge while training with new data, their architecture includes two memory buffers, namely a deep memory and a fast memory. The deep memory is composed of several deep networks, which are built when the amount of data from an unseen distribution is accumulated and reaches a threshold. The fast memory component is a small neural network, which is updated immediately when coming across a new data sample. These two memory modules allow to perform continuous learning without forgetting old knowledge. Experiments on a non-stationary image data stream prove the effectiveness of this model, as it significantly outperforms other online deep learning algorithms. The memory mechanism has also been applied in [185]. In particular, the authors introduce a differentiable neural computer, which allows neural networks to dynamically read from and write to an external memory module. This enables lifelong lookup and forgetting of knowledge from external sources, as humans do.
Parisi et al. consider a different lifelong learning scenario in [186]. They abandon the memory modules in [184] and design a self-organizing architecture with recurrent neurons for processing time-varying patterns. A variant of the Growing When Required network is employed in each layer, to to predict neural activation sequences from the previous network layer. This allows learning time-vary correlations between inputs and labels, without requiring a predefined number of classes. Importantly, the framework is robust, as it has tolerance to missing and corrupted sample labels, which is common in mobile data.
There exist two extreme transfer learning paradigms, namely one-shot learning and zero-shot learning. One-shot learning refers to a learning method that gains as much information as possible about a category from only one or a handful of samples, given a pre-trained model [191]. On the other hand, zero-shot learning does not require any sample from a category [192]. It aims at learning a new distribution given meta description of the new category and correlations with existing training data. Though research towards deep one-shot learning [33,193] and deep zero-shot learning [194,195] is in its infancy, both paradigms are very promising in detecting new threats or traffic patterns in mobile networks.

Summary
Deep learning is playing an increasingly important role in the mobile and wireless networking domain. In this chapter, we provided a survey of recent work that lies at the intersection between deep learning and mobile networking.

Forecasting on City Grids
Precision traffic engineering and demand-aware allocation of cellular network resources is becoming essential to support emerging applications, including augmented/virtual reality, autonomous vehicles, and digital healthcare. These tasks require real-time traffic analysis and accurate prediction capabilities [196], which are challenging to implement with existing tools [197]. In particular, mobile network monitoring currently relies on specialized equipment, e.g. probes [198]. Deploying these at each base station is expensive and involves storing locally massive amounts of logs that later have to be transferred for analysis. If monitoring is instead exclusively employed at selected locations in the core network, it requires substantial processing power. Timely and exact mobile traffic forecasting is further complicated by the complex spatio-temporal patterns of user demand [199,200].
Alarm based monitoring systems enable engineers to react to abrupt changes in traffic volume only a posteriori, which impacts negatively on the latency perceived by interactive applications. While long-term network traffic forecasting techniques have been proposed to overcome this problem in wired broadband networks (e.g. [202][203][204]), mobile networks have received less attention [205]. Existing mobile traffic prediction mechanisms (e.g. [206,207]) work well in estimating trends, though largely undertake naïve predictive modeling across time series observed at individual base stations; therefore, they are ill-suited to network-wide forecasting. Further, they ignore important spatial correlations associated with user movement, hence are predominantly limited to short-term predictions. Such is the case of common practice exponential smoothing (ExpS) [206] and Auto-Regressive Integrated Moving Average  (ARIMA) [207] techniques, whose accuracy degrades considerably over time when the data series exhibit frequent fluctuations, as we exemplify in Fig require a considerably larger number of parameters to be stored in memory [208].
Secondly, to enable long-term traffic forecasting with only limited observations, we propose an Ouroboros Training Scheme (OTS). This fine tunes the deep neural network such that earlier predictions can be used as input, while the difference between its output and the ground truth is minimized. Our intuition is that re-training the neural network on actual traffic measurements combined with one-step predictions made over these will enhance long-term predictions' quality when ground truth becomes (partly) unavailable.
Thirdly, we specify a Double STN (D-STN) solution that combines the proposed STN with a decay mechanism, which mitigates accumulating prediction errors by mixing the predictions with an empirical mean of the locally observed traffic. This approach ensures mobile traffic volume forecasts remain within reasonable bounds and their duration is substantially extended. Unlike recent work that combines LSTMs and autoencoders for traffic prediction purposes [209], the proposed (D-)STN are not limited to 1-step inferences. Instead, we achieve practical and reliable multi-step forecasting without requiring to train separate neural networks for each base station.
Finally, we implement the proposed (D-)STN prediction techniques on a GPU cluster and conduct experiments on publicly available real-world mobile traffic datasets collected over 60 days and released through the Telecom Italia's Big Data Challenge [201].
The results obtained demonstrate that, once trained, our solutions provide high-accuracy long-term (10-hour long) traffic predictions, while operating with short observation intervals (2 hours) and irrespective of the time of day when they are triggered. Importantly, our models outperform commonly used prediction methods (HW-ExpS and ARIMA), as well as the traditional multilayer perceptron (MLP) and Support Vector Machine (SVM), reducing the normalized root mean square error (NRMSE) by up to 61% and requiring up to 600 times shorter measurement intervals.

The Mobile Traffic Forecasting Problem
Our objective is to make accurate long-term forecasts of the volume of mobile data traffic users consume at different locations in a city, following measurement-based observations. We formally express network-wide mobile traffic consumption observed over a time interval T as a spatio-temporal sequence of data points where D t is a snapshot at time t of the mobile traffic volume in a geographical region represented as an X ×Y grid, i.e.
measures the data traffic volume in a square cell with coordinates (x, y) and the sequence can be regarded as a tensor D ∈ R T ×X×Y . From a machine learning perspective, the spatio-temporal traffic forecasting problem is to predict the most likely K-step sequence of data points, given previous S observations. That means solving There is growing evidence that important spatio-temporal correlations exist between traffic patterns [199,200], though the value at any location, d (x,y) t+1 , largely depends only on the traffic in neighboring cells and information associated with distant cells could be neglected [205]. That is, statistical dependence exists between proximate cells, while the traffic patterns at distant cells provide little insight into how traffic consumption will evolve at a 'target' cell. Therefore, confining consideration to the traffic in (r + 1) × (r + 1) adjacent cells allows us to simplify the problem and express one-step predictions as is the data traffic matrix at time t in an (r + 1) × (r + 1) region adjacent to location (x, y). Then the prediction of D t+1 can be expressed as the set (3.6) The above predictions depend only on a marginal distribution, which is precisely the distribution we will model with the Spatio-Temporal Network (STN) we propose next to forecast mobile traffic across different locations and times. Forecasting points at all locations will be concatenated to reconstruct the entire traffic snapshot.

The Spatio-Temporal Network
We design a deep neural network architecture, which we name Spatio-Temporal neu- ConvLSTMs: The Long Short-Term Memory (LSTM) is a special recurrent neural network (RNN) that remedies the vanishing gradient problem characteristic to RNNs, by introducing a set of "gates" [210]. The gates in standard LSTMs are usually fully connected and as a consequence the number of parameters is large, requiring substantial memory and computation time for training purposes. Hence, although proven powerful when working with sequential data, this model is highly complex and frequently turns overfitted.
ConvLSTMs solve this problem by replacing the inner dense connections with convolution operations [211]. This approach reduces significantly the number of parameters in the model and enhances its ability to handle spatio-temporal data, which is particularly important to our problem. Further, ConvLSTMs can capture long-term trends present in sequences of data points, which makes them particularly well-suited to making inferences about mobile data traffic, as it is known this exhibits important spatio-temporal correlations [196,199].
Given a sequence of 3-D inputs (i.e. multiple "frames" of data traffic measurements across 2-D grids/feature maps) denoted X = {X 1 , X 2 , ..., X T }, we specify the operations of a single ConvLSTM in (3.7). Here ' ' denotes the Hadamard product, ' * ' the 2-D convolution operator, and σ(·) is a sigmoid function. Since each hidden element of this neural network is represented as a 2-D map, we effectively capture cross-spatial traffic correlations through the convolution operations. (3.7) In the above, W (··) and b (·) denote weights and biases we obtain through model training, which we perform on the complete architecture using a stochastic optimization algorithm, as we detail towards the end of this section. Note that the inputs X t , cell outputs C t , hidden states H t , input gates i t , forget gates f t , and output gates o t in the ConvLSTM's inner structure are all 3-D tensors. The first two dimensions of the tensors form the spatial dimension, while the third is the number of feature maps. The input-to-state, cell-to-state, and cell-to-cell transitions are element-wise controlled by each gate i t , o t , and f t , which allows the model to "learn to forget" in the spatiotemporal dimension. This property dramatically improves the model's ability to capture spatio-temporal trends [211].
This choice is motivated by recent results showing 3D-ConvNet perform remarkably in terms of spatio-temporal feature learning [212,213]. Further, they also capture well local dependencies, as seen in minor fluctuations of traffic sequences that are triggered by stochastic human mobility. Given a sequence of spatio-temporal data with N feature maps X = {X 1 , X 2 , ..., X N }, the output of a 3-D convolutional layer will consist of H 1 , . . . H M convoluted feature maps, given by where ' * ' corresponds now to a 3-D convolution operator and act(·) denotes an activation function, whose objective is to increase the model's non-linearity. Functions such as the rectified linear unit (ReLU) and the sigmoid are commonly used for this purpose. We note that 3D-ConvNets differ from ConvLSTMs primarily because they do not involve back-propagation through time (BPTT), which in the latter happens between cells. Instead 3D-ConvNets require more layers to attain similar results. On the other hand, the 3-D convolutions enable the model to also capture cross-temporal traffic correlations essential in our problem. The 3D-ConvNet shares weights across different locations in the input, allowing to maintain the relation between neighboring input points and spatio-temporal locality in feature representations. This property enables 3D-ConvNets to capture better short-term traffic fluctuations and overall improves the model's generalization abilities.

STN -Fusing ConvLSTMs and 3D-ConvNets: To leverage the ability of both
ConvLSTM and 3D-ConvNet to learn spatio-temporal features and forecast mobile data traffic with high accuracy, the STN architecture we propose blends the output of both models through two "fusion" layers (see Fig. 3.2). The goal of the fusion operation is to build an ensembling system which includes two dedicated deep spatiotemporal models, which has been proven to enhance the model's performance [214].
By averaging intermediate outputs of both ConvLSTM and 3D-ConvNet twice, the proposed STN reinforces the ensembling system. Thus through the fusion operations we jointly exploit the advantages of both ConvLSTM (capturing long-term trends) and 3D-ConvNet (capturing local fluctuations), which leads to superior prediction performance, as compared to simply employing any of the two individually. This is demonstrated by the results we present in Sec. 3.4 and is a key novelty of our purpose-built neural network architecture. Importantly, unlike other deep learning approaches proposed recently [209], where different structures extract spatial and temporal patterns separately, our solution can jointly distil spatio-temporal traffic features. This enables us to train our architecture in an end-to-end manner, instead of individually training each of its components, as required in [209]. Further, the proposed STN has excellent generalization abilities, as we will demonstrate it is sufficient to train the STN for a single geographic area, before applying it for inference to others.
In our design the input data (measurements) is first processed in parallel by one ConvLSTM and one 3D-ConvNet, then their outputs are aggregated by a fusion layer that performs the following element-wise addition: where h C and h L are the outputs of a single 3D-ConvNet and respectively a ConvL-STM, and Θ H = {Θ 1 , Θ 2 } denotes the set of their parameters (weights and biases).
We choose the addition operation instead of concatenation, to maintain the dimension in the hidden layer. We employ this procedure twice to encode the spatio-temporal embedding of the data sequence given as input. Subsequently, we decode the obtained features and perform prediction via an MLP. The MLP connects the outputs from the second fusion layer over every time step, to achieve an "attention"-like mechanism [215]. This allows the model to make use of all temporal features learned in order to produce final predictions, rather than merely relying on the last state. It is important to note that, unlike traditional restricted Boltzmann Machines (RBMs) employed for time series forecasting [216], the proposed STN shares weights between inputs, therefore it requires to configure considerably fewer parameters.
The STN models the expected value of the marginal distribution p(d i.e. it takes a "local" spatio-temporal traffic matrix to predict the volume of traffic at the following time instance t +1, and its output consists only of one regression value corresponding to an (x, y) location. The prediction is repeated multiple times to encompass all the locations covered by the cellular network grid.
The encoder contains six 3D-convolutional layers with (3, 3, 3) and respectively (6,6,6) feature maps, and two ConvLSTM layers with 3 and 6 feature maps. In our design, we set the length of the input S = 12 (corresponding to 2 hours, with traffic volume snapshots every 10 mins) and r = 10 (i.e. considering spatial correlation among 10×10 adjacent cells). The length of the input is sufficient to capture the evolution trend of traffic behavior, while retaining a reasonable model complexity. Thus each input is a 11 × 11 × 12 tensor and the STN model will predict the traffic volume d t+1 at the center of a 11 × 11 map in the next time step.
To obtain these predictions, we effectively train a neural network model M parameterized by Θ, which takes a set of inputs F (3.10) We adopt the maximum likelihood estimation (MLE) method to train this model by minimising the following L 2 loss function: (3.11) Stochastic Gradient Descent (SGD) based methods are widely used to optimize this loss function. In our work, we choose the Adam optimizer [217], which commonly yields faster convergence compared to traditional SGD. We employ standard configuration (β 1 = 0.9, β 2 = 0.999, ε = 10 −8 ), setting the initial learning rate to 0.005.
Note that STN only performs one-step predictions based on complete ground truth information available at every step. This is however problematic when multi-step prediction is desired, as soon as ground truth information becomes unavailable. In the next section we extend our design to achieve multi-step predictions and forecast mobile traffic long-term with only limited ground truth observations.

Long-Term Mobile Traffic Forecasting
In the case of multi-step predictions, ground truth becomes rapidly unavailable, while still necessary for conditioning in the prediction problem posed in (3.6). An intuitive  way to address this issue is to recursively reuse recent predictions as input for the following prediction step. Inevitably, this leads to prediction errors that are likely to accumulate over time and the results obtained may be modest. For instance, the predictions the proposed STN makes will be very accurate when ground truth measurements are always available, as we illustrate in the shaded region of Fig. 3.3. However, when network measurements are suspended, the pure STN's output is rapidly unable to follow the actual evolution of the data traffic (observe the red curve in the light region shown in Fig. 3.3).
To address this problem and achieve reliable long-term forecasting, we propose a Double STN scheme (D-STN), which comprises two key enhancements. Specifically, (1) we introduce an Ouroboros Training Scheme (OTS) that fine tunes the neural network, allowing earlier predictions to be fed as inputs when ground truth becomes unavailable, while keeping prediction errors small; (2) D-STN blends the newly trained STN with historical statistics that essentially summarise prior knowledge of long-term trends, and thus enables accurate forecasting for extended periods of time (up to 10h).
We exemplify the D-STN's ability to track the real traffic in Fig. 3.3 and detail its operation next.

An Ouroboros Training Scheme
Turning attention again to (3.6), we can see that ground truth observations become unavailable as early as at the second prediction step. If working with S = 12, by the twelfth step, no measurements will be available for prediction. To deal with this issue, one possibility is to substitute the missing information with earlier model predictions.
However, simply conditioning on inferred data will unavoidably introduce errors that accumulate over time. Intuitively, the reason is that the model only works well when the training data and test data follow the same distributions. When the model operates based on its own predictions, any prediction error, however small, will lead to diverging distributions of input and respectively real data. Similar behavior was previously observed in imitation learning problems [218]. Examining again Fig. 3.3, observe the traffic volume experiences an abrupt rise when the multi-step prediction is activated.
As a result, the pure STN, which completely relies on the model's predictions, fails to capture this initial trend and ultimately the error grows considerably with the prediction step. Pop the first element out of Q, 9: Predict D S+t−1 by M with input Q, 10: Push D S+t−1 to the end of Q. Generate the target input T ← D S+t .

13:
Train M with input Q and target T by SGD. 14: end for

15: end for
We solve this problem by introducing an Ouroboros training scheme (OTS), which draws inspiration from the DAGGER technique that mixes ground truth and selfgenerated sequences in the model training phase [219]. Our goal is to enable the neural network to forecast precisely, irrespective of whether conditioning on ground truth or on predictions it made earlier. Therefore, apart from the original training data, the OTS recursively stores the model predictions and uses these for a second round of training, to mimic the prediction behavior. We summarize this procedure in Algorithm 1, where at every epoch e, we regard the inputs fed to the model as a queue Q. First (t = 1) we initialize this with S ground truth observations (line 6). Subsequently, at every sub-step t, we pop the oldest frame in Q (line 8) and push the prediction made at the last step (lines 9-10), thereby rebuilding the model's input. When used, Q is partitioned into X ×Y data points, each of which is an (r + 1) × (r + 1) × S tensor (in our design these are 10,000 tensors with dimension 11 × 11 × 12). We feed the model with Q and corresponding ground truth T , then preform Stochastic Gradient Descent (SGD) based training [217] (line 13). An epoch will stop when it exhausts all training data, i.e. t reaches T − S. This procedure resembles the behavior of a mythological snake called Ouroboros, which perpetually eats its own tail (hence the name of the proposed scheme). We work with E = 1 epoch, which is sufficient for our problem.
The OTS algorithm works particularly well, as it broadens the horizon of the model by extending the training data with its predictions and enlarging the support set of the input distribution. This can be regarded as a data augmentation technique, which was proven powerful when training complex models [144]. In our case OTS suppresses the overestimation tendency, as the retraining forces the predictions to be substantially closer to the ground truth.

Blending Predictions & Historical Statistics
Employing the OTS will improve the accuracy of multi-step predictions, though note that uncertainty may grow over time and thus limit accuracy when long-term (e.g. ¿5h long) forecasting is desired. In what follows we propose a further improved Double STN (D-STN) forecasting system that addresses this issue.
The D-STN design stems from two important properties of mobile data traffic that we observed. Namely, data traffic exhibits certain periodicity (in both daily and weekly patterns) and relatively flat averages, if observed over long intervals [205]. This is indeed the case also for the city of Milan, as we illustrate in Fig. 3 is a sigmoid decay function which is rectified between (0, 1). γ(h) controls the weighting of model predictions and empirical means. It will non-linearly degenerate to zero over h, meaning the empirical mean will dominate the prediction's result if h is large.
The hyper-parameters w and b control the changing rate and the initial state of γ(h), and are set to w = 0.01 and b = −5 based on cross validation over the training set.
Note that b must be a large negative value to guarantee that the model's predictions will mostly contribute at the beginning of the process. In practice, the empirical mean D t+h can also be updated in an on-line manner, as new measurements are conducted.
In addition, predictions made by the two models D M t+h and D O t+h are weighted by α(h), which is dynamically updated as follows: Recall that S denotes the temporal length of the input sequence and δ is a fixed lower bound for α. Since the fine tuned STN is trained using OTS with the model predictions, which normalises the output of the D-STN. Note that the original and the OTS trained models share the same input when making predictions, i.e.
where D t is the observable ground truth at time t.
Next we compare the performance of STN, D-STN, commonly used network traffic prediction schemes, and other deep learning based predictors, demonstrating substantial accuracy gains over state-of-the-art techniques.

Performance Evaluation
In this section we first briefly describe our implementation of the proposed neural network models.  Trentino (right). Full dataset corresponds to measurements collected over 2 months.

Mobile Traffic Datasets
We experiment with publicly available real-world mobile traffic datasets released through Telecom Italia's Big Data Challenge [201]. These contain network activity measure- can be regarded as almost following a Gaussian distribution in the spatial dimension.
This represents traffic patterns in a metropolitan area. In contrast, the traffic in Trentino is representative for areas where smaller towns are clustered, yet laid out at some distance from each other. Thus the traffic exhibits multiple clusters of smaller volume, and as expected, the overall total consumption is less than that in Milan.

Implementation
We implement the proposed (D-)STN forecasting schemes as well as the conventional ConvLSTM, 3D-ConvNet and MLP using the open-source Python libraries Tensor-Flow [222] and TensorLayer [223]. We train the models using a GPU cluster compris-

Prediction Accuracy Evaluation and Comparison with Existing Techniques
Next we evaluate the performance of our proposals against widely used time series pre- and O(n 2 ) time and space complexities, where n is the size of the training set (in our case, n = 57, 480, 000 points), and is thus computationally infeasible on very large datasets. We do however compare the prediction performance of our schemes against that of an SVM trained on a sub-set of the original data. For completeness, we also compare our proposal against a recent deep learning approach [209], which comprises auto-encoders (AEs) and an LSTM. Unfortunately, this solution cannot operate when ground truth data is (partially) unavailable and is only able to perform one-step predictions. Therefore in this case we limit the comparison to such short-term forecasts.
We train all deep learning models, i.e. In addition, the training and validation data covers rich traffic activities caused by different social events (e.g., black Friday, football matches) and therefore will allow the model to capture unusual traffic patterns. Note that all of the neural network models are reinforced with OTS and empirical mean. We train HW-ExpS and ARIMA on both datasets with measurements collected during the first 50 days and test on the same sets used for evaluating the deep learning models.
We quantify the accuracy of the proposed (D-)STN and existing prediction methods through the Normalized Root Mean Square Error (NRMSE) as given below: Observe that in predictions in the city of Milan, STN and D-STN yield the best performance among other approaches, especially as the prediction duration grows.  for all instances. We only employ AE+LSTM for one-step predictions, as this does not support longer forecasting. We summarise these results in Table 3.1 where we also include the traditional SVM for completeness. Observe that D-STN performs best in all cases, attaining superior performance to that of other neural network based schemes (i.e. Conv-LSTM, 3D-ConvNet, and MLP) used individually, which confirms the effectiveness of combining such elements through multiple fusion layers, as we propose. In addition D-STN achieves NRMSEs up to 60% and 38% smaller than those obtained with HW-ExpS and respectively ARIMA, and as expected SVM is inferior to the MLP. Our approach further outperforms the AE+LSTM solution in terms of onestep prediction by 26%, which confirms the superior performance of our architecture.  We now turn attention to the performance of all schemes on the Trentino dataset.
Recall that the deep learning based prediction schemes were trained on the Milan data,   We further compute averages and standard deviation of the mean over 11 prediction instances and examine the performance over prediction durations of different lengths (1 to 60 steps). We summarize these results in Table 3.2, where we observe that on average ARIMA is slightly more accurate in short-term predictions as the volume of traffic remains low, while STN performs substantially better in the long-term (61% and 35% lower NRMSE than HW-ExpS and ARIMA). We note that since the OTS is employed over the Milan dataset, in this case D-STN may be unnecessarily sophis- areas. Observe that both STN and D-STN make consistently good predictions, as their median is the lowest in all cases. In addition, the performance of D-STN is statistically significant over STN in the Milan dataset, as the error box plot has much lower upper and lower bounds. However, the difference between quartiles is small in the Trentino.
Not least, it is important to note that linear time series predictors require longer observations to forecast the traffic volume. In particular the 50-day long data series used for ARIMA and HW-ExpS are 600 times longer than those employed by the proposed deep learning approaches. Moreover these techniques cannot be reused without prior re-training in each area. In contrast, once trained with one dataset, (D-)STN can be easily re-used in other locations and provides excellent performance, even if the geographical layouts and traffic volume profiles differ.
We also note that our model is not perfect, as it sometime fails to predict traffic spikes. These spikes are mostly caused by noise in the collected data and equipment failures, which are hardly predictable. Other traffic peaks caused by human mobility, can be however, predicted well by our model by capturing the spatio-temporal correlations. We further stress that the traffic spikes can be more predictable if similar patterns have occurred in the training set, and therefore collecting more data for training becomes important to capture richer traffic patterns.

The Spatio-Temporal Impact
Lastly we examine the cross-spatial and cross-temporal correlations between data traffic that is provided as input to the predictors we propose.
The overall model is essentially a complex non-linear function of the input F k .
The relationship between the prediction and measurement observations can be approximated by the first-order term of its Taylor expansion, i.e.
The point-wise contribution of each input data point in (3.4) to the predicted future traffic can be estimated by the w(F k ) [225], i.e.
Evaluating the above should give insights into both the number of temporal steps and measurement points adjacent to a location of interest, required for accurate prediction.  where the target lies, influences the prediction (a color closer to red corresponds to a stronger correlation).
Unsurprisingly, the center of each input accounts for the majority of contributions to the value predicted at t + 1. The cross-temporal correlation is stronger as the frame index approaches t and we can see that the oldest frame (frame 1) provides limited useful information, since all gradients are close to zero. On the other hand, spatial components have a major contribution to the predictions, especially those in the frames closer to t + 1, i.e. frames 9 to 12 (see the brighter squares around the center of each frame). This is indeed reasonable, since users move in clusters and the volume of traffic consumed is more likely to shift to adjacent cells over short intervals, due to their mobility. Further, we observe that cells at the boundaries of the squares we consider (i.e. 11 × 11 × 12) yield small gradient values, which supports the dependence assumption we make in (3.3). We believe that taking into consideration such spatial information is key to the superior prediction accuracy attained by STN, as compared to other single time series predictive methods (e.g. HW-ExpS and ARIMA).

Summary
Forecasting traffic in cellular networks is becoming increasingly important to dynamically allocate network resources and timely respond to exponentially growing user demand. This task becomes particularly difficult as network deployments densify and the cost of accurate monitoring steepens. In this chapter, we proposed a Spatio-Temporal neural Network (STN), which is a precise traffic forecasting architecture that leverages recent advances in deep neural networks and overcomes the limitations of prior forecasting techniques. We introduced an Ouroboros Training Scheme (OTS) to fine tune the pre-trained model. Subsequently, we proposed a Double STN (D-STN), which employs a light-weight mechanism for combining the STN output with historical statistics, thereby improving long-term prediction performance. Experiments conducted with publicly available 60-day long traffic measurements collected in the city of Milan and the Trentino region demonstrate the proposed (D-)STN provide up to 61% lower prediction errors as compared to widely employed ARIMA and HW-ExpS methods, while requiring up to 600 times shorter ground truth measurement durations.
We further recognize that Gaussian Processes have potential to resolve the mobile traffic forecasting, by automatically selecting a combination of kernels to fit time series data [226]. This can further model the prediction uncertainty to better support traffic engineering for mobile operators. Future work will focus on comparing and combining a seasonal Gaussian Process with our D-STN, to further enhance forecasting performance.

Chapter 4 Deep Learning Driven Mobile Traffic
Forecasting on Geospatial Point

Clouds
Digital services continue to diversify and demand often conflicting performance guarantees (e.g., low latency vs. high throughput vs. high reliability). Precision traffic engineering thus becomes increasingly important, as operators must be able to allocate resources intelligently for each service and anticipate individual future demands. Network slicing is a first step towards addressing these challenges, enabling to logically isolate network infrastructure on a per-service basis. Allocating sufficient resources to a certain slice however requires precise measurements and detailed real-time analysis of mobile traffic [227]. Achieving this is computationally expensive [228] and relies heavily on specialized equipment (e.g., measurement probes [198]).
To achieve precise mobile traffic forecasting in support of network slicing, this chapter attacks the network-wide traffic prediction over a broad range of mobile services at the antenna level. Unlike previous forecasting on the city grids, antennas are usually non-uniformly distributed over a region. Forecasting over such scattered antennas poses a different point-cloud stream forecasting problem. Point-cloud stream forecasting seeks to predict the future values and/or locations of data streams generated by a geospatial point cloud S, given sequences of historical observations [229].
Unlike traditional spatio-temporal forecasting on grid-structural data (e.g., precipitation nowcasting [211], or video frame prediction [230]), point-cloud stream forecasting needs to operate on geometrically scattered sets of points, which are irregular and unordered, and encapsulate complex spatial correlations. While vanilla Long Short-term Memories (LSTMs) have modest abilities to exploit spatial features [211], convolution-based recurrent neural network (RNN) models (e.g., ConvLSTM [211] and PredRNN++ [230]) are limited to modeling grid-structural data, and are therefore inappropriate for handling scattered point-clouds. Leveraging the location information embedded in such irregular data sources, so as to learn important spatio-temporal features, is in fact challenging.
Forecasting over grids ... ...  input data streams that are inherently grid-structured, e.g., video frames using ConvL-STMs (top); mapping of point-cloud input to a grid, e.g., mobile network traffic collected at different antennas in a city, to enable forecasting using existing neural network structures (middle); forecasting directly over point-cloud data streams using historical information (as above, but without pre-processing), as proposed in this chapter (bottom).
Existing approaches that tackle the point-cloud stream forecasting problem can be categorized into two classes, both of which bear significant shortcomings: (i) methods that transform point-clouds into data structures amenable to processing with mature solutions (e.g., grids [3], see Fig.4.1); and (ii) models that ignore the exact locations of each data source and inherent spatial correlations (e.g., [231]). The transformations required by the former not only add data preprocessing overheads, but also introduce spatial displacements, which distorts relevant correlations among points [3]. On the other hand, the latter are largely location-invariant, while recent literature suggests spatial correlations should be revisited over time, to suit series prediction tasks [232].
In essence, overlooking dynamic spatial correlations will lead to modest forecasting performance.
Beyond learning from sequential data, deep neural networks for feature learning on spatial-only point cloud are advancing rapidly. PointNet performs feature learning and maintains input permutation invariance [38]. PointNet++ upgrades this structure by hierarchically partitioning point-clouds and performing feature extraction on local regions [233]. VoxelNet employs voxel feature encoding to limit inter-point interactions within a voxel [234]. This effectively projects cloud-points onto sub-grids, which enables feature learning. Li et al., generalize the convolution operation on pointclouds and employ X -transformations to learn the weights and permutations for the features [235]. Through this, the proposed PointCNN leverages spatial-local correlations of point clouds, irrespective of the order of the input. Notably, although these architectures can learn spatial features of point-clouds, they are designed to work with static data, thus have limited ability to discover temporal dependencies.
Contributions. In this chapter, we introduce Convolutional Point-cloud LSTMs CloudLSTM takes into account the locations of each data source and performs dynamic positioning at each time step, to conduct a deformable convolution operation over point-clouds [236]. This allows revising the spatial and temporal correlations, and the configuration of the data points over time, and guarantees that the locationvariant property is met at different steps. Importantly, the D-Conv operator is flexible, as it can be easily plugged into existing neural network models for different purposes, such as RNNs, LSTMs, sequence-to-sequence (Seq2seq) learning [215], and attention mechanisms [237].
We perform antenna-level forecasting of data traffic generated by mobile services [5,227] as a case study, experimenting with metropolitan-scale mobile traffic measurements collected in two European cities for 38 popular mobile apps. This represents an important application of geospatial point-cloud stream forecasting. We combine our CloudLSTM with Seq2seq learning and an attention mechanism, then undertake a comprehensive evaluation on both datasets. The results obtained demonstrate that our architecture can deliver precise long-term mobile traffic forecasting, outperforming eight different baseline neural network models in terms of four performance metrics, without any data preprocessing requirements. To the best of knowledge, the proposed CloudLSTM is the first dedicated neural architecture for spatio-temporal forecasting that operates directly on point-cloud streams.

Convolutional Point-cloud LSTM
Next, we describe in detail the concept and properties of forecasting over point cloudstreams. We then introduce the D-Conv operator, which is at the core of our proposed CloudLSTM architecture. Finally, we present CloudLSTM and its variants, and explain how to combine CloudLSTM with Seq2seq learning and attention mechanisms, to achieve precise forecasting over point-cloud streams.

Forecasting over Point-cloud Streams
We formally define a point-cloud containing a set of N points, as S = {p 1 , p 2 , · · · , p N }. Each point p n ∈ S contains two sets of features, i.e., p n = {ν n , ς n }, where ν n = {v 1 n , · · · , v H n } are value features (e.g., mobile traffic measurements) of p n , and ς n = {c 1 n , · · · , c L n } are its L-dimensional coordinates. At each time step t, we may obtain U different channels of S by conducting different measurements 1 denoted by S υ mobile traffic consumption in a region covered by a scattered antenna set. An ideal point-cloud stream forecasting model should embrace five key properties, similar to other point-cloud applications and spatio-temporal forecasting problems [38,232]: (i) Order invariance: A point cloud is usually arranged without a specific order. Permutations of the input points should not affect the output of the forecasting [38].
(ii) Information intactness: The output of the model should have exactly the same number of points as the input, without losing any information, i.e., N out = N in .
(iii) Interaction among points: Points in S are not isolated, thus the model should be able to capture local dependencies among neighboring points and allow interactions [38].
(iv) Robustness to transformations: The model should be robust to correlationpreserving transformation operations on point-clouds, e.g., scaling and shifting [38].
(v) Location variance: The spatial correlations among points may change over time.
Such dynamic correlations should be revised and learnable during training [232].
In what follows, we introduce the Dynamic Point-cloud Convolution (D-Conv) operator as the core module of the Cloud-LSTM, and explain how D-Conv satisfies the aforementioned properties.

Dynamic Convolution over Point Cloud
The Dynamic Point-cloud Convolution operator (D-Conv) absorbs the concept of ordinary convolution over grids, which takes U 1 channels of 2D tensors as input, and outputs U 2 channels of 2D tensors of smaller size (if without padding). Similarly, the D-Conv takes U 1 channels of a point-cloud S, and outputs U 2 channels of a pointcloud, but with the same number of elements as the input, to ensure the information intactness property (ii) discussed previously. For simplicity, we denote the i th channel of the input set as S i in and the j th channel of the output as S j out . Both S i in and S j out are 2D tensors, of shape (N, (H+L)) and (N, (H+L)) respectively.
We also define Q K n as a subset of points in S i in , which includes the K nearest points with respect to p n in the Euclidean space, i.e., Q K n = {p 1 n , · · · , p k n , · · · , p K n }, where p k n is the k-th nearest point to p n in the set S i in . Note that p n itself is included in Q K n as an anchor point, i.e., p n ≡ p 1 n . Recall that each p n ∈ S contains H value features and L coordinate features, i.e., p n = {ν n , ς n }, where ν n = {v 1 n , · · · , v H n } and ς n = {c 1 n , · · · , c L n }. Similar to the vanilla convolution operator, for each p n in S i in , the D-Conv sums the element-wise product over all features and points in Q K n , to obtain the 66Chapter 4. Deep Learning Driven Mobile Traffic Forecasting on Geospatial Point Clouds values and coordinates of a point p n in S j out . Note that we assume the value features are related to their positions at the previous layer/state, to better exploit the dynamic spatial correlations. Therefore, we aggregate coordinate features c(p k n ) l i when computing the value features v h n, j . The mathematical expression of the D-Conv is thus: In the above, we define learnable weights W as 5D tensors with shape (U is the sigmoid function, which limits the range of predicted coordinates to (0, 1), to avoid outliers. Before feeding them to the model, the coordinates of raw point-clouds are normalized to (0, 1) by ς = (ς − ς min )/(ς max − ς min ), on each dimension. This improves the transformation robustness of the operator.
Note that The K nearest points can indeed vary for each channel at each location.
The reason is that the channels in the point-cloud dataset may represent different types of measurements. For example, channels in the mobile traffic dataset are related to the traffic consumption of different mobile apps. The spatial correlations will vary between different measurements (channels), due to human mobility. For instance, more people may use Facebook at a social event, but YouTube traffic may be less significant in this case. This will be reflected by the data consumption of each mobile service. We want these spatial correlations to be learnable, so we do not fix the K nearest neighbours across channels, but encourage each channel to find the best neighbour set. This is also a contribution of the CloudLSTM, which helps improve the forecasting performance, which will be demonstrated later.
Here, we show that the normalization of the coordinates features enables transformation invariance with shifting and scaling. The shifting and scaling of a point can be represented as: where A and B are a positive scaling coefficient and respectively an offset. By normalizing the coordinates, we have: This implies that, by using normalization, the model is invariant to shifting and scaling transformations.
n } to produce values and coordinate features for p n ∈ S 1 out . Here, each w k is a set of weights w with index k (i.e., k-th nearest neighbor) in Eq. 4.2, shared across different p.
We provide a graphical illustration of D-Conv in Fig. 4.2. For each point p n , the D-Conv operator weights its K nearest neighbors across all features, to produce the values and coordinates in the next layer. Since the permutation of the input neither affects the neighboring information nor the ranking of their distances for any Q K n , D-Conv is a symmetric function whose output does not depend on the input order. This means that the property (i) discussed in Sec. 4.1.1 is satisfied. Further, D-Conv is performed on every point in set S i in and produces exactly the same number of features and points for its output; property (ii) is therefore naturally fulfilled. In addition, operating over a neighboring point set, irrespective of its layout, allows to capture local dependencies and improve the robustness to global transformations (e.g., shifting and scaling). The normalization over the coordinate features further improves the robustness to those transformations. This enables to meet the desired properties (iii) and (iv).
More importantly, D-Conv learns the layout and topology of the cloud-point for the next layer, which changes the neighboring set Q K n for each point at output S j out . This enables the "location-variance" (property (v)), allowing the model to perform dynamic positioning tailored to each channel and time step. This is essential in spatio-temporal forecasting neural models, as spatial correlations change over time [232]. D-Conv can be efficiently implemented using simple 2D convolution, by reshaping the input map and weight tensor, which can be parallelized easily in existing deep learning frameworks.
We assume a batch size of 1 for simplicity. Recall that the input and output of D-Conv, S in and S out , are 3D tensors with shape (N, (H + L),U 1 ) and (N, (H + L),U 2 ), respectively. Note that for each p n in S i in , we find the set of top K nearest neighbors Q K n . Combining these, we transform the input into a 4D tensor S i in , with shape (N, K , (H +L),U 1 ). To perform D-Conv over S i in , we split the operator into the following steps in Algorithm 2, which enables to translate the D-Conv into a standard convolution operation, which is highly optimized by existing deep learning frameworks.
Complexity Analysis. We study the complexity of D-Conv by separating the operation into two steps: (i) finding the neighboring set Q K n for each point p n ∈ S, and (ii) performing the weighting computation in Eq. 4.2. We discuss the complexity of each step separately. For simplicity and without loss of generality, we assume the number of input and output channels are both 1. For step (i), the complexity of computing a point-wise Euclidean distance matrix is O(L · N 2 ), while finding K nearest neighbors for one point has complexity O(N log K ), if using heapsort [238]. As such, (i) has complexity O(L · N 2 + N log K ). For step (ii), it is easy to see from Eq. 4.2 that the complexity of computing one feature of the output p n is O((H + L) · K ). Since each Algorithm 2 Efficient algorithm for D-Conv implementation using the 2D convolution operator 1: Inputs: S in , with shape (N, K , (H + L),U 1 ).

2: Initialize:
The weight tensor W . Relations with PointCNN [235] and Deformable Convolution [236]. The D-Conv operator builds upon the PointCNN [235] and deformable convolution neural network (DefCNN) on grids [236], but introduces several variations tailored to pointcloud structural data. PointCNN employs the X -transformation over point clouds, to learn the weight and permutation on a local point set using multilayer perceptrons (MLPs), which introduces extra complexity. This operator guarantees the order invariance property, but leads to information loss, since it performs aggregation over points.
In our D-Conv operator, the permutation is maintained by aligning the weight of the ranking of distances between point p n and Q K n . Since the distance ranking is unrelated to the order of the inputs, the order invariance is ensured in a parameter-free manner without extra complexity and loss of information.
Further, the D-Conv operator can be viewed as the DefCNN [236] over pointclouds, with the differences that (i) DefCNN deforms weighted filters, while D-Conv deforms the input maps; and (ii) DefCNN employs bilinear interpolation over input maps with a set of continuous offsets, while D-Conv instead selects K neighboring points for its operations. Both DefCNN and D-Conv have transformation modeling flexibility, allowing adaptive receptive fields on convolution. We note that to the best of our knowledge, D-Conv is the first convolutional operator for point cloud stream processing, which makes the major contribution of this chapter.

The CloudLSTM Architecture
The D-Conv operator can be plugged straightforwardly into LSTMs, to learn both spatial and temporal correlations over point-clouds. We formulate the Convolutional Point-cloud LSTM (CloudLSTM) as: We combine our CloudLSTM with Seq2seq learning [215] and the soft attention mechanism [237], to perform forecasting, given that these neural models have been proven to be effective in spatio-temporal modeling on grid-structural data (e.g., [211,239]).
Sequence-to-sequence learning is a technique widely-applied to recurrent neural network (RNN) for machine translation tasks [215]. This structure employs a RNN model to encode the input into a low-dimensional tensor. The decoder is another RNN model that decodes the tensor encoded into a sequence. The sequence-to-sequence architecture provides an end-to-end mapping from different sequences, which is particular  CloudLSTM architecture (right). We denote by (·) ν and (·) ς the value and coordinate features of each input, while these features are unified for gates.
well-suited for the mobile traffic forecasting problem, since essentially we seek to infer a sequence (i.e., future mobile traffic demand) from another sequence (i.e., mobile traffic measurements observation).

Soft attention mechanism
We denote the j-th and i-th states of the encoder and decoder as H j en and H i de . The context tensor for state i at the encoder can be represented as: where e i, j is a score function, which can be selected among many alternatives. In Here [·; ·] is the concatenation operator and * is the convolution function. Both W a and v a are learnable weights. The processing tasks [240], which helps translate the raw point cloud into tensors and vice versa. In this study, we employ a two-stack encoder-decoder architecture, and configure 36 channels for each CloudLSTM cell, as we found that further increasing the number of stacks and channels does not improve the performance significantly.
Beyond CloudLSTM, we also explore plugging the D-Conv into vanilla RNN and and Convolutional Point-cloud GRU (CloudGRU), as formulated by the following equations respectively: CloudRNN: CloudGRU: The CloudRNN and CloudGRU share a similar Seq2seq architecture with CloudL-STM, except that they do not employ the attention mechanism. They are employed as baselines to compare different sequential structures for mobile traffic forecasting.
Note that the attention mechanism is not used in the CloudRNN and CloudGRU. We compare their performance in the following section.

Experiments
To evaluate the performance of our architectures, we employ antenna-level mobile traffic forecasting as a case study and experiment with two large-scale mobile traffic datasets. We use the proposed CloudLSTM to forecast future mobile traffic consumption at scatter-distributed antennas in the regions of interest. We provide a comprehensive comparison with 12 baseline deep learning models, over four performance metrics. All models considered in this study are implemented using the open-source Python libraries TensorFlow [222] and TensorLayer [223]. We train all architectures with a computing cluster with two NVIDIA Tesla K40M GPUs. We optimize all models by minimizing the mean square error (MSE) between predictions and ground truth, using the Adam optimizer [241].
Next, we first introduce the dataset employed in this study, then discuss the baseline models used for comparison, the experimental settings, and the performance metrics employed for evaluation. Finally, we report on the experimental results and provide visualizations that reveal further insights.

Dataset and Preprocessing
We conduct experiments using large-scale multi-service datasets collected by a major operator in two large European metropolitan areas during 85 consecutive days. The data consists of the volume of traffic generated by devices associated to each of the 792 and respectively 260 antennas in the two target areas. The antennas are non-uniformly distributed over the urban regions, thus they can be viewed as 2D point clouds over space. Their locations are fixed across the measurements period. As a final remark on data collection, we stress that all measurements were carried out under the supervision of the competent national privacy agency and in compliance with applicable regulations. In addition, the dataset we employ for our study only provides mobile service traffic information accumulated at the antenna level, and does not contain personal information about individual subscribers. This implies that the dataset is fully anonymized and its use for our purposes does not raise privacy concerns.
As already mentioned, the set of services S considered in our analysis comprises 38 different services. An overview of the fraction of the total traffic consumed by each Before feeding to the models the traffic measurements for each mobile service, these are transformed into different input channels of the point-cloud S. All coordinate features ς are normalized to the (0, 1) range. In addition, for the baseline models that require grid-structural input (i.e., CNN, 3D-CNN, ConvLSTM and PredRNN++), the point clouds are transformed into grids [3] using the Hungarian algorithm [242], as required. The ratio of training, validation, and testing sets is 8:1:1.

Benchmarks and Performance Metrics
We compare the performance of our proposed CloudLSTM with a set of baseline models, as follows. MLP [22], CNN [144], and 3D-CNN [212] are frequently used as benchmarks in mobile traffic forecasting (e.g., [5,227]). DefCNN learns the shape of the convolutional filters and has similarities with the D-Conv operator proposed in this study [236]. PointCNN [235] performs convolution over point-clouds and has been employed for point-cloud classification and segmentation. LSTM is an advanced RNN frequently employed for time series forecasting [243]. CloudCNN is an original benchmark we introduce, which stacks the proposed D-Conv operator over multiple layers for feature extraction from point-clouds. PointLSTM is another original benchmark we design, obtained by replacing the cells in ConvLSTM with the X -Conv operator employed by PointCNN, which provides a fair term of comparison for other Seq2seq architectures. While ConvLSTM [211] can be viewed as a baseline model for spatiotemporal predictive learning, the PredRNN++ is the state-of-the-art architecture for spatio-temporal forecasting on grid-structural data and achieves the best performance in many applications [230]. Beyond these models, we also compare the CloudLSTM with two of its variations, i.e., CloudRNN and CloudGRU, which were introduced in Sec. 4.1.3. We show in Table 4.1 the detailed configuration along with the number of parameters for each model considered in this study. We note that the hyper-parameters of all models are optimized based on our experience, as well as on the performance obtained on the validation set during the training.
We quantify the accuracy of the proposed CloudLSTM, in terms of Mean Absolute Error (MAE) and Root Mean Square Error (RMSE). Since the mobile traffic snapshots can be viewed as "urban images" [244], we also select Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM) [245] to quantify the fidelity of the forecasts and their similarity with the ground truth, as suggested by relevant recent work [7]. These are defined as: where µ v (t) and v max (t) are the average and maximum traffic recorded for all services, at all antennas and time instants of the test set. VAR(·) and COV(·) denote the variance and covariance, respectively. Coefficients c 1 and c 2 are employed to stabilize the fraction in the presence of weak denominators. Following standard practice, we set c 1 = (k 1 L) 2 and c 2 = (k 2 L) 2 , where L = 2 is the dynamic range of float type data, and k 1 = 0.1, k 2 = 0.3. We optimize all architectures using the MSE loss function: Here v h n is the mobile traffic volume forecast for the h-th service at antenna n at time t, and v h n is its corresponding ground truth. We employ all neural networks to forecast city-scale future mobile traffic consumption for up to 30 mins, given consecutive 30-min measurements sampled every 5 minutes. That is all models take as input 6 snapshots (M = 6) and forecast following 6 traffic volume snapshots (J = 6). For RNN-based models, i.e., LSTM, ConvLSTM, PredRNN++, CloudLSTM, CloudRNN, and CloudGRU, we extend the number of prediction steps to J = 36 (3 hours), to evaluate their long-term performance.

Result and Visualization
We perform 6-step forecasting for 4,888 instances across the test set, and report in Table 4.2 the mean and standard deviation (std) of each metric. We also investigate the effect of different numbers of neighboring points considered (i.e., K = 3, 6, 9), as well as the influence of the attention mechanism.
Observe that RNN-based architectures in general obtain superior performance, compared to CNN-based models and the MLP. In particular, our proposed CloudL-STM, and its CloudRNN, and CloudGRU variants outperform all other banchmark architectures, achieving lower MAE/RMSE and higher PSNR/SSIM on both urban scenarios. This suggests that the D-Conv operator learns features over geospatial point-clouds more effectively than vanilla convolution and PointCNN. Among our approaches, CloudLSTM performs better than CloudGRU, which in turn outperforms CloudRNN.
Interestingly, the forecasting performance of the CloudLSTM seems fairly insensitive to the number of neighbors (K ). It is therefore worth using a small K in practice, to reduce model complexity, as this does not compromise the accuracy significantly. Further, we observe that the attention mechanism improves the forecasting performance, as it helps capturing better dependencies between input sequences and  Prediction step

Augmenting Forecasting with Seasonal Information
We notice that seasonal information exists in the mobile traffic series, which can be further exploited to improve the forecasting performance. However, directly feeding the model with data spanning multiple days is infeasible, since, e.g., a 7-day window corresponds to a 2016-long sequence as input (given that data is sampled every 5 minutes) and it is very difficult for RNN-based models to handle such long sequences. In  To capture seasonal information more efficiently, we concatenate the 30 minutelong sequences (sampled every 5 minutes) with a sub-sampled 7-day window (sampled every 2h). This forms an input with length 90 (6 + 84). We conduct experiments on a randomly selected subset (100 antennas) of the mobile traffic dataset (City 1), and show the forecasting performance without and with seasonal information (7-day window) in Table 4.3. By incorporating the seasonal information, the performance of most forecasting models is boosted. This indicates that the periodic information is learnt by the model, which helps reduce the prediction errors. However, the concatenation increases the length of the input, which also increases the model complexity. Future work will focus on a more efficient way to fuse the seasonal information, with marginal increase in complexity.

Service-wise Evaluation
Finally, we dive deeper into the performance of the proposed Attention CloudLSTMs, by evaluating the forecasting accuracy for each individual service, averaged over 36 steps. To this end, we present the MAE evaluation on a service basis (left) and category basis (right) in Fig. 4.8. Observe that the attention CloudLSTMs obtain similar performance over both cities at the service and category level. Jointly analyzing with Fig. 4.4, we see that services with higher traffic volume on average (e.g., streaming and cloud) also yield higher prediction errors. This is because their traffic evolution exhibits more frequent fluctuations, which introduces higher uncertainty, making the traffic series more difficult to predict.

Summary
In this chapter, we attacked the multi-service mobile traffic forecasting problem to support resource management for network slicing. We introduce CloudLSTM, a dedicated neural model for spatio-temporal forecasting tailored to point-cloud data streams.
The CloudLSTM builds upon the D-Conv operator, which performs convolution over point-clouds to learn spatial features while maintaining permutation invariance. The   In particular, combining different information from a large number of such specialized equipment is required, e.g. user position obtained via triangulation [247], data session timings, traffic consumed per location, etc. Overall this is a challenging endeavour that cannot be surmounted in real-time by directly employing measurements from independent RNC probes.
In order to simplify the analysis process, mobile operators make simple assumptions about the distribution of data traffic consumption across cells. For instance, it is frequently assumed users and traffic are uniformly distributed, irrespective of the geographical layout of coverage areas [248]. Unfortunately, such approximations are usually highly inaccurate, as traffic volumes exhibit considerable disparities between proximate locations [199]. Operating on such simplified premises can lead to deficient network resources allocations and implicitly to modest end-user quality of experience.
Our objective is to precisely infer narrowly localized traffic consumption from aggregate coarse data recorded by a limited number of probes (thus reducing deployment costs) that have arbitrary granularity. Achieving this goal is challenging, as small numbers of probes summarize traffic consumption over wide areas and thus only provide 'low-resolution' snapshots that cannot capture distributions correlated with human mobility. Further, measurement instrumentation is non-uniformly deployed, as coverage area sizes depend on the population density [250]. Such diversity creates considerable ambiguity about the traffic consumption at sub-cell scale and multiple 'high-resolution' snapshots could be matched to their aggregate counterparts. Inferring the precise traffic distribution is therefore hard.
Drawing inspiration from image processing. Spatio-temporal correlations we observe between mobile traffic patterns prompt us to represent these as tensors that highly resemble images (cross-spatial relations) or videos (cross-temporal relations).
It becomes apparent that a problem similar to the one we tackle exists in the image processing field, where images with small number of pixels are enhanced to highresolution. There, a super-resolution (SR) imaging approach mitigates the multiplicity of solutions by constraining the solution space through prior information [251]. This inspires us to employ image processing techniques to learn end-to-end relations between low-and high-resolution mobile traffic snapshots. We illustrate the similarity between the two SR problems in Fig. 5.1. Recent achievements in GPU based computing [222] have led to important results in image classification [144], while different neural network architectures have been successfully employed to learn complex relationships between low-and high-resolution images [252,253]. Thus we recognise the potential of exploiting deep learning models to achieve reliable mobile traffic superresolution (MTSR) and make the following key contributions: Our design accelerates training convergence and we demonstrate it outperforms the baseline Super-Resolution Convolutional Neural Network (SRCNN) [252] in terms of prediction accuracy.
3. To stabilise the adversarial model training process, and prevent model collapse or non-convergence problems (common in GAN design), we introduce an empirical loss function. The intuition behind our choice is that the generator can be optimized and complexity reduced, if using a loss function for model training that is insensitive to model structure and hyper-parameters configuration.
4. We propose a data processing and augmentation procedure to handle the insuf-

Problem Formulation
The objective of MTSR is to infer city-wide fine-grained mobile data traffic dis-tributions, using sets of coarse-grained measurements collected by probes deployed at different locations. We formally define low-resolution traffic measurements as a spatio- where D H t denotes the solution of the prediction. Both D H t and F S t are high-dimensional, since they represent different traffic measurements across a city. To precisely learn the complex correlation between D H t and F S t , in this work we propose to use a Generative Adversarial Network (GAN), which will model the conditional distribution p D H t |F S t . As we will demonstrate, the key advantage of employing a GAN structure is that it will not only minimize the mean square error between predictions and ground truth, but also yield remarkable fidelity of the high-resolution inferences made.

Performing MTSR via ZipNet-GAN
In what follows we propose a deep-learning approach to tackle the MTSR problem using GANs. This is a novel unsupervised learning framework for generation of artificial data from real distributions through an adversarial training process [29]. In general, a GAN is composed of two neural network models, a generator G that learns the data distribution, and a discriminative model D that estimates the probability that a data sample came from the real training data rather than from the output of G. We first give a brief overview of general GAN operation, then explain how we adapt this structure to the MTSR problem we aim to solve.

Essential Background
As with all neural networks, the key to their performance is the training process that serves to configure their parameters. When training GANs, the generator G takes as input a noisy source (e.g. Gaussian or uniformly distributed) z ∼ P n (z) and produces an outputx that aims to follow a target unknown data distribution (e.g. pixels in images, voice samples, etc.). On the other hand, the discriminator D randomly picks data points generated by G, i.e.x ∼ G(z), and others sampled from the target distribution x ∼ P r (x), and is trained to maximize the probabilities thatx is fake and x is real.
In contrast, G is trained to produce data whose distribution is as close as possible to P r (x), while maximizing the probability that D makes mistakes. This is effectively a two-player game where each model is trained iteratively while fixing the other one.
The joint objective is therefore to solve the following minimax problem [29]: Once trained, the generator G is able to produce artificial data samples from the target distribution given noisy input z.
In the case of our MTSR problem, the input of G is sampled from the distribution of coarse-grained measurements p(F S  • 3D upscaling blocks consisting of a 3D deconvolutional layer [255], three 3D convolutional layers [212], a batch normalization (BN) layer [256], and a Leaky ReLU (LReLU) activation layer [257]. 3D (de)convolutions are employed to capture spatial (2D) and temporal relations between traffic measurements. The deconvolution is a transposed convolutional layer widely employed for image upscaling. 3D convolu-tional layers enhance the model representability. BN layers normalize the output of each layer and are effective in training acceleration [256]. LReLUs improve the model non-linearity and their output is of the form: where α is a small positive constant (e.g. 0.1). The objective of such upscaling blocks is to up-sample the input F S t into tensors that have the same spatial resolution as the desired output D h t . The number of upscaling blocks increases with the resolution of the input (from 1 to 3). Upscaling blocks are frequently used to increase the data dimension for image super resolution, whereas we introduce an extra dimension to process the temporal domain. These 3D upscaling blocks are key to jointly extracting spatial and temporal features specific to mobile traffic. The proposed ZipNet is a complex architecture that has over 50 layers. In general, accuracy grows with the depth (which is precisely what we want to achieve), but may also degrade rapidly, if the network becomes too deep. To overcome this problem, we use shortcut connections at different levels between the comprising blocks, as illustrated in Fig. 5.4 -this resembles a zipper, hence the naming. The structure can be regarded as an extension to residual networks (ResNets) previously used for image recognition [254], where the zipper connections significantly reduce the convergence rate and improve the model's accuracy, without introducing extra parameters and layers.
The fundamental module B of the zipper convolutional block comprises a convolutional layer, a BN layer, and an activation function. Staggered skip connections link every two modules, and a global skip connection performs element-wise addition between input and output (see Fig. 5.3) to ensure fast backpropagation of the gradients.
The skip connections also build an ensemble of networks with various depths, which has been proven to enhance the model's performance [214]. Further, replacing layerwise connections (as e.g. in [258]) with light-weight staggered shortcuts reduces the computational cost. Compared to the original ResNets, extra zipper paths act as an additional set of residual paths, which reinforce the ensembling system and alleviate the performance degeneration problem introduced by deep architectures. The principle behind ensembling systems is collecting a group of models and voting on their output for prediction (e.g. using a random forest tool). Extra zipper paths increase the number of candidate models in the voting process, which improves the robustness of the architecture and contributes to superior performance.
Finally, the discriminator D accepts simultaneously the predictions made by the generator and fine-grained ground truth measurements, and minimizes the probability of misjudgement. In our design D follows a simplified version of a VGG-net neural network architecture [259] routinely used for imaging applications, and consists of 6 convolutional blocks (convolutional layer + BN layer + LReLU), as illustrated in

Designing the Loss Functions
The MTSR is a supervised learning problem, hence directly deploying the traditional adversarial training process is inappropriate. This is because the data generated by G in traditional GANs is stochastically sampled from the approximated target distribution, whereas in MTSR we expect the output of the generator to follow as close as possible the distribution of real fine-grained measurements. That is, individual data points G(F S t ) produces should be close to their corresponding ground truth. This requires to minimize (i) the divergence between the distributions of the real data p(D H t ) and the generated data p(G(F S t )), and (ii) the Euclidean distance between individual predictions and their corresponding ground truth. L 2 loss functions commonly used in neural networks to solve the optimization problem given in (5.1) only fulfill the second objective above, but do not guarantee that the generator's output will follow the real data distribution. This may lead to failure to match the fidelity expected of high-resolution predictions [260]. Therefore we add another term to (5.1), which requires to design different loss functions, while changing the original problem to where recall that D(G(F S t )) is the probability that D predicts whether data is sampled from the real distribution. Minimizing this new term D(G(F S t )) aims to 'fool' the discriminator, so as to minimize the divergence between real and generated data distributions, i.e. objective (i) above, and remedy the aforementioned fidelity problem.
The discriminator D works as a binary classifier, which is trained to configure the discriminator's parameters Θ D by maximizing the following loss function: The more challenging part is the design of the loss function employed to train the generator. Following the common hypothesis used in regression problems, we assume that the prediction error ε follows a zero-mean Gaussian distribution, with diagonal covariance matrix σ 2 I [22], i.e.
ε ∼ N(ε|0, σ 2 I). (5.6) Then a fine-grained data point D H t can be approximated with respect to the corresponding prediction error as following a multivariate Gaussian distribution with a mean that depends on F S t and a diagonal covariance matrix σ 2 I. This allows us to rewrite the conditional distribution in (5.4) as However, we find that the training process is highly sensitive to the configuration of σ 2 . Specifically, the loss function does not converge when σ 2 is large, while the discriminator rapidly reach an optimum if σ 2 is small, which in turn may lead to model collapse [261] and overall poor performance. To solve this problem, we propose an alternative loss function in which we replace the σ 2 term with the MSE. This yieldŝ In the above, the MSE term forces the predicted individual data points to be close to their corresponding ground truth, while the adversarial loss works to minimize the divergence between two distributions. Our experiments suggest that this new loss function significantly stabilises the training process, as the model never collapses and the process converges fast. In what follows, we detail the training procedure.

Training the ZipNet-GAN
To train the ZipNet-GAN we propose for solving the MTSR problem, we employ Algorithm 3, which takes a Stochastic Gradient Descent (SGD) approach and we explain the steps involved next. Recall that the purpose of training is to configure the parameters of the neural network components, Θ G and Θ D . We work with the Adam optimizer [217], which yields faster convergence as compared to traditional SGD.
We train G and D iteratively, each time for n G and n D sub-epochs, by fixing the parameters of one and configuring the others', and vice-versa, until their loss functions converge (line 3). At every sub-epoch (lines 4,9), G and D randomly sample m low-/high-resolution traffic measurement pairs (lines 5, 10) and compute the gradients g G and g D (lines 6, 11) to be used in the optimization (lines 7, 12).
The key to this training process is that G and D make progress synchronously. At early training stages, when G is poor, D can reject samples with high confidence as they are more likely to differ from the real data distribution. An ideal D can always find a decision boundary that perfectly separates true and generated data points, as long as the overlapping measure support set of these two distributions is null. This is highly likely in the beginning and can compromise the training of G. To overcome this issue, we initialize the generator by minimizing the following MSE until convergence Note that at this stage the initialized G (line 2) could be directly deployed for the MTSR purpose, since the MSE based initialization is equivalent to solving (5.1). However, this only minimizes the point-wise Euclidean distance, and the further training steps in Algorithm 3 are still required to ensure the predictor does not lose accuracy. In our experiments, we set n G and n D to 1, and learning rate λ to 0.0001.
Next we discuss the processing and augmentation of the dataset we employ to train and evaluate the performance of the proposed ZipNet(-GAN).

Data Processing & Augmentation
To train and evaluate the ZipNet(-GAN) architecture, we conduct experiments with a publicly available real-world mobile traffic dataset released through Telecom Italia's Big Data Challenge [262], as we discuss in Sec. 3.4.1. We show snapshots of the traffic's spatial distribution for both off-peak and peak times in Fig. 5.6. Sample low-/high-res traffic measurement pairs

7:
Θ D ← Θ D + λ · Adam(Θ D , g D ). for e G = 1 to n G do 10: Sample low-/high-res traffic measurement pairs measurements. This number appears sufficient when using traditional machine learning tools, though it is grossly insufficient for the purpose of training a complex neural network, as in our case. This is due to the highly dimensional parameter set, which can turn the model over-fitting if improperly configured through training with small datasets. To overcome this problem, we augment the Milan dataset by cropping each snapshot to multiple 'windows' of smaller size, each with different offsets (1 cell increment in every dimension). We illustrate this augmentation process in Fig. 5.7.
We work with 'sub-frames' of 80 × 80 sub-cells, thereby producing 441 new data points from every snapshot. Note that the initial size of model's prediction matrix is

Experiments
In this section we first describe briefly the implementation of the proposed ZipNet(-GAN), then evaluate its performance in terms of prediction accuracy (measured as Normalized Mean Root Square Error -NMRSE), fidelity of the inferences made (measured through Peak Signal-to-Noise Ratio -PSNR), and similarity between predictions made and ground truth measurements (structural similarity index -SSIM). We compare the performance of ZipNet(-GAN) with that of Uniform and Bicubic interpolation techniques [263], Sparse Coding method (SC) [264], Adjusted Anchored Neighboring Regression (A+) [265], and Super-Resolution Convolutional Neural Network (SRCNN) previously used in imaging applications [252].

Implementation
We implement the proposed ZipNet(-GAN), the SRCNN, the Uniform and Bicubic in-  sorLayer [223]. 1 We train the models using a GPU cluster comprising 19 nodes, each equipped with 1-2 NVIDIA TITAN X and Tesla K40M computing accelerators (3584 and respectively 2280 cores). To evaluate their prediction performance, we use one machine with one NVIDIA GeForce GTX 970M GPU for acceleration (1280 cores). SC and A+ super-resolution techniques are implemented using Matlab. In what follows, we detail four MTSR instances with different granularity, which we use for comparison of the different SR methods.

Different MTSR Granularity
In practice measurement probes are deployed at different locations (e.g. depending on user density) and often have different coverage in terms of number of cells. We approximate the coverage of a probe by a square area consisting of r f = n f ×n f sub-cells, and refer to n f as an upscaling factor. The smaller the n f , the higher the granularity of measurement. Given the heterogeneous nature of cellular deployments, we construct four different MTSR instances with different granularity, as summarized in Up-10 Probes cover 10 × 10 sub-cells 10 100 Mixture 7% of probes cover 10 × 10 sub-cells, 44% cover 4 × 4, and 49% cover 2 × 2 sub-cells. instance corresponds to a mixture of probes, each with different coverage, as we illustrate in Fig. 5.8. Specifically, we consider three types of probes covering 2×2, 4×4, and respectively 10×10 sub-cells. In this instance, more probes serve the city center (red area), each with smaller coverage and thus finer granularity. Fewer probes are assumed in surrounding areas, covering larger regions (the yellow and green areas).

16
We compute aggregate measurements collected by such dissimilar probes, each aggregate corresponding to the sum over the covered cells. We then project these points onto a square that becomes the input to our model, as shown on the right in Fig. 5.8.
Therefore, for each traffic snapshot we can obtain 400 measurement points that can be viewed as a 2D square (right side of Fig. 5.8), which we use for training and performing inferences. Note that although the average n f of the mixture instance is 4, its structure differs significantly from that of the 'up-4' instance. Our evaluation will reveal that such differences will affect the accuracy of the MTSR outcome.
We train all deep learning models with data collected between 1 Nov 2013 and 10 Dec 2013 (40 days), validate their configuration with measurements observed over the following 10 days, and finally evaluate their performance using the averages aggre-  including Uniform interpolation, Bicubic interpolation, Sparse Coding based methods (SC) [264], Adjusted Anchored Neighboring Regression (A+) [265], and Super-Resolution Convolutional Neural Network (SRCNN) [252]. Uniform interpolation is routinely used by operators and assumes that the data traffic volume is uniformly distributed across cells [248]. The Bicubic interpolation is a popular non-parametric tool frequently used to enhance the resolution of images [263]. SC and A+ are commonly used as benchmarks in image super-resolution evaluation. Finally, SRCNN is a benchmark deep learning architectures that comprises three convolutional layers. We note that in our evaluation ZipNet is a simplified version of the ZipNet-GAN, which is purely trained with the mean square error (5.10), without the help of the discriminator.

Performance Evaluation
Assessing the quality of inferences: We summarize the performance of the proposed ZipNet(-GAN) and that of existing SR techniques in terms of the aforementioned metrics in Fig. 5 ZipNet-GAN Taking a closer look at Fig. 5.9, observe that the prediction accuracy of all approaches drops as the upscaling factor n f grows. This is indeed reasonable, since a larger n f corresponds to a greater degree of aggregation and thus detail information loss, which will pose more uncertainty to the models. Further, although the 'up-4' and mixture instances have the same average upscaling factor, the proposed ZipNet (-GAN) operate somewhat better with the former. Our intuition is that the mixture instance dis- ZipNet-GAN centre. In addition, the predictions made by SC and A+ exhibit significant distortions and yield inferior performance, demonstrating their image SR capabilities cannot be mapped directly to MTSR tasks. Lastly, the SRCNN approach, which employs deep learning, works acceptably in areas with low traffic intensity, but largely underestimates the traffic volume in the city center.  in the architecture improves the prediction fidelity, as it minimizes the divergence between real and predicted data distributions, although this does not necessarily enhance overall accuracy. Note that the additional accuracy does not come at the cost of increased complexity, since the adversarial training is fast in terms of convergence and the discriminator will be abandoned in the inference phase.

Robustness to Abnormal Traffic
To evaluate the robustness of our solution in the presence of traffic anomalies, we artificially add such traffic patterns to the test dataset and investigate the behavior of our proposal with the best inferred accuracy, i.e., ZipNet-GAN. Specifically, we introduce abrupt traffic demands in suburban areas, which can be regarded as occurrences of social events (e.g. concert, football match, etc.), as seen in the bottom left corner of the second sub-plot in Fig. 5 Fine-grained meas. (Ground truth)

Magnitudes of gradients:
The impact of the input's temporal dimension can also be evaluated from the gradients' perspective. The loss function L is essentially a complex non-linear of the input F S t . However, this can be approximated by the first-order term of its Taylor expansion, i.e.
where w(F S t ) is the gradient of the loss function L(F S t ) over input F S t and b is a bias. Computing the absolute value of the gradient w(F S t ) T , i.e.

∂L(F
should give insights into the number of temporal steps required for accurate prediction with different MTSR instances. Therefore in Fig. 5.15 we plot the average magnitude of the gradient of the loss function over all inputs F S t , for all three homogeneous MTSR instances. Observe that the most recent 'frame' (i.e. frame 6) yields the largest gradient for all instances, as we expect. This means that the current measurement 'snapshot' provides the most valuable information for the model to reconstruct the fine-grained counterpart. Further, the contribution of historical measurements (i.e. frames 1 to 5) increases with the upscaling factor (from 2 to 10), which suggests that historical information becomes more significant when less spatial information is available, which is consistent with the insight gained earlier.

Discussion
Obtaining city-scale fine-grained mobile traffic maps from coarse aggregates collected by probes brings important benefits to a range of applications critical to the urban realm. Namely, • Agile network resource management: our approach enables infrastructure simplification and reduces OpEx. This is because base station controllers (BSC) are shared by increasing numbers of BSs, and already handle radio quality measurements and handovers. Adding further measurement capabilities, co-ordination of triangulation, and real-time processing of multi-modal measurements, poses scalability concerns, which may eventually impact on end user QoE. The proposed ZipNet-GAN shifts the burden to a single dedicated cluster that only requires to be trained infrequently and can perform coarse-to fine-grained measurement transformations, fed by summary statistics already available at selected probes.
• Events localization & response: popular social events (e.g. concerts, fairs, sports, etc.) or emergency situations (fires, riots, or terrorist acts) exhibit high spatial similarity in terms of mobile data traffic consumption, which can serve as an indicator of density/size of the crowds involved. Accurate and timely localization of such instances through inference of data traffic can help overcome network congestion in hot spots, but also appropriately provision policing and emergency services.
• Context-based business: accurate MTSR can also aid small businesses that can offer promotional products depending on spontaneous circumstances, e.g. families gathering in the park on a sunny day. Likewise university PR services can disseminate relevant information during highly-attended open/graduation days. Therefore, we argue ZipNet-GAN is not limited to network infrastructure related tasks, e.g. precision traffic engineering or anomalous traffic detection [266], but could also serve civil applications such as events planning or even transportation. Importantly, once trained the proposed technique can continuously perform inferences on live streams, unlike post-processing approaches that only work off-line and thus have limited utility.

Summary
Precision large-scale mobile traffic analytics is increasingly vital for operators, to provision network resources agilely and keep up with end-user application requirements.
Extracting fine-grained mobile traffic patterns is however complex and expensive, as this relies on specialized equipment, substantial storage capabilities, and intensive post-processing. In this chapter we proposed a mobile traffic super resolution (MTSR) technique that overcomes these issues and infers mobile traffic consumption with fine granularity, given only limited coarse-grained measurement collected by probes. Our The ZipNet(-GAN) reduce the prediction error (NRMSE) of existing interpolation and super-resolution approaches by 78%, and achieve up to 40% higher fidelity (PSNR) and 36.4× greater structural similarity (SSIM). Future work will focus on evaluating our proposal with other traffic datasets, e.g., the one collected in Trentino.

Chapter 6 Deep Learning Driven Mobile Traffic Decomposition
In this chapter, we introduce an original mobile traffic decomposition (MTD) technique, which breaks down the aggregated mobile traffic consumption into service-wise demand, to support the resource allocation for network slicing [267]. Strong service differentiation needs are already emerging in current deployments, where, e.g., live video streaming must coexist with on-line gaming or shared cloud services. An important instrument that 5G mobile communication infrastructures will leverage to answer such diverse necessities is a much-improved flexibility in the management of resources.
This will be realized via novel solutions for the virtualization of network functions at both the edge and core of the network, including dynamic spectrum allocation [268], baseband processing [269], scheduling [270], or task containerization [271].
Network operators remain in charge of performing management and orchestration (MANO) of resources dedicated to each slice, through platforms like ONOS [272] or OSM [273]. A critical operation in MANO is the anticipatory provisioning of isolated capacity (e.g., spectrum, computation, storage, or transport) to each slice. This requires knowledge of the total demand generated by each mobile service over horizons of minutes, which is the common resource reallocation periodicity supported by stateof-the-art Virtual Infrastructure Manager (VIM) and Network Function Virtualization (NFV) architectures [274,275].
Unfortunately, mobile operators do not have direct visibility of service-level traffic. The current common practices for extracting such information combine two steps, as follows: (i) Deep Packet Inspection (DPI) allows collecting IP traffic header metadata, e.g., by sniffing on the GPRS Tunneling Protocol user plane (GTP-U) via probes tapping into the interfaces of the Packet Data Network Gateway (PGW) [276,277]; (ii) Flow-level classification then leverages such metadata to identify the service generating each flow. Nowadays, classifiers mostly rely on cleartext hostnames in DNS queries, or revealing fields in the TLS handshake, like the Server Name Indication (SNI), due to the increasing adoption of traffic encryption [278].
Yet, running DPI at line rate and at scale is computationally expensive, while the surge in mobile data traffic and rapid growth of transport link speeds beyond the Terabit-per-second barrier exacerbate the problem. Further, while on-line classification of streaming data is currently an open research challenge, recent proposals for DNS over TLS [279] or encrypted SNI in TLS 1.3 [280] will make classifiers based on DNS and TLS ineffective, and force the adoption of even more complex fingerprinting techniques [281]. Overall, there is a real risk that current trends in mobile data usage, network architectures, and security will render scalable on-line flow-level classification a much more tangled and resource-intensive problem than it already is today.
Contributions. We propose an alternative approach to demand estimation for sliced network MANO. We target the inference of service-level demands that are required for capacity provisioning to individual slices. Our proposal builds on mobile traffic decomposition (MTD), i.e., the process of breaking down aggregate traffic time series into separate time series for each individual service. We illustrate the MTD concept by the example in Fig. 6.1. Performing MTD is technically challenging, since (i) the decomposition of a single signal into multiple service-wise time series may have a multitude of solutions and yields inherent ambiguity; (ii) complex spatial and temporal correlations exist in mobile traffic, and capturing these in order to resolve the ambiguity is non trivial; and (iii) traditional decomposition techniques, including factorial hidden Markov models [282] or neural networks for decomposition considered in other domains [6], are unsuitable for MTD, as they only work on single input time series, whereas in our case multiple input time series are concurrently generated at different geographical locations.
To tackle these challenges and achieve effective and scalable MTD, we design a dedicated deep learning framework. We rely on deep learning due to its demonstrated effectiveness in discovering knowledge from time series under spatial correlations [4], and in operating on large-scale mobile traffic in real time [5]. This leads to the follow- show that it can be a low-cost yet effective solution for the real-time inference of the demands generated by individual mobile services.
2. We propose MICROSCOPE, a framework that solves the MTD problem effectively via a new class of deformable convolutional neural networks, named 3D-DefCNNs, which enhance traditional CNN structures [283] and can extract complex spatio-temporal correlations from aggregate traffic data.
3. We experiment with metropolitan-scale measurement data collected in an operational networks in a major European city; we show that MICROSCOPE makes inferences about per-service traffic consumption with errors below 1.2%. 4. We give a quantitative assessment of the practical feasibility of employing MI-CROSCOPE in operational networks, showing that the additional cost incurred by decomposition is small, yet the benefits are on par with having perfect knowledge of per-service demands.
Ultimately, our results indicate that the MTD approach implemented by MICRO-SCOPE can drive service-level capacity provisioning in emerging NSaaS network management models. MICROSCOPE can then be combined with legacy techniques based on DPI and flow-level classification into an efficient hybrid framework, as illustrated in Fig. 6.2. By only requiring monitoring of the total traffic volume, MICROSCOPE offers a lightweight solution for per-service demand estimation that can be run persistently at low cost. The mechanics and popularity of mobile applications are however evolving continuously, which calls for periodic validation of the MTD solution: expensive DPI-based classification is thus still performed for short time periods to produce the necessary ground-truth data. Extensive flow-level classification is only required when the validation fails and re-training is necessary. Nonetheless, major changes in the operation and adoption of mobile service usage occur over long timescales (e.g., months), which lets us speculate that the latter would be a relatively infrequent event.
Although we do not have sufficient data to demonstrate that this is the case, our results are promising in this sense, as they show that the MTD model yields excellent performance two weeks after training.

Mobile Traffic Decomposition
We formalize the MTD problem in Sec. 6.1.1, and then outline the MICROSCOPE framework we propose to solve it in Sec. 6.1.2.

Problem Formulation
Consider a geographical region where mobile network coverage is provided by a set A of antennas, 1 which accommodate traffic generated by a set S of mobile services.
We denote by d s a (t) the traffic demand (expressed in Mbps) accommodated by antenna a ∈ A for a specific service s ∈ S at time t.     We stress that MTD is a supervised learning problem, but fundamentally different from prediction, as it assumes knowledge of the aggregate measurement data at the current time instant t, and aims at inferring information relative to that same time instant. In fact, MTD is a one-to-many problem that seeks to decompose one aggregate traffic measurement into the underlying |S | per-service snapshots: D s (t) includes |S | snapshots, each featuring the same cardinality as D(t). Iteratively solving this problem over time ultimately leads to the reconstruction of per-service demand time series at each antenna from the aggregate traffic, as originally illustrated in Fig. 6.1.

MICROSCOPE in a Nutshell
MICROSCOPE is a novel machine learning framework that is specifically designed for MTD. Here, we provide an overview of the framework, discussing the functionality and integration of the modules it comprises; the following sections give full details about the implementation of each component.
As shown in Fig. 6 We further propose to train the neural network by minimizing a cross-entropy function that yields higher accuracy when solving the MTD problem. The final outputs are the estimated service snapshots D s (t) as per (6.1). Details are in Sec. 6.3.4.

Mobile Network Traffic Dataset and Preprocessing
We

Data Collection and Overview
The set of services S considered in our analysis comprises tens of different services.
However, we confine the evaluation of MICROSCOPE to a representative set of services that encompass a variety of application types and are reasonable candidates to be allo- to the well-known Zipfian distribution of the demand across services [277,285], the nine selected services are responsible for more than 42% of the total mobile data traffic in the target region. Interestingly, the diverse nature of applications in S leads to dissimilar temporal dynamics of the corresponding demands [277,286], allowing us to test our MTD approach in a realistic scenario where heterogeneous services coexist.

Traffic Snapshots Preprocessing
The core of MICROSCOPE is a specialized type of convolutional neural network (CNN), and thus requires an input in matricial form. In our case, an input matrix describes an aggregate snapshot D(t) of mobile network traffic, as explained in Sec. 6.1.1. The input format creates the problem of mapping antennas to matrix elements, i.e., points on a regular grid. As a matter of fact, and as later detailed in Sec. 6.3, the adjacency Antennas Antennas with grid points Association Instead, we solve the mapping problem by constructing a regular grid that has the same number of points as the number of antennas and performing a one-to-one antenna-to-point association. Below we discuss the design of the regular grid and the solution to the mapping problem.

Regular Grid Design
To preserve spatial correlations within mobile network traffic, a properly designed grid should (i) overlap with the coverage of the antennas as much as possible, and (ii) only introduce small spatial displacements after the mapping procedure. Then, given the target set A of antennas, our grid design follows the logic below. Here, we employed κ = 0.25, and obtained a 33 × 24 grid.

Antenna-to-point Mapping
We aim to minimize the overall displacement when performing the one-to-one association between antennas and grid points. We define the displacement c a,p as the Eu- x a,p = 1, ∀a ∈ A, (6.6) where constraints enforce that one antenna will be assigned to only one grid point, and vice versa.
The expressions in (6.4)-(6.6) define an assignment problem that is efficiently solved via the Hungarian algorithm [242], which has four major steps. Namely: Step 1: For each row of the cost matrix C, subtract the lowest value c min i from each element in that row, i.e., Step 2: For each column of the cost matrix C, subtract the lowest value c min j from each element in that column, i.e., Step 3: Find the minimum number of lines l min required to cover the zero elements in matrix C, both vertically and horizontally. An optimum (the zero-element location) is reached and the algorithm terminates when l min = V ; otherwise, continue with the next step, if l min < V .
Step 4: Find the smallest value c min that is not covered by a line at Step 3. Subtract

Displacement Assessment
Although minimized by the approach presented above, some spatial displacement is unavoidable, due to cell coverage heterogeneity. We further investigate the level of displacement induced by our proposed solution, by considering the representative case of our reference large metropolis scenario. The right plot makes it even more clear that geographical correlations are maintained in the regular grid, where significant displacement are restricted to the borders, and most points incur a shift below 500 m. Hence, in our reference scenario, the proposed preprocessing of traffic snapshots generates an input matrix for the neural network that preserves substantial spatial relationships in the mobile network demands.

3D-Deformable convolutional neural network
The core of MICROSCOPE is a new deep learning architecture, named 3D deformable convolutional neural network, or 3D-DefCNN. The 3D-DefCNN is specifically designed for MTD: it compensates for the spatial displacement in network traffic snap-shots, discovers spatio-temporal correlations in aggregate traffic, and exploits them for decomposition.

Deformable CNN
Our 3D-DefCNN design is an enhancement of the deformable convolutional neural network (DefCNN) [283] originally proposed for computer vision application, such as image classification [288], object detection and semantic segmentation [289].  The approach is equivalent to letting the neural network re-organize the 2D spatial structure of the input data. In our context, this allows identifying and exploiting any geographical correlation inherent to the mobile network traffic that may be lost during the snapshot preprocessing phase.

3D-Deformable Convolution
Legacy DefCNNs perform deformable convolution over 2D input matrices. In MTD, the data fed to the network includes time, thus it is three-dimensional. Specifically, the input consists of the aggregate snapshot set {D(t−T+1), . . . , D(t)} (Sec. 6.1.1), which is preprocessed into T subsequent 2D matrices (Sec. 6.2.2.2). Hence, we extend the deformable convolution operation to the temporal dimension. In doing so, we account for the fact that not all last T input snapshots have the same relevance to MTD at the current time instant, and weight in an adaptive manner the different 2D input matrices.
To achieve our objective, we combine the DefCNN model with 3D convolution, a technique previously used for action recognition [212], which operates over both time and a bidimensional space. Essentially, 3D convolution performs summation over an input map x weighted by a filter matrix w, which results in an output map y. 3 Each convolutional filter w has a receptive field G, which defines the spatio-temporal extent of connectivity between different locations in the input. As an example, the receptive field of a 3 × 3 × 3 convolutional filter can be defined as G = {(−1, −1, −1), (−1, −1, 0), (1, 1, 0), (1, 1, 1)}. For each location p y of the output y, the 3D convolution performs the following calculation: where p G denotes all positions in G. For instance, if p y = (1, 2, 3) and p G = (−1, 1, 0), Our proposed 3D-DefCNN modifies the operations above by introducing a set of additional offsets {∆p G |G = 1, . . . , |G|}. The actual ∆p G is selected from the set by an additional 3D CNN, which takes x as input. Our model then extends (6.7) as: Note, for each location p y , we apply different ∆p G (p y ). This requires the offset map to have the same shape as x. Overall, the 3D CNN will output 3|G| offset maps, each corresponding to the offset applied to location p G in one dimension. 4 We illustrate the principle of 3D deformable convolution in Fig. 6.7. As mentioned above, we first apply a 3D-CNN structure (3 layers) onto the original convolutional filter (which is compact) to predict 3|G| offset maps ∆p G (p y ). These offset maps essentially seek to alter the position of the filter elements, in order to scan, at each step, locations in the input that are not necessarily adjacent. The offsets are learned and shared across the different input channels. Subsequently, we apply these offsets to the original convolutional filter, to construct a deformed convolutional filter. Finally, by performing convolution between input and deformed filter, we obtain the output at location p y via (6.8). Since 3D deformable convolution operations are fully differentiable, the offsets to be applied can be learned through standard back-propagation. As such, 3D-DefCNNs grant convolutional filters complete freedom to query any location in the input maps. This significantly improves the model flexibility and enables to adapt to any spatial displacement (spatial deformation) and diverse importance of historical data (temporal deformation).
A complication introduced by equation (6.8) is that the sample positions p = p y + p G + ∆p G can be fractional. Indeed, while p G and p y are indices of G and y, and thus integer values, ∆p G may not be integer, as it is estimated by a CNN. We compute the deformed input in (6.8) as: where U p = {u 000 p , u 001 p , . . . , u 111 p } are the locations of the eight input samples around p, and Tri(·) denotes the trilinear interpolation operator [290], whose principle we show in Fig. 6.8.

Overall 3D-DefCNN Structure
We integrate the 3D deformable convolutional operations presented above in the complete 3D-DefCNN structure shown in Fig. 6.9. Our design encompasses three major  The 3D-Deformable convolutional blocks consist of stacks of 3D-Deformable convolutional layers, batch normalization (BN) layers [256], and leaky rectified linear unit (LReLU) activation layers [257]. As detailed in Sec. 6 The zipper convolutional blocks receive the output of the 3D-Deformable convolutional blocks and are responsible for feature extraction. The structure of these blocks is inspired by that of a deep zipper network (ZipNet). The rationale is that the ZipNet, originally proposed for mobile network traffic super-resolution [7], works demonstrably well in extracting spatio-temporal correlations hidden in this type of measurement data. More precisely, global and multiple skip connections are employed within these blocks, to perform effective residual learning [254], which is known to make the model more robust by constructing an ensembling system of neural networks with different depths [214]. Skip connections also significantly smoothen the loss surface, which enables faster convergence of the model training [291].
Upon processing by the zipper convolutional blocks, the mobile network traffic data is transformed into highly abstracted representations, ready for final MTD inference. This is performed by standard 2D convolutional blocks. Compared to the previous blocks, these are configured with a larger number of feature maps, so as to provide sufficient information for the inference process. The last layer of this block has |S | channels, i.e., feature maps, each corresponding to the decomposed traffic volume of an individual mobile service.

Tuning the Neural Network
To train the proposed 3D-DefCNN to solve the problem in (6.1), we explore three different methods, namely (i) regression, (ii) ratio prediction trained with Mean Square Error (MSE), and (iii) ratio prediction trained with Cross-Entropy (CE).
1. The Regression method trains neural networks with a loss function over the traffic volume, which directly aims at minimizing the difference between d s a (t) and d s a (t), i.e., .
Hereχ s a (t) denotes the intermediate (unnormalized) output of the neural network. In essence, by the above we map a vector output with elements of arbitrary values onto a probability vector where the elements are in the (0,1) range [292]. The expression ofr s a (t) in (6.11) satisfies both (6.2) and (6.3). Moreover, following training this approach allows for an immediate derivation of the mobile network traffic, asd s a (t) =r s a (t) · d a (t). Hence, we train the neural network to enforcer s a (t) to be close to r s a (t), by minimizing the following loss function: We refer to this approach as MSE in the following.
3. Alternatively, we can uses the cross-entropy (CE) for training, which is formally defined as −r s a (t) log(r s a (t)), (6.13) for the service snapshot estimated at time t. The overall CE for a given time span T can then be computed as the average over all time instants t ∈ T . The expression of CE in (6.13) is minimized when the estimated and actual traffic demand ratios match, i.e.,r s a (t) = r s a (t), ∀a ∈ A,∀s ∈ S,∀t. This method makes the assumption that the traffic fraction follows a multinomial distribution, and minimizing the loss (6.13) is equivalent to minimizing the Kullback-Leibler (KL) divergence between the model and target distribution [293]. We opt for this function since, as reported in [294], training a neural network with CE usually finds a better optimum than other loss functions when the output is normalized, as in our case. This will be later confirmed by our comparative performance evaluation in Sec.6.4.2.

Experiments
We implement MICROSCOPE using the open-source Python libraries TensorFlow [222] and TensorLayer [223]. We train and evaluate the framework on a high-performance computing cluster with two NVIDIA Tesla K40M GPUs with 2280 cores. The model parameters are optimized using the popular Adam stochastic gradient descent-based optimizer [241].
In the following, we first introduce in Sec. 6.4.1 the metrics used to assess the accuracy of MICROSCOPE, and present the benchmarks against which we test it. We then perform in Sec. 6.4.2 a comprehensive comparative evaluation of MTD performance on mobile network traffic recorded at the antenna level, which corresponds to end-to-end NSaaS settings where each network slice enjoys dedicated spectrum [295].
In Sec. 6.4.3, we investigate how such performance vary at different network levels, including MEC facilities, C-RAN or core network datacenters where network slices are also to be implemented [295]. Finally, we comment on the complexity of the different models used in MICROSCOPE and discuss accuracy-complexity trade-offs in Sec. 6.4.4.

Performance Metrics and Benchmarks
We evaluate the performance of MICROSCOPE, along with that of all benchmarks, by means of the mean absolute error (MAE, see Eq.(4.9)) and Normalized MAE (NMAE).
The NMAE normalizes MAE by the range of ground truth traffic measurements: . (6.14) In both (4.9) and (6.14), the set of antennas A shall be replaced by the set of facilities or datacenters, depending on the network level at which MTD is performed.
We compare our proposed 3D-DefCNNs against six deep learning architectures, whose configurations are summarized in Tab. 6.1. Note that since there is no existing solution for MTD, these baselines are what we find to be most relevant for comparison purposes. The multi-layer perceptron (MLP) is the simplest neural network class [22] and we consider it as a baseline solution. Convolutional neural networks (CNNs) are commonly used for imaging applications [144]. Long Short-Term Memory (LSTM) is frequently exploited for modeling sequential data [243], e.g., speech signals and natural language. Convolutional LSTM (ConvLSTM) is a dedicated model for spatio-temporal data forecasting [211]. Deep zipper networks (ZipNets) were originally proposed for mobile traffic super resolution tasks with remarkable results [7]. 2D deformable CNN (DefCNN) extend the transformation ability of CNNs and perform very well in many computer vision tasks [283].

MTD at radio access
At radio access, network slicing can provide very high QoS guarantees by isolating spectrum or even dedicated antenna sites for specific mobile services [296,297]. To fulfill this vision, resource management decisions need to be made at the individual antenna level, which in turn calls for fine-grained traffic usage information for different services as close as possible to the user. Our initial scenario for evaluation of MTD is thus the access network, with decomposition carried out on traffic recorded at each antenna sector separately. The results suggest that: (i) both spatial and temporal features are significant to the MTD performance; (ii) the spatial deformation operations help reorganizing the geographical displacements in the aggregate snapshots provided as input; (iii) incorporating temporal deformation into the model enables scanning of historical data with frequencies that are tailored to their importance. The second point is equivalent to an attention-like mechanism [298], where relevant information is sampled more fre-   deformable convolutional layer (right).

Service-level performance of MICROSCOPE
Having clarified that MICROSCOPE outperforms all considered benchmarks, we shift our attention to the MTD performance offered by our framework on a per-service basis. services, yet it stays at a very reasonable 1.2%. Overall, the MTD performance of MICROSCOPE is remarkable, as the inference errors are typically well below 1% for all services.
An illustrative example of the MTD quality granted by our framework is in Fig. 6 MICROSCOPE yields precise MTD, irrespective of service type.

MTD at network datacenters
Network slicing heavily relies on the capability of the operator to dynamically orchestrate virtualized functions at the edge and core of their infrastructures [274,296,299].
Similarly to the radio access case, this requires efficient data-driven resources management, which could be fueled by service-level demands inferred via MTD. In order to assess the flexibility of MICROSCOPE in serving heterogeneous edge and core network scenarios, we consider three use cases: (i) fifty MEC facilities deployed at the edge, aggregating traffic from 10-20 antennas each; (ii) thirty C-RAN datacenters, each providing MAC-layer functionalities for 20-40 antennas; (iii) ten core network datacenters implementing, e.g., Serving Gateway (S-GW) functions and accommodating traffic generated by 50 or more antennas each. We model the deployment of such diverse network entities according to a strategy of load balancing and latency reduction.
In order to decide on the associations between antennas and MEC facilities, C-RAN and core datacenters, we run the balanced graph k-partitioning algorithm proposed in [295] over the Delaunay triangulation graph [300]  heuristic [301] are provided in Fig. 6.14 for the core and C-RAN datacenter scenarios.
Although the architectural settings above are arbitrary, and do not necessarily reflect the future organization of the Network Virtualization Function (NVF)-compliant mobile network in the target region, they provide a reasonable approximation of what one could expect, and allow us to investigate the performance of MICROSCOPE in diverse virtualized network scenarios. In all these cases, we run MICROSCOPE using the geographic centroid of each cluster as the location associated to the traffic served by each datacenter.
We also consider different time resolutions for the management of NSaaS, from 5 mins to 1 h. The rationale is that Virtual Network Functions (VNF) and their associated resources at datacenter level are likely to be reconfigured over longer timescales than at radio access. Hence, varying the temporal granularity offers a more complete analysis  in bold. The key takeaway is that MICROSCOPE still outperforms all other architectures as long as MTD is performed with higher frequency (i.e., 5 to 30 minutes) or at MEC facilities and C-RAN datacenters. Instead, when mobile traffic is accumulated in large volumes, by considering hourly aggregates or demands at network core datacenters, LSTM yields the lowest errors. Indeed, (i) coarse temporal granularities lead to more regular time series, and generally easier to decompose, whereas (ii) considering combined at core datacenters diminishes the impact of spatial correlations between locations. Under these settings, the complexity of MICROSCOPE becomes unnecessary, while LSTM thrives by avoiding looking for complicate interactions that are in fact absent in the input data. For the same reason, the performance of CNN-based models, including ConvLSTM, CNN, ZipNet, and DefCNN, improves as we move from the core to the edge of the network, where the impact of spatial correlations increases.
Overall, MICROSCOPE proves the best solution for MTD in the majority of settings, which confirms the flexibility of our framework.

Complexity Analysis
We also evaluate the models' complexity in terms of floating point operations (FLOPs) per inference instance, a frequently employed measure of the complexity of neural networks [302]. The number of FLOPs is computed by counting the number of mathematical operation or assignments that involve floating-point numbers. Observe in  lower, but so is its overall MTD accuracy.
An interesting remark is that, although LSTM yields the best accuracy in some cases, as indicated in Tab

Implications for Operators
We complete our evaluation of the performance of MICROSCOPE by assessing the viability of the MTD it offers in practical case studies. Specifically, we take the perspective of the mobile network operator, and assess the incurred costs when MICRO-SCOPE is used to determine the capacity allocated to each network slice, solely based on aggregate traffic information. Such costs directly stem from estimation errors in the decomposed demands, which may entail Service-Level Agreements (SLAs) violations (if the estimate is below the reference) or overprovisioning of unnecessary capacity (if the estimate is above the reference).
We thus re-train MICROSCOPE to perform MTD with a recently proposed loss function that specifically aims at minimizing monetary costs for network operators [227]: Here ∆d s a (t) = d s a (t) − d s a (t), α controls the cost of an SLA violation, and ε is a small constant. The expression accounts for the cost of SLA violations (quasi constant, and intervening for ∆d s a (t) ≤ αε) and overprovisioning (growing as additional resources are erroneously reserved, when ∆d s a (t) > αε), so that MICROSCOPE can perform MTD by trying to balance them. We configure α = 1 and ε = 0.01, as suggested in [227].
We test MICROSCOPE with this configuration in three case studies: for SLA violations, each infringement is translated into MB/s as per (6.15), where one violation has the same cost as allocating additional capacity to cover α times the peak demands for the considered mobile service traffic. In both cases, results are reported as the total over all MEC (respectively, C-RAN and network core) nodes in the target metropolitan region.
At C-RAN and core datacenters, MICROSCOPE carries percent costs in the range from 8% to 58%, computed with respect to the true demand. These are in fact comparable to the equivalent costs for capacity allocation to network slices at the same network levels, incurred when the operator has perfect knowledge of the traffic demand associated to each mobile service: in these conditions, by using a state-of-the-art one-step predictor, costs are up to 30% for SLA violations and up to 18% for overprovisioning [227]. When pushing MICROSCOPE at MEC facilities, the performance degrades sensibly, and the stronger fluctuations in per-service traffic make a MTDbased estimation of the demand generated by each service less suitable to capacity allocation.
When MTD is performed at antenna level, we translate the extra resources required to support the unnecessary capacity overprovisioned at each antenna in terms of additional subcarriers/spectrum [303]. From this, we compute the cost in CPU time, based on experimental models obtained with open LTE stacks such as OpenAirInterface [304]. We summarize our findings in Tab. 6.4. When MICROSCOPE performs MTD at antenna level, just 6 Mbps of additional throughput is needed per antenna, which yields a 3 MHz spectrum cost and requires 7.5% additional CPU time with respect to the case where perfect knowledge of service traffic is available.
Given the positive results obtained in the majority of the scenarios considered, we believe that MTD can substantially reduce the cost of service-level demand estimation in many practical cases, with minimal impact to the quality of the resource allocation.

Summary
In this chapter, we introduced MICROSCOPE, a dedicated framework for aggregate Mobile Traffic Decomposition (MTD) into service-level demands, intended to assist capacity allocation to network slices. By hinging on an original 3D-DefCNN structure, MICROSCOPE decomposes traffic aggregates into service-level consumption time series with inference errors below 1.2%, in large-scale and heterogeneous network deployments. In doing so, it also outperforms a wide range of other deep learning approaches.
MICROSCOPE can perform MTD inference in real-time, and we show that a resource allocation based on decomposition yields affordable costs for the operator. As a result, MTD via MICROSCOPE provides a means to limit the need for extensive deep packet inspection (DPI) in traffic collected at different levels of the network infrastructure. We believe that it is a promising novel approach that can complement the DPI technique.

Chapter 7
Attacking and Defending Deep

Systems
Network Intrusion Detection (NID) aims at identifying malicious traffic flows, so as to protect computers, networks, servers, and data from attacks, unauthorized access, modification, or destruction [305]. Given the unprecedented growth in the data traffic volume transiting both wired and wireless infrastructure, NID is becoming increasingly important to ensure system/service availability and protect individuals' safety and privacy online. As new cyberattacks proliferate, traditional intrusion detection methodologies that rely on pattern matching (e.g., IP address and Port number) and classification are losing their effectiveness [306]. In this context, deep learning-based solutions are gaining traction, as they rely less often on deep packet inspection (hence raising fewer privacy concerns) and have better generalization abilities. However, due to their complex structures, DNN also suffer from limited interpretability, which inevitably raises important questions: Is deep learning a truly reliable option for NID?
Is there any "Achilles heel" that can be exploited to compromise the alleged high detection accuracy? Answering these questions is crucial to guaranteeing the reliability of Network Intrusion Detection System (NIDS).
Unfortunately, Deep Neural Networks (DNNs) have been proven vulnerable to adversarial examples [307] or blakdoor attacks [308] in several applications [309,310], whereby they can be fooled by dedicated unnoticeable perturbations introduced in the input [311], which interfere with the correctness of the inferences made. Since such perturbations are very subtle, they are often extremely difficult to detect. Deep learning-based NIDS may be also susceptible to such adversarial manipulations. Attackers unaware of the properties of an NIDS (i.e., black-box system) could generate adversarial samples by repeatedly changing small subsets of the traffic features, and make "queries" to the NIDS. After each query, the attacker obtains some feedback (e.g., ACK), which indicates the success or failure of the attack attempt. 1 Based on this feedback, the attacker can adjust perturbations on selected time-based features (e.g., intervals between each two packets) of the traffic, or introduce new ones, without changing its essence, until succeeding in bypassing the NIDS [312,313]. By this approach, malicious flows could then be disguised into benign traffic and compromise their targets [314], while remaining undetected even by NIDS previously thought to be highly accurate.
To mitigate the aforementioned issues, in this chapter we investigate the robustness of state-of-the-art deep learning NID models against different adversarial mechanisms.
We consider attacks in black-box and decision-based settings, and test the effectiveness and efficiency of each attack in two detection scenarios: one-to-all and one-to-one, i.e., aiming to discriminate malicious vs. benign traffic, and respectively identify precise types of attacks. To defend against those threats, we propose three different solutions, which effectively reduce the success rate of each attack to a large extent. This enables more robust and reliable NID and leads to the following contributions: 1. We implement three types of DNN architectures based on state-of-the-art NID models, i.e., MLP, CNN and LSTM, and perform NID on the realistic cyber defense dataset CSE-CIC-IDS2018 [315] in both one-to-all and one-to-one scenarios. The NID models implemented achieve over 98.7% detection accuracy based on a limited set of traffic features, which matches the performance of previously  3. We propose three defense mechanisms to strengthen deep learning based NIDS against the aforementioned attacks, namely model voting ensembling [316], ensembling adversarial training [317], and adversarial query detection [318]. Each defense method can either operate individually or jointly with others. Experiments show that our defense methods can drastically reduce the success rate of each attack, which significantly improves the robustness of the NID models (see Sec. 7.5).
We name our attack-defense framework TIKI-TAKA 2 and illustrate the workflow of 2 TIKI-TAKA is a football tactic that encourages short and fast passing of the ball and tackling on the 142Chapter 7. Attacking and Defending Deep Learning-based Intrusion Detection Systems our methodology in Fig. 7.1. To the best of our knowledge, we are the first to study defense mechanisms against adversarial attacks targeting NID systems.

Related Work
DNN are increasingly used or NID purposes, as they help minimize the effort of feature engineering, and operate with high detection accuracy [305]. However, recent research suggests that there exist loopholes that can degrade their high performance, as perturbation added to their input can trigger traffic misclassification [4,319]. Thus, defending deep learning based approaches from adversarial samples becomes a crucial issue for network security.

Attacking Deep Learning Driven NIDS
The majority of existing methods that employ adversarial samples to compromise classifiers target image applications (e.g., [320,321] [314]. By learning and approximating the distribution of benign and anomalous samples, these methods can evade NID with high success rate.
spot when losing possession. We use this is to metaphorize the frequent queries passed to the intrusion detector in the attack process, and with the detector subsequently regaining control through defenses.
Network distillation methods employ a student neural network to learn knowledge from a more complex teacher network. With this approach, the student network generalizes better and becomes more robust to the adversarial samples. Adversarial training While these approaches are effective in the computer vision and natural language processing domains, none of them target defending against adversarial samples in NIDS, which is precisely the problem we tackle in this chapter.

Dataset
We conduct all experiments (i.e., NID, black-box adversarial attacks, and with the proposed defenses) using the publicly available CSE-CIC-IDS2018 dataset [315]. This     We train all deep learning models, implement and defend against the black-box adversarial attacks using the selected features.

Training Network Intrusion Detectors
Training accurate deep network intrusion detectors is the initial important step of the study, as TIKI-TAKA builds on the pre-trained NID models. To this end, we employ 3 well-known deep learning architectures, namely MLP [332], CNN [333], and CNN with LSTM layers, i.e., C-LSTM [334]. These models are frequently used for NID purposes and have achieved notable performance. We illustrate the specific architectures of all models considered in Fig 7.2.
The MLP is the most simple deep learning architecture, which employs multiple stacks of fully-connected layers for features extraction. It is particularly suitable for handling traffic flows that have mixture types of features and ranges. In our study, we construct an MLP with 3 hidden layers. Each layer has 200 units, except for the last hidden layer, which has 400 units. CNN have good spatial perception abilities and have demonstrated remarkable precision in NID tasks [333]. In this work, we design a CNN with 10 one-dimensional CNN layers, each equipped with 108 filters, with filter size of 5. Lastly, we replicate the C-LSTM employed in [334], with our C-LSTM operating on the features that characterize the traffic, instead of the raw flows. The C-LSTM combines CNN and LSTM structures to extract spatial and temporal features separately. Data will be first processed by a CNN with 5 hidden layers, then passed to a 2-layers LSTM for the final predictions. Each LSTM layer has 160 units. In this study, we perform NID, black-box adversarial attacks and defend against them based on these models, as we will detail in the next sections. We consider NID in two different scenarios, namely (i) one-to-all detection and (ii) one-to-one detection. The one-to-all scenario groups all types of attack into a single "anomaly" class, which leads to a supervised binary classification problem. Instead, one-to-one detectors separate each network attack type (14 in total) into individual classes, and perform multi-class classification. In our study, the same neural network architectures are employed for both scenarios, except for changes in the final layers, as their number directly depends on the number of classes considered for identification.
We train and validate all models using 80% of the dataset and test on 20% of it, as customary. All models are trained via minimizing the cross-entropy loss function through the Adam optimizer [241]. Super-sampling is employed to reduce the effect of class imbalance between benign and malicious traffic, which is inherent to the dataset.
All models are trained and evaluated on a parallel computing cluster equipped with one or multiple Nvidia TITAN X, Tesla M40 or/and Tesla P100 GPUs. The neural models are implemented in Python using the Tensorflow [222] and TensorLayer [223] packages.

One-to-all NID
We quantify the performance of the NIDS using four performance metrics, namely accuracy, precision, recall and F1 score, as shown in Table 7 Observe that all models achieve high detection performance, as all F1 scores are above 0.960. In addition, the performance of the three models considered is similar, since the difference between the F1 scores attained by each never exceed 0.01. This matches the performance of state-of-the-art deep learning based NID solutions, thus the models can be considered "reliable".

One-to-one NID
One-to-one NIDS aim at classifying each traffic flow into 14 types of anomalies and benign. We employ the same neural network architectures to assess their detection performance also in this scenarios, this time resorting to normalized confusion matrices, as shown in Fig. 7.3. The diagonal elements represent ratios of points for which the predicted label is equal to the true label, while off-diagonal elements are indicate misclassification ratios [335]. Therefore, the elements of each row sum up to 1. The higher the diagonal values of the confusion matrix, the higher the performance, indicating many correct predictions.
Observe that all NID models achieve high detection accuracy for most types of anomalies, as diagonal values are close to 1. However, taking a closer look at the Brute Force-XSS, SQL Injection, Infiltration, and Brute Force-Web attacks, it appears the NID models usually fail to identify those and tend to misclassify them as "be- In what follows, we will demonstrate that although the NID performance of these solutions seems reliable in terms of detection accuracy, they can be easily compromised through a sequence of perturbations and queries without requiring to have information about the underlying models.

Black-box Attacks against NIDS
The objective of adversarial attacks is to generate adversarial samples, by adding small perturbations to the input given to NIDS, so as to cause misclassification. We denote by x the input to a classifier (i.e., features extracted from traffic flows), an adversarial sample as x adv = x + σ x , and the targeted class as y adv . The objective of the adversarial attacks can be formulated as finding x adv such that ||x adv −x|| ∞ < ε and x adv is classified as y adv . Here, σ x is the perturbation added to the input and ε limits the scale of the perturbation [336].

Threat Model
Typical attacks against machine learning models can be categorized into three classes, namely (i) white-box attacks, (ii) grey-box attacks, and (iii) black-box attacks. Whitebox and grey-box attacks assume the malicious actors have access to the training data or/and model structures. Such hypotheses apply in cases where system designers seek to improve the robustness of their NIDS, but rarely to external adversaries. Instead, potential hackers are forced to treat an NIDS as a black-box, since the details of a victim system's inner workings remain hidden and the only way in which the NIDS behavior can be learned is through a sequence of queries and the feedback received. This is also the practical threat model that we consider in this work.
Specifically, an attacker may send a traffic flow towards the target network, which will be first examined by a NID model. This is known as a query process. Subsequently, the attacker will receive implicit/explicit feedback from the model, e.g., an ACK packet, which reflects whether the traffic flow was classified as an anomaly.
Based on the feedback, the attacker can adjust and apply subtle perturbations to the malicious traffic flow, thereby producing adversarial samples that eventually may compromise the effectiveness of the NIDS, which will end up classifying malicious traffic as benign. On the other hand, the attacker may not have confidence about the exact decision class decided by the NIDS. We illustrate this black-box attack process against NID models in Fig. 7

Domain Constraints
Unlike adversarial attack against image classifiers, adversarial samples against NIDS must respect certain domain constrains [314], such that preserving the functionality and intactness of the samples when introducing perturbations σ x . This means that (i) (iv) if the std feature is zero, the corresponding mean, max, min and std features remain unchanged in the adversarial sample. Samples that violate these constrains will be automatically rejected and characterized as unsuccessful trials. These validation tests ensure that the generated adversarial samples preserve the originally intended functionality.
NES [336] are black-box gradient estimation methods for machine learning models. POINTWISE Attack [339] is a simple decision-based attack method that greedily minimizes the L 0 -norm between raw and adversarial samples. In image applications, it first introduces salt-and-pepper noise until misclassification, and then repeatedly iterates over each perturbed pixel, resetting it to the initial value if the perturbed image remains adversarial. We implement a similar approach to attack the NID models, but substitute the salt-and-pepper noise with additive Gaussian noise, to better suit network traffic.
HOPSKIPJUMPATTACK [340] is a hyperparameter-free, query-efficient attack method, which consists of three main steps, namely (i) estimation of the gradient direction, (ii) step-size search via geometric progression, and (iii) boundary search via a binary search approach. It is applicable to more complex settings, such as non-differentiable models or discrete input transformations, and achieves competitive performance against several defense mechanisms.
OPT-ATTACK [341] projects the decision-based attack into a continuous optimization problem and solves it via randomized zeroth-order gradient update. In particular, a Random Gradient-Free (RGF) method is employed to find appropriate perturbations and converge to stationary points. Since OPT-ATTACK does not rely on gradients, it can attack other non-differentiable classifiers besides neural networks, e.g., Gradient Boosting Decision Trees.
We employ a modified version of the mean absolute percentage error to quantify the deviation between each unmodified sample x and its adversarial version x adv , i.e., where N is the total number of perturbed features in x and x (k) , x

Attack Performance
We randomly select 50,000 malicious traffic flows from the test set to craft adversarial samples. We summarize the statistics of these samples in Table 7.3. We quantify the attack performance of each approach using 4 performance metrics, namely Attack Success Rate (ASR), average benign confidence, MAPE, and average number of queries.
The ASR is measured by the ratio between the number successful adversarial samples and the total attack attempts (50,000). This can be an indicator of the effectiveness of an attack approach. An attack attempt is successful if and only if the attack algorithm converges, and the adversarial samples meet the aforementioned constraints. The average benign confidence denotes the probability that the model predicts an adversarial sample x adv as benign. Higher confidence implies that the model is more confident   [342]. In what follows, we show the attack performance of the one-to-all and one-to-one scenarios in this section.

Attack Performance in One-to-all Scenario
We show the performance of all attack approaches in one-to-all detection scenarios in Fig. 7 Notably, the robustness and vulnerability to a specific type of attack may vary from models. For example, no adversarial samples of the DoS attacks-SlowHTTPTest can bypass CNN, while its ASR for MLP are mostly over 90%. This information can deliver useful insight for the network service provide to defend specific types of attacks.

Attack Performance in One-to-one Scenario
We illustrate the statistics of each attack against the different NID models considered for one-to-one scenario in Fig. 7 Number of Queries number of queries. This suggests that this approach is effective and efficient in oneto-one settings. The C-LSTM appears to be the most robust model against adversarial samples, as all attack methods attain the lowest ASR values against this NID model.
Although achieving the highest benign confidence with adversarial samples, the NES obtains the lowest ASR on average. In general, it also requires a large amount of queries to craft an adversarial sample.
In Fig. 7.8, we show the ASR for each type of malicious traffic flow considered, in the same one-to-one scenario. Analyzing these results jointly with Fig. 7.3, observe that anomalies with low detection rate (i.e., Brute Force-XSS, SQL Injection, Infiltration, Brute Force-Web) are easier to be disguised by the attackers. This is because the models already have vague decision boundaries for these flow types, thus are easier to be gamed. Attackers obtain the lowest ASR when crafting adversarial samples based on DoS attacks-Hulk, -GoldenEye, -Slowloris, and DDoS attack-LOIC-UDP, as the NID models exhibit high detection rates over these anomalies. Overall, most of attacks achieve similar ASR performance as they obtain in the one-to-all scenario.

Cross-Transferability
We define the transferred ratio ε m 2 m 1 = Observe that large proportion adversarial samples are transferable across NID models for both detection scenarios. This has been also confirmed in the adversarial attack against image classifiers [343]. This implies that, even with completely different struc- Number of Queries tures, NID models enclose similar blemish, of which attackers can take advantage. For example, we assume that network service provider (NSP) employs the C-LSTM model to perform one-to-one NID. To compromise the system, attackers manage to craft K

Feature-wise MAPE
We delve deeper into the adversarial samples generated, by showing in Fig. 7.10 the average MAPE of each perturbed feature on all successful attack samples across all NID models and attack approaches. Observe that for both detection scenarios, the Active/Idle Time (i.e., the time a flow was idle before becoming active (mean, min, max, std) and amount of time a flow was active before becoming active (mean, min, max, std)) are less affected, as the related features remain almost unchanged in the attack process. In contrast, features that characterize average number of bytes and packets sent in forward and backward direction in the initial window or/and sub flows, are perturbed more significantly. This indicates that these features are the most influential in the decision of NID models, and therefore more likely to be exploited by potential attackers. One-to-one CT    One-to-all One-to-one

t-SNE Visualization
We also investigate the inner workings of each NID model, by visualizing the output embedding of their hidden layers, so as to understand better how a neural network "thinks" of the benign, malicious, and adversarial samples. To this end, we adopt the t-distributed Stochastic Neighbor Embedding (t-SNE) [344] to reduce the dimension of the last hidden layer of each model to 2. In Fig. 7.11, we plot the t-SNE embedding (x, y axis) of their hidden representations of 10,000 benign samples (blue), 10,000 adversarial samples (green) generated by each attack method, and their corresponding abnormal samples used to craft them (pink), along with their benign confidence (z axis). Note that the sample will be considered as benign if and only if the the benign confidence is greater than 0.5 (above the decision plane). Typically, the t-SNE approach organizes data points that have higher similarity into nearby embeddings [98].
It can therefore reflect how the model "thinks" of the data samples, as similar data representations will be clustered.
Observe that abnormal samples can be clearly distinguished from benign samples by their t-SNE embeddings for all NID models. The purpose of adversarial attacks is to cause misclassification by bringing abnormal samples across the decision boundary. This is reflected in the Fig. 7.11, as the t-SNE embedding of adversarial samples are moved closer to the benign embedding cluster, while they remain anomalies in nature. This successfully confuses the NID models, making the adversarial samples indistinguishable. In addition, adversarial samples with higher benign confidence are in general closer to the benign embedding cluster. This is especially clear in the t-SNE embedding produced by the CNN.

Defending Against Black-box Adversarial Samples
Defense mechanisms against adversarial attacks should improve the robustness of deep learning models to adversarial samples, such that they become less likely to be com-   In what follows, we detail the proposed defense mechanisms, and demonstrate their effectiveness against black-box attacks.

Model Voting Ensembling
The experiments we reported in Sec. small set of adversarial samples can bypass all three NID models simultaneously. This motivates us to construct a new ensembling model [5,7] by combining all of these structures, to strengthen the barrier against potential attacks. Specifically, for each input traffic flow, we gather the decisions of all NID models individually, and make the classification using a voting process. A traffic flow will be classified as "benign" if and only if all models reach consensus, i.e., all of them classify it as "benign". Otherwise, the traffic flow will be regarded as an "anomaly". We show the underlying principle of the model voting ensembling mechanism in Fig. 7.12. We recognize several advantages of using such model voting ensembling for defending agaisnt adversarial attacks. Namely: 1. In order to construct a successful adversarial sample, attackers need to defeat all NID models simultaneously, which is much harder than compromising a single Number of Queries one; 2. The voting mechanism makes the entire model non-differentiable, thus attack approaches that rely on model gradient estimation (e.g., NES) will be obstructed; 3. The voting mechanism is easy to implement, as it does not require to re-train the original NID models.
The proposed model voting ensembling method is a proactive approach, as it improves the robustness of the pretrained models against adversarial samples. We show the NID performance of the ensembling model for the one-to-all scenario in Table 7.4 and the confusion matrix for the one-to-one scenario in Fig. 7.13. Revisiting Table 7.2 and Fig. 7.3, observe that the ensembling model obtains very close performance compared to its individual components in both detection scenarios, while achieving lower false positive rates, since it requires consensus to make the "benign" decision.
We re-run the same 5 black-box attacks considered previously over the same set of 50,000 malicious samples and show their statistics in Fig. 7.14. Note that the benign confidence is abandoned as, outputs of ensembling models are no longer probabilities.
Jointly analyzing with Fig. 7  obtains 20.1% ASR in attacking CNN in the one-to-all scenario, while this drops to 8.0% while attacking the ensembling model. Regarding the one-to-one scenario, the dropping degree of the ASR is also substantial. This indicates that the voting ensembling mechanism operates well as a defense approach. On average, the ensembling models lead to 17.12% and 9.02% drop of ASR for one-to-all and one-to-one scenarios respectively. Turning attention to the MAPE, observe that the MAPE of adversarial samples crafted from ensembling models is lower, which suggests that the ensembling mechanism applies hidden and tighter constraints to the adversarial samples, to prevent them deviating excessively from the raw input samples.
We also show in Fig. 7.15 the ASR on a malicious traffic type bases, when crafting adversarial samples against the ensembling model, for the one-to-one NID scenario.
Observe that the voting ensembling mechanism successfully defends 9 type of adver-  across different attack methods and victim models [317,345]. Therefore, from the defenders' points of view, adversarial samples generated using white-box attacks can be exploited to improve the robustness of NID models, so as to defend against potential black-box adversarial samples. Therefore, we employ the Ensemble Adversarial Training (EAT) as an additional defense approach [317], which augments the training data with adversarial examples generated by white-box attacks crafted on other static pre-trained NID models. Subsequently, the original NID models are reinforced by re-training on the augmented dataset. We show the underlying principle of the EAT mechanism in Fig. 7. 16. We expect that, with the proposed re-training on the augmented dataset, the NID models learn to classify adversarial samples better and thus become more resilient to black-box attacks.

Reinforcing NID models with White-box Adversarial Samples
Specifically, we randomly select 250,000 malicious traffic flow to generate adversarial samples using three state-of-the-art white-box attack approaches. Namely, Fast Gradient Sign Method [346], Iterative Attack (I-FGSM) [347] and Momentum Iterative Fast Gradient Sign Method (MI-FGSM) [348]. The FGSM-based approaches performed one step gradient update along the direction of the sign of gradient at each feature that allows perturbations, and introduce noise following the direction of the gradient.
The I-FGSM method extends the FGSM by running a finer optimization for multiple iterations to generate a valid adversarial sample. The MI-FGSM method introduces the a momentum term into the iterative process of I-FGSM, which help stabilizes the update directions and escape from poor local maxima. This leads to more transferable adversarial samples.
We show statistics of malicious traffic samples used for white-box attacks, number of successful adversarial samples, and their ratio in Table 7.5. Note that the adversarial sample numbers are summed over all white-box attacks, all models, and both detection scenarios. Due to the information asymmetry between attackers and defenders, the defenders do not have knowledge about which features will be perturbed for attack purposes. We therefore relax the features constraints (see Sec. 7.4.2) for perturbations in the white-box setting. However, the constraints over MAPE (≤ 20%) are retained, to restrict the scale of the perturbations. Note that the adversarial samples generated by white-box attacks are not necessarily valid traffic flows, as they are only employed for training purposes. We gather successful adversarial samples generated by all white-box attack methods (i.e., FGSM, I-FGSM, and MI-FGSM), crafted with all NID models (i.e., MLP, CNN, and C-LSTM) in both detection scenarios (i.e., one-to-all and oneto-one) and combine these with the original training data, to build a new augmented dataset for the EAT.
We show the performance of each white-box attack in Fig. 7.17. Observe that since the NID models are transparent, and looser constraints are applied to the adversarial samples, the ASR for all white-box attacks is significantly higher than their blackbox counterparts. White-box attacks also require fewer queries to generate adversarial samples. Fortunately, attackers normally do not have access to the NID models. The ASRs for crafting each type of anomaly is shown in 7.18. Observe that ASR for many types of anomalies are close to 100%.

NID Performance of Post-EAT Models
We show the detection performance on the same test set after EAT, for the one-to-all scenario, in Table 7.6. Compared to NID models prior to the EAT (See Tables 7.4, 7.2), the detection performance of the newly trained models has dropped slightly in terms of accuracy, precision, and F1 score. However, the recall rate of each model has improved. This indicates that the models are prone to classify some ambiguous samples as anomalies, which results in higher false positive rate and lower false negative rate.
Similar phenomena are also observed in the one-to-one scenario. The accuracy for the MLP, CNN, C-LSTM, and the ensembling model are 98.13%, 98.12%, 98.10% and 97.96% respectively, which appears worse than what was achieve prior to EAT. However, by taking a closer look at their confusion matrices in Fig. 7.19, post-EAT models   This effect is confirmed by their t-SNE embedding. In Fig. 7.20, we show the twodimensional (x, y axis) t-SNE embedding of the representations in the last hidden layer along with the benign confidence (z axis) of each NID models after the EAT, as similar to Fig. 7.11. Note that we employ the same set of samples in Fig. 7.11 to generate the new Fig. 7.20. Observe that after the EAT, some old adversarial samples are rejected by the new models (purple), as they are below the decision boundary. It appears that the EAT pushes certain of the adversarial samples away from the benign cluster, such that they become more separable. Even though some adversarial samples still escape, their benign confidences become lower compared to Fig. 7.11. These means that the new models are more suspicious on these data after the EAT. One can raise the decision boundary to filter those samples, though it might result in higher false negative rate.

The Effect of EAT
In Fig. 7.21, we show the ASR for each attack after EAT (ASR EAT , bars in the upper part of the plot), and the ASR reduction compared to the case before EAT was applied (ASR -ASR EAT , bars in the lower part) for the both NID scenarios. In the figure, positive numbers below the x-axis indicate that the ASR EAT has dropped after EAT was employed. We observe that ASR of each attack drops for most of the models.
This means that EAT successfully improves the robustness of each model, making them more difficult to be compromised. On average, the ASR drops to 6.70% and 5.78% for one-to-one and one-to-all NID scenarios, respectively.

Adversarial Query Detection
Recall that all black-box attack methods rely on continuous queries to the victim model and feedback received. Based on the feedback, the attackers learn to adjust the perturbations added to the input, so as to compromise detection. The scale of perturbations is usually small, so that they to do not change the essence of the original input. Therefore, the queries in the same attack round are typically with high similarity. This inherent similarity between queries can be harnessed to detect an attack. Therefore, we explore query detection [318] as the final defense mechanism. Once queries have been discovered, the NIDS can blacklist the attackers' IP addresses, to prevent potential threats.
Specifically, for each IP address, we construct a buffer with size B to store the features of the traffic flows originating from that address in a pre-defined period. To reduce the dimension of the features saved and model the similarity degree between flows, we employ a deep similarity encoder (DSE) [349], encoding similar traffic flow in a lower-dimensional space with shorter l 2 distance. More precisely, for each new flow x sent from that IP address, we compute the pairwise distance between the embedding of this flow and others in the buffer, calculating the k nearest neighbor average distance d k x . If d k x is lower than a threshold τ, i.e., d k x < τ, this suggests that particular IP address has sent an excessive number of similar traffic flows, which can be considered as queries in an ongoing attack. When this happens, the IP address can be blacklisted and thus the potential threat eliminated. We show the underlying principle of the query detection mechanism in Fig. 7.22.
After an attack is detected, the buffer associated to the specific IP address can be cleared. In addition, when query detection suggests a potentially malicious actor, their IP address can be banned either immediately, or after subsequent queries, as suggested in [349]. This can minimize an attacker's knowledge of the time when their attack was detected, therefore reducing the probability of compromising the query detection mechanism.

Deep Similarity Encoder
The core component of the query detection based defense mechanism is the deep similarity encoder (DSE) [349], which is a neural network that reduces the dimension of the input data. After embedding by a DSE, dissimilar flows will be far away from each other in the encoded space, while similar queries will be close to each others. Therefore, queries and traffic flows become more distinguishable.
For the DSE, we employ a CNN similar to that in Fig. 7.2, only replacing the last layer with 3 units. This means that the embedding of each traffic flow is a 3dimensional vector. We denote e i = DSE(x i ), as the embedding of the input sample x i .
The DSE can be trained via minimizing the following contrastive loss function: Here, x i ,x i are a pair of similar traffic flows, while x m , x n are traffic flows which are dissimilar. θ is the trainable parameter set of the DSE, and ϖ is a constant penalty, which regularizes the scale of ||e m − e n || 2 2 . We choose ϖ = 0.5 in our experiments. The first term of the function ensures that the l 2 distances of the similar traffic flows are     viewed as a stream of routine traffic in real life. Observe that the embeddings of the query set congregate in a fairly small region, and are close to each other. In contrast, the embeddings of the normal traffic appear more dispersed and separable. This further proves that our DSE can effectively learn the similarity between each traffic sample.

Hyper-parameters Selection
There are three important hyper-parameters to be configured for query detection, namely (i) the detection threshold τ; (ii) the number of neighbors k used for the detection; and (iii) the size of the buffer B, which stores the traffic flows sent from the same IP address. These parameters will significantly affect the performance of the query detection, and we optimize such hyper-parameters via a separate validation set.. First, we select τ = 0.00157, since 10% of dissimilar pairs and 86.4% of similar pairs in the training set are below this threshold. This provides an appropriate decision boundary to discriminate normal traffic flows and attack queries. Note that a high threshold will block benign traffic and a low threshold might lead to leakage of adversarial queries.
The values of k and B affect the robustness of detection and also the computational and storage cost of the NIDS. We select B = 500 and k = 200, as these numbers allow efficient detection and yield 0 false positive rates when operating with traffic streams simulated with the entire training set.

Query Detection Defense Performance
We show the ASR of each attack after the query detection, the ASR reduction compared to when query detection is not employed (bars bellow the x-axis in the top subplot), the query detection rate (middle), and the average number of queries (bottom) when the attack is detected, for each attack method for both NID scenarios in Fig. 7.25 and 7.26 respectively. Observe that the ASR has dropped significantly after the query detection is employed. In particular, the ASR of NES reaches 0 for all models for both NID scenarios, and the detection rates therefore become 100%. On average, the query detection defense reduces the ASR of attacks by 12.38% and 8.56% for each NID scenario respectively, and their average detection rate are 70.24% and 59.50%. This means that majority of the adversarial attack are detected during their query process.
Taking a closer look at the average detected query, we observe that NES, BOUND-ARY, POINTWISE, and HOPSKIPJUMPATTACK attack attempts are detected at their 201 st query. Recall that the k neighbor size selected for the query detection is 200, hence the detection alarm will only be triggered when the buffer has more than 200 samples. This means that the attack is detected immediately after the buffer has k neighbor samples. Regarding the OPT-ATTACK attack, this is detected always 208 queries. This is due to the initial phrase of the attack, when it injects a few benign traffic flows to learn the direction of perturbation to be added to the adversarial samples.
These samples are normally dissimilar, which slightly increases the detection time.
Note that, despite the efficiency of the query detection mechanism, a larger buffer size (B = 500) is still needed for tolerance, as the attacks may fill the buffer with queries (similar samples) and garbled traffic (dissimilar samples) alternately, to compromise the defense.
In Fig. 7.27 and 7.28 we show the ASR for each type of attack for both NID scenarios after the query detection is employed. We observe that the ASR drops significantly. In particular, except for the Infiltration traffic, the ASR for all type of malicious traffic are close to 0. This means that our defense mechanisms work fairly well in preventing all black-box attacks for each type of malicious traffic. Overall, by combining the model voting ensembling, EAT and query detection mechanisms, our proposal can successfully prevent 5 types of mainstream black-box attacks from compromising neural-network based NID systems.

Zooming in on Infiltration Traffic
To understand the reason why infiltration traffic samples escape detection, in Fig. 7.29 we examine the distribution of the number of queries of all successful attack attempts at each defense stage. We observe that while EAT does not change the query distribution significantly, most of the adversarial attacks bypassing the query detection only require 1 query. This means that the original traffic is already misclassified. The confusion matrices in Fig. 7.19 further confirm this, as the Infiltration traffic yields both high misclassification rate and ASR.
Recall that we removed three features (i.e. flow duration, total time between two packets sent in the forward and backward direction) that may be affected by perturbations during training and evaluation. The total time between two packets sent in the backward direction is however essential for identifying the infiltration traffic, according to our experiments. Once this feature is added back, the detection rate increases to over 97% and our defense mechanisms operate well in this case. We leave this as future work, which requires further in-depth study.

Effectiveness in Different Landscapes
To further demonstrate the effectiveness of our defense mechanism, we re-stage the MICROSCOPE flow (i.e., NID models training, 5 black-box attacks, and 3 defense mechanism) on a different dataset, namely CICIDS2017 [315]. The CICIDS2017 dataset is the predecessor of the CSE-CIC-IDS2018 dataset, where similar benign/abnormal traffic flows were collected and similar features extracted.
We show the pre-EAT and post-EAT NID performance of all models considered in Table. 7.8. Observe that all NID models obtain excellent performance, as they all achieve over 98% in terms of F1 score. After EAT, their performance are further improved which demonstrate that the EAT can effectively improve the robustness of NID models. We employ the aforementioned black-box attacks to craft adversarial samples on 10,000 malicious traffic flows. After applying all defense mechanism proposed, we obtain the ASR for each types of attacks in CICIDS2017 dataset in Fig. 7.30. Observe that except for Infiltration, the ASR for all attacks are 0% for all models. This complies with the performance we obtain on the CSE-CIC-IDS2018 dataset, which demonstrates that our defense methods can generalize well, thus being a reliable mechanism for the defense of deep learning driven NID systems. On the other hand, we observe that the defense performance obtained in this dataset appears better than the CSE-CIC-IDS2018. The reason is that the traffic patterns are less diverse in the CICIDS2017 dataset, thus it is easier for NID models to learn. This is reflected by the detection accuracy, where the F1 score of each NID models in the CICIDS2017 is higher. As a result, this naturally hinders a proportion of adversarial samples, which fall in similar traffic patterns.

Summary
In this chapter, we introduced TIKI-TAKA, a framework for defending against adversarial attacks on deep learning based NIDS. We trained 3 state-of-the-art deep learning models (MLP, CNN and C-LSTM) on a publicly available dataset, then employed 5 classes of black-box, decision-based adversarial attacks to compromise the neural models. Experiments show that despite having high detection rates, deep learning based NIDS are vulnerable to adversarial samples. To strengthen NIDS against such threats, we proposed three defense methods, namely model voting ensembling, ensembling adversarial training, and query detection. The combination of these can reduce the success rate of all attacks considered, bringing detection rates close to 100% on most malicious traffic. Future work will focus on handling infiltration traffic, which appears more resilient to NID models and defense approaches.

Chapter 8
Future Work and Conclusion

Future Research Perspectives
As deep learning is achieving increasingly promising results in the mobile networking domain, several important research issues remain to be addressed in the future. Some of which we discuss next, before we conclude this thesis.

Serving Deep Learning with Massive High-Quality Data
Deep neural networks rely on massive and high-quality data to achieve good performance. When training a large and complex architecture, data volume and quality are very important, as deeper models usually have a huge set of parameters to be learned and configured. This issue remains true in mobile network applications. Unfortunately, unlike in other research areas such as computer vision and NLP, high-quality and large-scale labeled datasets still lack for mobile network applications, because service provides and operators keep the data collected confidential and are reluctant to release datasets. While this makes sense from a user privacy standpoint, to some extent it restricts the development of deep learning mechanisms for problems in the mobile networking domain. Moreover, mobile data collected by sensors and network equipment are frequently subject to loss, redundancy, mislabeling and class imbalance, and thus cannot be directly employed for training purpose.
To build intelligent 5G mobile network architecture, efficient and mature streamlining platforms for mobile data processing are in demand. This requires considerable amount of research efforts for data collection, transmission, cleaning, clustering, transformation, and annonymization. Deep learning applications in the mobile network area 3D Mobile Traffic Surface 2D Mobile Traffic Snapshot  [7] using data from [262].
can only advance if researchers and industry stakeholder release more datasets, with a view to benefiting a wide range of communities.

Deep Learning for Spatio-Temporal Mobile Data Mining
Accurate analysis of mobile traffic data over a geographical region is becoming increasingly essential for event localization, network resource allocation, context-based advertising and urban planning [182]. However, due to the mobility of smartphone users [350,351], the spatio-temporal distribution of mobile traffic [199] and application popularity [352] are difficult to understand (see the example city-scale traffic snapshot in Fig. 8.1). Recent research suggests that data collected by mobile sensors (e.g. mobile traffic) over a city can be regarded as pictures taken by panoramic cameras, which provide a city-scale sensing system for urban surveillance [244]. These traffic sensing images enclose information associated with the movements of individuals [228].
From both spatial and temporal dimensions perspective, we recognize that mobile traffic data have important similarity with videos or speech, which is an analogy made recently also in [7] and exemplified in Fig. 8.2. Specifically, both videos and the largescale evolution of mobile traffic are composed of sequences of "frames". Moreover, if we zoom into a small coverage area to measure long-term traffic consumption, we can observe that a single traffic consumption series looks similar to a natural language sequence. These observations suggest that, to some extent, well-established tools for Beyond these similarity, we observe several properties of mobile traffic that makes it unique in comparison with images or language sequences. Namely, 1. The values of neighboring 'pixels' in fine-grained traffic snapshots are not significantly different in general, while this happens quite often at the edges of natural images.
2. Single mobile traffic series usually exhibit some periodicity (both daily and weekly), yet this is not a feature seen among video pixels.
3. Due to user mobility, traffic consumption is more likely to stay or shift to neighboring cells in the near future, which is less likely to be seen in videos.
Such spatio-temporal correlations in mobile traffic can be exploited as prior knowledge for model design. We recognize several unique advantages of employing deep learning for mobile traffic data mining: 1. CNN structures work well in imaging applications, thus can also serve mobile traffic analysis tasks, given the analogies mentioned before.
2. LSTMs capture well temporal correlations in time series data such as natural language; hence this structure can also be adapted to traffic forecasting problems.
3. GPU computing enables fast training of NNs and together with parallelization techniques can support low-latency mobile traffic analysis via deep learning tools.
In essence, we expect deep learning tools tailored to mobile networking, will overcome the limitation of traditional regression and interpolation tools such as Exponential Smoothing [206], Autoregressive Integrated Moving Average model [207], or unifrom interpolation, which are commonly used in operational networks.

Deep learning for Geometric Mobile Data Mining
As discussed in Sec. 1.2, certain mobile data has important geometric properties. For instance, the location of mobile users or base stations along with the data carried can be viewed as point clouds in a 2D plane. If the temporal dimension is also added, this leads to a 3D point cloud representation, with either fixed or changing locations. In addition, the connectivity of mobile devices, routers, base stations, gateways, and so on can naturally construct a directed graph, where entities are represented as vertices, the links between them can be seen as edges, and data flows may give direction to these edges. We show examples of geometric mobile data and their potential representations in Fig. 8.3. At the top of the figure a group of mobile users is represented as a point cloud. Likewise, mobile network entities (e.g. base station, gateway, users) are regarded as graphs below, following the rationale explained below. Due to the inherent complexity of such representations, traditional ML tools usually struggle to interpret geometric data and make reliable inferences.
In contrast, a variety of deep learning toolboxes for modeling geometric data exist, albeit not having been widely employed in mobile networking yet. For instance, PointNet [353] and the follow on PointNet++ [38] are the first solutions that employ deep learning for 3D point cloud applications, including classification and segmentation [354]. We recognize that similar ideas can be applied to geometric mobile data  analysis, such as clustering of mobile users or base stations, or user trajectory predictions. Further, deep learning for graphical data analysis is also evolving rapidly [355].
This is triggered by research on Graph CNNs [39], which brings convolution concepts to graph-structured data. The applicability of Graph CNNs can be further extend to the temporal domain [356]. One possible application is the prediction of future traffic demand at individual base station level. We expect that such novel architectures will play an increasingly important role in network graph analysis and applications such as anomaly detection over a mobile network graph.

Deep Unsupervised Learning in Mobile Networks
We observe that current deep learning practices in mobile networks largely employ supervised learning and reinforcement learning. However, as mobile networks generate considerable amounts of unlabeled data every day, data labeling is costly and requires domain-specific knowledge. To facilitate the analysis of raw mobile network data, unsupervised learning becomes essential in extracting insights from unlabeled data [357], so as to optimize the mobile network functionality to improve QoE.
The potential of a range of unsupervised deep learning tools including AE, RBM and GAN remains to be further explored. In general, these models require light feature engineering and are thus promising for learning from heterogeneous and unstruc-tured mobile data. For instance, deep AEs work well for unsupervised anomaly detection [358]. Though less popular, RBMs can perform layer-wise unsupervised pretraining, which can accelerate the overall model training process. GANs are good at imitating data distributions, thus could be employed to mimic real mobile network environments. Recent research reveals that GANs can even protect communications by crafting custom cryptography to avoid eavesdropping [359]. All these tools require further research to fulfill their full potentials in the mobile networking domain.

Deep Reinforcement Learning for Mobile Network Control
Many mobile network control problems have been solved by constrained optimization, dynamic programming and game theory approaches. Unfortunately, these methods either make strong assumptions about the objective functions (e.g. function convexity) or data distribution (e.g. Gaussian or Poisson distributed), or suffer from high time and space complexity. As mobile networks become increasingly complex, such assumptions sometimes turn unrealistic. The objective functions are further affected by their increasingly large sets of variables, that pose severe computational and memory challenges to existing mathematical approaches.
In contrast, deep reinforcement learning (DRL) does not make strong assumptions about the target system. It employs function approximation, which explicitly addresses the problem of large state-action spaces, enabling reinforcement learning to scale to network control problems that were previously considered hard. Inspired by remarkable achievements in Atari [23] and Go [360] games, a number of researchers begin to explore DRL to solve complex network control problems. However, these works only scratch the surface and the potential of DRL to tackle mobile network control problems remains largely unexplored. We recognize several potential of employing DRL to address problems in the mobile networking domain. Specifically, DRL allows network entities to learn knowledge over complex and high-dimensional mobile network environments, which enables network controllers to deliver superior performance without complete and accurate network information. In addition, DRL can make instant decisions with modern computing machines, which is essential for reducing network latency.
There have already been many encouraging DRL applications in the networking domain. For instance, as DeepMind trains a DRL agent to reduce Google's data centers cooling bill, 1 DRL could be exploited to extract rich features from cellular networks and enable intelligent on/off base stations switching, to reduce the infrastructure's energy footprint. In addition, such exciting applications make us believe that advances in DRL that are yet to appear can revolutionize the autonomous control of future mobile networks, and we will further explore this area in the future.

Conclusions
This thesis address several problems in the mobile networking domain using deep learning. We surveyed research at the intersection between deep learning and mobile networking domains. We then presented two deep learning frameworks, i.e., STN and CloudLSTM tailored to the precise city-scale mobile traffic forecasting with different data structures (i.e., city grid and geospatial point cloud). We introduced the MTSR technique, which enables to reduce mobile traffic data post-processing overhead by inferring fine-grained mobile traffic distribution from its coarse-grained counterparts using a novel GAN based architecture. Subsequently, a MTD technique was proposed to infer the city-scale service-wise mobile traffic consumption from aggregates, thus reducing the cost and privacy concerns raised by traditional deep packet inspection.
We then studied the vulnerability of deep anomaly detectors against black-box adversarial attacks, and propose three defense mechanisms to minimize the risks of this type of threats.
Overall, we believe this thesis not only represents a pioneering step towards building deep neural intelligence to automate the analytics and management of mobile networks, but also can be used as an valuable handbook for those who intend to further explore this territory.