GPON PLOAMd Message Analysis Using Supervised Neural Networks

Abstract

This paper discusses the possibility of analyzing the orchestration protocol used in gigabit-capable passive optical networks (GPONs). Considering the fact that a GPON is defined by the International Telecommunication Union Telecommunication sector (ITU-T) as a set of recommendations, implementation across device vendors might exhibit few differences, which complicates analysis of such protocols. Therefore, machine learning techniques are used (e.g., neural networks) to evaluate differences in GPONs among various device vendors. As a result, this paper compares three neural network models based on different types of recurrent cells and discusses their suitability for such analysis.

1. Introduction

Customer requirements for provided services increase over time, which also increases requirements for provided bandwidth [1,2]. A modern solution to meet customer needs is the gigabit-capable passive optical network (GPON). Another modern solution is passive optical network (PON) technology [3,4,5,6,7,8,9,10,11,12]. The protocol used in these networks is defined by the International Telecommunication Union Telecommunication sector (ITU-T) as a set of recommendations, which allows device vendors to modify this protocol with little adjustment [13,14]. An analysis of such protocols requires advanced techniques because conventional (e.g., pushdown automata) methods are not sufficient for undocumented messages or message usages. Therefore, this paper investigates the possibility of GPON protocol analysis using machine learning algorithms.

A passive optical network exhibits a tree-like topology, where the root is the optical line terminal (OLT) located at the provider site and the leaves are optical network units (ONUs) or optical network terminals (ONTs) located at the customer sites. The distributional network between the OLT and ONUs/ONTs consists of fiber cables and passive optical components (e.g., splitters, splices, and connectors). The OLT provides organization and management for components of this network, especially for effective bandwidth allocation, transmit synchronization and others [15,16,17,18]. Passive optical components cause the data to be sent using broadcasting for downstream communication (from the root to leaves). Each communication participant must be correctly synchronized to avoid transmission collisions, which is achieved by forcing leaves to use the activation process when they want to join the network [19]. This process uses physical layer operations, administration and maintenance downstream (PLOAMd) messages located in the header of the downstream transmission frame.

The communication medium (optical fiber) and GPON maximal symmetrical transmission speed of 2.48832 Gbps make the data capture process challenging. The downstream data are mirrored using an optical splitter into a network probe consisting of a hardware accelerated signal decoder [20]. The captured data are sent to a message database, which is the source for the learning data used in this paper.

The main contribution of this paper is a comparison of three different types of recurrent neural network layer used for the analysis of PLOAMd message sequences using supervised machine learning methods. All of these layer types are tested in the exactly the same network architecture to achieve reasonable performance comparison. All of the models share the same optimizer and objective function. The only difference is recurrent layer type. The tested models should be able to recognize patterns in communication sequences and decide whether the communication satisfies the GPON standard. Thus, the models classify input sequence into two categories: a correct class representing communication according to the GPON recommendation and a faulty class representing a violation of GPON recommendation. Exemplary GPON communication is captured in a real GPON network in a laboratory environment. This communication is considered as suitable for the GPON standard and is used as the source of learning data. A non-standard communication sequences are generated by custom corrupting function, which add/drop/modify messages in the captured sequences. The output of this paper is comparison of various recurrent layers and recommended recurrent layer for protocol analysis capable of learning patterns in message sequences.

The rest of this paper is structured as follows. Section 2 introduces related works. The learning data generation process and its final data shape are described in Section 3. Section 4 introduces the model design based on long short-term memory (LSTM) cells and evaluates its detection capabilities (accuracy). Finally, Section 5 concludes this paper.

2. Related Work

The GPON protocol is a following protocol, which replaces old technologies providing services such as internet connectivity, cable television (CATV), and others. Passive optical networks are still under research and development, and, hence, experiments and protocol upgrades are being conducted [21]. The newest version of this protocol family is next-generation passive optical network stage 2 (NG-PON2), which is capable of symmetrical 40 Gbps transfer owing to time and wavelength division multiplexing (TWDM) [22]. There is also an experimental study attempting to extend a long-range GPON with dense wavelength division multiplexing (DWDM) over 135 km [23]. The ITU-T also has a competitor in the PON standard, which is defined by the Institute of Electrical and Electronics Engineers (IEEE) as the Ethernet passive optical network (EPON), which uses standard Ethernet frames instead of frames based on asynchronous transfer mode (ATM) cells [24]. The newest research defines EPON standards with bitrates up to 100 Gbps [25,26].

Artificial intelligence (AI) and machine learning (ML) algorithms are used to solve various problems of current networks [27,28,29,30,31,32,33,34,35,36,37]. In a given location, the minimal GPON deployment cost is achieved by choosing optimal routing information, type of aggregating equipment and position of network elements. This is an NP-hard problem, and the optimal solution can be approximated using ant colony optimization (ACO) [38]. Traffic analysis using current methods (e.g., port-based and payload-based) shows various disadvantages, but the analysis using ML methods could be a potential replacement, even for encrypted data traffic [39,40]. ML may also help with parameter tuning for a GPON rule-based expert system used for the problem of root cause localization [41].

The authors of [42,43] presented an artificial intelligence modeling for future and intelligent elastic optical networks (EONs) as a review. We can also mention the article by Musumeci et al. [44], which provides a comprehensive study about machine learning for optical networks. Yi et al. [45] proposed the novel machine learning-based equalization algorithm for intensity modulation and direct detection PON (IM-DD PON) and extended the capacity of PON from 50 Gbps per $\lambda$ to 100 Gbps per $\lambda$ over 25 km standard single-mode fiber (SSMF). Further, Yi et al. [46] proposed using neural network (NN)-based equalizer to mitigate both the linear and nonlinear distortions in IM-DD 100 Gbps per $\lambda$ PON based on 20G-class optical and electrical devices.

Neural networks based on various types of recurrent layers help to solve difficult problems (e.g., speech recognition, natural language processing, sequence analysis, etc.). Therefore, researchers investigate performance differences of these recurrent layers in certain applications. Mangal et al. [47] evaluated the performance of a bidirectional a recurrent neural network (BiRNN), a gated recurrent unit (GRU), and a LSTM used for TV script generation. The results of this paper show the best performance of all tested layers has the LSTM layer. Similarly, Apaydin et al. [48] evaluated the performance of various recurrent layers for a reservoir flow forecast, and the LSTM cells show the most accurate predictions. On the other hand, Shewalkar et al. [49] evaluated various recurrent layers for speech recognition and proposes a GRU-based network as the best. The network has slightly worse accuracy compared to the LSTM-based network, but the number of parameters in the GRU is much lower making GRU layer preferable for speech recognition.

3. Data Characteristics

The training data are captured in the GPON laboratory environment. Frames are captured using a special field-programmable gate array (FPGA) card, correctly parsed, and stored in a database. A detailed explanation of this process is outside of the scope of this paper. This section describes the GPON downstream frame header in Section 3.1, the process of data preparation in Section 3.2, the data shape in Section 3.3), and the preparation of invalid data sequences needed for supervised learning in Section 3.4.

3.1. GPON Frame Header

The frame structure sent by the OLT consists of a physical control block downstream (PCBd) containing information for specific ONUs/ONTs and a GPON transmission container (GTC) payload carrying transferred data. The frame structure is shown in Figure 1. The most interesting part is the PLOAMd field, which is used during the ONU/ONT activation process. The other parts are irrelevant in this paper. The PLOAMd field is 13 bytes long and contains the following parts:

• ONU ID specifies the receiving ONU.
• Message ID defines the type of message.
• DATA are unique data for specific message.
• Cyclic redundancy check (CRC) is used to verify the correctness of field data.

3.2. Raw Data Preparation

The first step of the data analysis process is to count occurrences of each message type in the captured communication. Surprisingly, the most used message type is NoMessage₁₁, which creates 99.98% of captured traffic and does not contain any useful data. This type of message must be filtered out from the learning data to avoid false positive results. The number of occurrences for each message type is shown in

Table 1. Filtered PLOAMd message counts from captured data traffic.

Message ID	1	3	4	5	6	8	10	11	14	18	20	21	24
Count	82	88	114	94	54	286	86	545,934	93	103	63	54	1

.

The remaining data are processed using several procedures resulting in a sequence of PLOAMd messages. These procedures remove the useless parts of the frame header and expand PLOAMd data fields into a suitable form.

3.3. Data Shape

Each PLOAMd message is 13 bytes long, resulting in a learning vector of 13 elements (each field contains separate elements, and 10 bytes of the data fields are expanded). The header is shown in Figure 1. As mentioned above, the protocol analysis is inspired by natural language processing, which analyzes a sequence of words. In this scenario, words are replaced by vectors of 13 elements and shaped into a sequence of 30 vectors. The sequence length is empirically evaluated as the optimal length considering the ability to locate a possible non-defined sequence and to distinguish sequences. Final learning samples are generated by using a sliding time window over captured messages and returning sequences of correct shape (30 messages × 13 features).

3.4. Invalid Data Generation

Supervised learning algorithms require a balanced number of samples for each classification set. The model described by this paper classifies message sequences into a set that satisfies the GPON standard and a set that does not. The standard communication samples are generated using procedures described in the previous section. The non-standard sequence samples are generated using three procedures that knowingly corrupt standard sequences (the input of these procedures is the entire captured communication). The first corruption procedure changes values in random PLOAMd messages using Equation (1).

$$Valu{e}_{new}=(Valu{e}_{old}+128)mod255$$

(1)

The second procedure removes important message types from the activation process. The activation process consists of Messages 4, 8, 10, and 18, in this exact order (a more detailed explanation of these messages can be found in GPON recommendation [50]). The procedure runs for each message on a distinct instance of the captured dataset separately and deletes all occurrences of that message. The third procedure creates faulty messages by adding zero-mean Gaussian noise with standard deviation equal to 20 into the captured communication. The last procedure simulates modification of the GPON protocol by a device vendor. This procedure duplicates the important messages of activation process mentioned earlier. Each message is duplicated in a separate instance of the captured message list.

All of the mentioned procedures are applied on separate instances of a filtered PLOAMd message sequence. The sliding window used for sequence sample generation runs through the faulty sequences with stride equal to 4. As a result, the number of generated faulty samples is almost the same as the number of correct sequence samples.

4. PLOAMd Analysis Using Various Recurrent Neural Networks and Results Discussion

Considering the shape of the data samples, the suitable neural network for protocol analysis is based on recurrent neural networks (RNNs). They pass their internal state across the analyzing sequence [51]. RNNs are also able to analyze variably long sequence samples. RNN layers used in following experiments are: SimpleRNN, LSTM, and GRU. These are the most common RNNs, which have different tools for sequence analysis, and all of them are implemented by Keras application programming interface (API). A simple RNN might be insufficient for analysis of long sequences, and, therefore, this paper verifies various types of RNNs (e.g., LSTM and GRU). LSTM enhances an RNN with an internal memory capable of holding information in longer sequences and a gating mechanism suitable for input/output data manipulation [52]. GRU is similar to an LSTM cell, but less complex and with fewer gates resulting in fewer learning parameters [53].

All experimental models classify input message sequences into two classes. Thus, all models are binary classifiers. The first class represents a message sequence that keeps the rules of GPON protocol. The second class represents an abnormal or non-standard sequence. The final learned model is used for abnormal or faulty traffic identification in a real GPON network.

4.1. Model Design

A generic model architecture is necessary for the comparison of various RNN types, especially for an evaluation in the exactly the same use case. The first proposed model is based on a single RNN layer with 32 neurons and a single dense layer with 1 neuron. The model is not learning properly and cannot distinguish correct and faulty data samples, which leads to poor model accuracy. The second proposed model evolves from the first model by doubling the number of both layers and adding more neurons into the first dense layer in the row. This model has much better learning capabilities. Therefore, the second model architecture is chosen as a generic model for further comparison of all inspected RNN layer types. The generic model architecture used for all RNN types is shown in Listing 1. These models are learned using Adam [54] optimizer and binary cross entropy loss function.

Listing 1: Generation process of GPON analyzing models.

• from tensorflow.keras.layers import SimpleRNN, GRU, LSTM, Dense
• from tensroflow.keras import Sequential
• rnn_types = [SimpleRNN, GRU, LSTM]
• rnn_models = []
• for rnn in rnn_types:
• rnn_models.append(Sequential([
• rnn(32,input_shape=data[0].shape,
• return_sequences=True, activation=’tanh’),
• rnn(32, activation=’tanh’),
• Dense(64, activation=’relu’),
• Dense(1, activation=’sigmoid’)])
• )

4.2. Learning Process

The learning data preparation is described in Section 3. The dataset is shuffled with predefined constant seed to guarantee the same data order every time. Ten-fold cross-validation is used to evaluate performance of models correctly [55]. This process splits the dataset into ten equally big groups. Each group is used as the validation dataset for a separate instance of the inspected model, while the remaining groups are used as the learning dataset. Based on the training history of all models, the average and standard deviation are evaluated for each model metric.

The design model input is a three-dimensional array because it is a list of sequences. Each model is learned using the Adam optimizer and updated every 50 sequences (i.e., the batch size is set to 50). Based on the learning history, it is estimated whether the model is capable of pattern recognition. The learning process of each model takes 200 epochs (the number of epochs is high enough to evaluate the accuracy and the loss in a under-fitted, good fit, and over-fitted model) to check the loss and accuracy evolution over learning epochs and whether the learning and validation loss increase, decrease, or remain constant.

The model with RNN layers is able to recognize learning samples very well, but it presents a problem in learning generalized patterns in the sequences, as shown by the validation loss and validation accuracy in Figure 2. The validation accuracy slowly raises and after few epoch it remains stable at accuracy of 74%. A rapid drop in the learning loss indicates that the model memorizes the input without generalized patterns, thus the validation loss raises slightly over epochs.

The model with LSTM layers exhibits sufficient accuracy in distinguishing standard and non-standard/corrupted data sequences for both the learning and validation datasets, as shown in Figure 3. The LSTM layers are able to learn patterns in the communication and decide whether they meet the GPON standard. On the other hand, this model is the most complex among the tested models and requires the most resources to learn.

The last evaluated model is based on layers with GRU cells. Similar to LSTM, the model starts to be perfectly fitted after approximately 75 learning epochs. More interestingly, the model accuracy for the validation dataset is slightly higher compared to the LSTM model, as shown in Figure 4.

4.3. Evaluation of Models

All of the models learn to distinguish correct and faulty samples of the training dataset, which is clearly visible in average loss (the model loss represents output of objective function used during learning process) and average accuracy (the model accuracy represents number of correctly classified samples compared to all samples) evolution over learning epochs by blue solid line in Figure 2, Figure 3 and Figure 4. In the figures, there is also the standard deviation for the average values represented by transparent fill in the same color. All inspected models have similar performance according to model metrics based on training dataset. Considering the standard deviation, it is difficult to choose one as the best.

The quality of learned capabilities is evaluated by classifying the validation dataset, which is disjunctive to the learning dataset. The evolution of accuracy and loss over the epochs is visible by orange dotted line in Figure 2, Figure 3 and Figure 4. The model based on SimpleRNN layer finds patterns in the data much more slowly compared to LSTM- or GRU-based models. This behavior is expected due to RNN being the simplest recurrent architecture and having fewer controlling instruments. All SimpleRNN model metrics in validation dataset indicate that the model has the worst performance of the all inspected models.

The LSTM-based model has better accuracy and the other metrics compared to SimpleRNN. This model finds and learns correct characteristic patterns. However, this model has the largest number of arguments, thus it is resource demanding and the learning process take longer to proceed.

The GRU-based model complexity is in between LSTM and SimpleRNN layers, but the validation dataset accuracy and other metrics point out that this model is the best of the inspected models. It is able to find distinguishing patterns better than SimpleRNN- and LSTM-based models. The GRU-based model has fewer gates (and learning parameters as well) and the learning process takes less time, even though it has the best performance according to validation dataset metrics. The training results and a summary of all model metrics are shown in

Table 2. Recurrent models mean metrics with standard deviation.

		SimpleRNN	LSTM	GRU
Learning	loss	$0.04897\pm 0.00470$	$0.11183\pm 0.05380$	$0.06980\pm 0.01116$
	accuracy	$0.97088\pm 0.00318$	$0.95212\pm 0.01856$	$0.96655\pm 0.00392$
	recall	$0.97005\pm 0.00491$	$0.93242\pm 0.02067$	$0.95103\pm 0.00751$
	precision	$0.97176\pm 0.00380$	$0.97085\pm 0.01821$	$0.98162\pm 0.00295$
	auc	$0.99846\pm 0.00026$	$0.99060\pm 0.00957$	$0.99685\pm 0.00106$
Validation	loss	$1.11480\pm 0.41351$	$0.47466\pm 0.12479$	$0.43730\pm 0.12738$
	accuracy	$0.74893\pm 0.07493$	$0.85820\pm 0.02028$	$0.87654\pm 0.02105$
	recall	$0.70229\pm 0.09837$	$0.80995\pm 0.03961$	$0.84339\pm 0.04841$
	precision	$0.76943\pm 0.08938$	$0.89800\pm 0.03948$	$0.90251\pm 0.01986$
	auc	$0.80492\pm 0.08378$	$0.92984\pm 0.01851$	$0.93931\pm 0.01630$
Trainable parameters		5729	16,385	13,025

.

5. Conclusions

This paper evaluates various types of recurrent layers used for GPON protocol analysis. The learning data are captured in a fully functional GPON using a special FPGA card. The card captures whole frames, but analysis focuses only on PLOAMd messages; therefore, useless data are removed during the pre-processing phase. Almost all filtered data consist of messages with ID 11, which must be removed from the learning dataset. Otherwise, it causes false positive results. The remaining data are formatted into sequences of thirty messages using a sliding window, creating a learning dataset. Created sequences are used to evaluate the analysis performance of SimpleRNN-, LSTM-, and GRU-based models. The model comparison is based on validation dataset accuracy to reveal the pattern learning potential of each layer type.

SimpleRNN is insufficient for such analysis due to it simply memorizing data instead of learning generalized principles. A single state vector without gating mechanisms in RNN design makes this layer not suitable for such analysis. The model with LSTM cells has almost the best accuracy for the learning and validation datasets; however, it consumes the most resources among all inspected models (the highest number of learned parameters). The GRU-based model has the best results in validation dataset classification compared to SimpleRNN. The GRU cell contains gating mechanisms as well, but the number of gates is lower compared to the LSTM cell. Even with fewer gates, GRU is able to learn complex data patterns specific to protocol analysis.

Among all inspected models, only the model based on GRU cells is suitable for network protocol analysis. The investigated data contains complex relations and the GRU-based model is capable to learn these relations using its sophisticated gating mechanism. Considering the standard deviation, performance comparison results correlate with the similar comparisons in [47,48,49]. Therefore, GRU layer is recommended for protocol analysis, even if it has more learning parameters and takes more time to learn.

Future Work Opportunities

This paper is focused strictly on three types of recurrent cells with supervised learning, but ML offers much more. There are some possibilities for further research on protocol analysis using neural networks:

• Convolutional network: One possible enhancement is replacing the recurrent layer with a sequence of convolutional and max-pooling layers, which should reduce the complexity of the final neural network and speed up the learning and evaluating process.
• Unsupervised learning techniques: Another possible continuation of this work is to create a machine learning model and train it using unsupervised learning techniques. The problem with the supervised algorithms used in this paper is that the model needs samples of non-standard or corrupted communication, but these samples may not exist during the model learning process. The result of this project would be an anomaly detector capable of marking suspicious or non-standard communication sequences.