The automatic classification of applications and services is an invaluable feature for new generation mobile networks. Here, we propose and validate algorithms to perform this task, at runtime, from the raw physical control channel of an operative mobile network, without having to decode and/or decrypt the transmitted flows. Towards this, we decode Downlink Control Information (DCI) messages carried within the LTE Physical Downlink Control CHannel (PDCCH). DCI messages are sent by the radio cell in clear text and, in this paper, are utilized to classify the applications and services executed at the connected mobile terminals. Two datasets are collected  through a large measurement campaign: one labeled, used to train the classification algorithms, and one unlabeled, collected from four radio cells in the metropolitan area of Barcelona, in Spain. Among other approaches, our Convolutional Neural Network (CNN) classifier provides the highest classification accuracy of 98%. The CNN classifier is then augmented with the capability of rejecting sessions whose patterns do not conform to those learned during the training phase, and is subsequently utilized to attain a fine grained decomposition of the traffic for the four monitored radio cells, in an online and unsupervised fashion.

Mobile traffic classification and prediction are key tasks for network optimization. Most of the works in this area present two main drawbacks. First, they treat the two tasks separately, thus requiring high computational capabilities. Second, they perform data mining on the information collected from the data plane, which is unsuitable for the mobile edge. To bridge this gap, this paper properly tailors a Multi-Task Learning model running directly at the edge of the network to anticipate  information on the type of traffic to be served and the resource allocation pattern requested by each service during its execution. Our study exploits data mining from the control channel of an operative mobile network to also reduce storage and monitoring processing. Different configurations of neural networks, which adopt autoencoders (i.e. Undercomplete Autoencoder or Sequence to Sequence Autoencoder) as key building blocks of the proposed Multi-Task Learning methodology for common feature representations, are investigated to evaluate the impact of the observation window of traffic profiles on the classification accuracy, prediction loss, complexity, and convergence. The comparison with respect to conventional single-task learning approaches, that do not use autoencoders and tackle classification and prediction tasks separately, clearly demonstrates the effectiveness of the proposed Multi-Task Learning approach under different system configurations.

Among the smart capabilities promised by the next generation cellular networks (5G and beyond), it is fundamental that potential network anomalies are detected and timely treated to avoid critical issues concerning network performance, security, public safety. In this paper, we propose a comprehensive framework for detecting network anomalies using mobile traffic data: collecting data from the LTE Physical Downlink Control Channel (PDCCH) of different eNodeBs, we implement deep learning algorithms in a semi-supervised way to detect potential traffic anomalies that are generated, for example, by unexpected crowd gathering. With respect to other types of mobile dataset, using LTE PDCCH information, we are able to obtain fine-grained and high-resolution data for the users that are connected to the LTE eNodeB. Through a semi-supervised approach, algorithms are trained to detect anomalies using only one class of traffic samples.We design two algorithms based on stacked-LSTM Neural Networks: 1) LSTM Autoencoder (LSTM-AE),in which the objective is to reconstruct the traffic samples 2) LSTM traffic predictor (LSTM-PRED), where the goal is to predict the traffic in the next time-instants, based on historical data. In both cases, we  analyzethe reconstruction (or prediction) error to assess if the mobile traffic presents anomalies or not. Using theF1-score as metric, we demonstrate that the proposed methods are able to identify the anomalous traffic periods, beating a benchmark that comprises different state-of-the-art algorithms for anomaly detection.

The analysis of real mobile traffic traces is helpful to understand usage patterns of cellular networks. In particular, mobile data may be used for network optimization and management in terms of radio resources, network planning, energy saving, for instance. However, real network data from the operators is often difficult to be accessed, due to legal and privacy issues. In this paper, we overcome the lack of network information using a LTE sniffer capable of decoding the unencrypted LTE control channel and we present a temporal and spatial analysis of the recorded traces. Moreover, we present a methodology to derive a stochastic characterization for the daily variation of the LTE traffic. We compare our results to the traffic model proposed in the FP7 EARTH project and we show that, with a limited number of states, our model presents a high level of accuracy in terms of first and second order statistics.