Operational Incident Records as Weak Supervisory Signals for Network Anomaly Detection in Resource-Constrained NRENs

Abstract

Resource-constrained National Research and Education Networks (NRENs), particularly those across South and Southeast Asia, face growing network security threats yet typically lack the labeled traffic datasets, dedicated security tooling, and staffing required by supervised anomaly detection methods. This paper proposes a weak-supervision framework for network anomaly detection that draws exclusively on operational incident records already accumulated during routine Network Operation Center operations—abuse notifications, watchdog threshold alerts, perimeter security event logs, Internet routing anomaly reports, Peer-to-Peer copyright infringement notices, and email servers related aggregate reports. Grounded in operational experience at Lanka Education and Research Network, Sri Lanka’s NREN, this paper characterizes six incident-record categories and maps them to programmatic labeling functions for semi-supervised model training. The paper then outlines a three-stage pipeline covering record normalization, weak-label generation via a probabilistic label model, and anomaly detection using Isolation Forest, Autoencoders, and Long Short-Term Memory (LSTM) based sequence models. The paper also identifies key deployment considerations including label noise, temporal delay, class imbalance, and cross-NREN portability. The framework is designed to be directly transferable to other resource-constrained NRENs across the Asia-Pacific region facing similar labeled-data scarcity.