## 2 AI Techniques in Communication Networks
### Machine Learning and Deep Learning in Network Applications
#### 2.1.2 Unsupervised Learning  
Unsupervised learning models are employed when the data do not have labeled outputs, making them ideal for anomaly detection and clustering tasks [39]. These models work by finding hidden patterns or relationships within the data, which is crucial when labeled data are unavailable. Unsupervised learning techniques are particularly \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Model** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1-Score (\%)** & **Computational Efficiency** \\ \hline CNN & 99 & 98 & 97 & 98 & High \\ \hline Decision Tree & 93 & 88 & 85 & 86 & Moderate \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Performance benchmark of CNN and decision tree models in network intrusion detection [32; 37; 38]. valuable in network security because they allow for the identification of previously unknown threats or novel attack patterns, which can be missed by traditional signature-based detection methods. Some of the most common unsupervised learning techniques used in network traffic analysis include clustering algorithms, dimensionality reduction, and autoencoders. Clustering algorithms like K-means [40] and hierarchical clustering group similar behaviors or data points together, helping network administrators detect unusual traffic patterns that may indicate an intrusion or misuse of network resources. Dimensionality reduction techniques, such as Principal Component Analysis (PCA) [41], are used to reduce the complexity of high-dimensional datasets while retaining the most important variance features. Autoencoders, a type of neural network, learn a compressed representation of the data and can identify anomalies based on reconstruction errors. Clustering algorithms like K-means are widely used in network traffic analysis to group similar behaviors or data points together [40]. For instance, K-means can cluster network traffic based on patterns of data flow, helping network administrators detect unusual traffic patterns that might indicate an intrusion or network misuse [42]. K-means operates by iteratively assigning data points to one of K clusters based on feature similarity, allowing for the detection of deviations from typical traffic patterns, which could signify a potential threat [43]. Dimensionality reduction techniques, such as PCA, are also employed to reduce the number of variables under consideration in network datasets [44]. PCA transforms the data into a lower-dimensional space while retaining the most important variance features. In network applications, PCA is used to simplify complex datasets, making it easier to identify anomalies in high-dimensional network traffic data [44]. This dimensionality reduction can help accelerate anomaly detection processes by focusing on the most relevant features without losing significant information [45]. Another unsupervised learning model gaining attention in network security is the use of Recurrent Neural Networks (RNNs) [46]. Since network traffic often exhibits temporal patterns and dependencies (especially in time-series data), RNNs, and their more advanced variants like Long Short-Term Memory (LSTM) networks, are highly effective in capturing sequential data patterns. RNNs are capable of learning and detecting anomalies in network traffic by considering the historical behavior of traffic over time. They are particularly useful in detecting attacks like DDoS, where traffic patterns show temporal correlations that evolve dynamically. Recently, Transformer networks, originally designed for natural language processing tasks, have emerged as a powerful tool in network traffic analysis [47]. Transformers use self-attention mechanisms to process entire sequences of data in parallel, enabling them to capture long-range dependencies efficiently. In network traffic analysis, Transformer models have shown promise in anomaly detection tasks due to their ability to handle large-scale datasets with complex, sequential behavior patterns.