Joint optimization of monitor location and network anomaly detection

Abstract

Abstract-Achieving cost-effective systems for network performance monitoring has been the subject of many research works over the last few years. Most of them adopt a two-step approach. The first step assigns optimal locations to monitoring devices, whereas the second step selects a minimal set of paths to be monitored. However, such an approach does not consider the trade-off between the optimization objectives of each step, and hence may lead to sub-optimal usage of network resources and biased measurements. In this paper, we propose to evaluate and reduce this tradeoff. Toward this end, we come up with two ILP formulations for a novel monitoring cost model. The aim is to jointly minimize the monitor location cost and the anomaly detection cost, thereby obtaining a monitoring solution that minimizes the total monitoring cost. Our formulations apply for both active and passive monitoring architectures. We show that the problem is NP-hard by mapping it to the uncapacitated facility location problem. Simulation results illustrate the interplay between the optimization objectives and evaluate the quality of the obtained monitoring solution.

Heuristics for Joint Optimization of Monitor Location and Network Anomaly Detection

“…The aim of the evaluation is to investigate the efficiency of our heuristics. Namely, we 1) implemented the two proposed algorithms and compared the solutions they delivered in order to verify their scalability with respect to the network size, and the impact of the selective heuristics on the quality of the solutions; 2) compared the solutions delivered by the algorithms to the exact solutions delivered by the path-based ILP [1], in order to investigate the gap of the greedy solutions to the optimal; and also 3) relaxed the path-based ILP formulation to a linear program, solved the LP, performed a random rounding of the LP results and then took the results as an input for the exhaustive greedy algorithm. The LP results constitutes a good starting point for the greedy algorithm and reduces the number of candidate paths and candidate monitors, that is why we consider the use of the LP results in combination with the greedy algorithm.…”

“…The aim is to find largescale heuristics that achieve low-cost solutions and reduce the computation time. The two algorithms will be compared to each other, and to the exact solution of the problem formulated in [1], in order the assess their efficiency.…”

“…In this section, we describe two greedy algorithms inspired from the monitoring cost model introduced in [1]. The aim of the algorithms is to optimize jointly the cost of monitor location and the cost of network anomaly detection.…”

“…Indeed, reducing the number of monitoring devices and the number of monitoring flows results in monitoring long paths that are quite likely to overlap, which increases redundant measurements. Our previous work [1] illustrated this conflictual aspect through ILP formulations. We proposed a monitoring cost model that includes a monitor location cost and an anomaly detection cost.…”

“…In this paper, we further investigate these issues. Acknowledging the efficiency of the joint optimization model to balance the trade-off between the multiple minimization objectives [1], we keep on considering this technique to devise novel greedy algorithms. The aim is to come up with large-scale heuristics that apply for large networks and achieve good quality solutions.…”