Localization of Single Link-Level Network Anomalies

Abstract

International audienceAchieving accurate, cost-efficient, and fast anomaly localization is a highly desired feature in computer networks. Prior works, examining the problem of single link-level anomaly localization, have shown that resources that enable the monitoring of a set of paths distinguishing between all links of the network pairwise must be deployed for unambiguous anomaly localization. In this paper, we show that the number of pair of links that are to be distinguished can be cut down drastically using an already established anomaly detection solution. This results in reducing the localization overhead and cost significantly. Furthermore, we show that all potential anomaly scenarios can be derived offline from the anomaly detection solution. Therefore, we compute full localization solutions, i.e. monitors that are to be activated and paths that are to be monitored, for all potential anomaly scenarios offline. This results in a significant minimization of localization delay. We devise an anomaly localization technique that selects monitor locations and monitoring paths jointly; thereby enabling a trade-off between the number and locations of monitoring devices and the quality of monitoring paths. The problem is formulated as an integer linear program (ILP), and is shown to be N P-hard through a polynomial-time reduction from the NP-hard facility location problem. The effectiveness and the correctness of the proposed anomaly localization scheme are verified through theoretical analysis and extensive simulations

Probe generation for active probing

“…Another problem associated with the use of active probing approaches for monitoring a network is the placement of probing stations in the network. Heuristic‐based approaches are described in Natu and Sethi, Patil et al, and Salhi et al, which attempt to incrementally select nodes that provide suitable locations for instantiating probing stations. The selection is based on the number of independent paths available from the probing stations to a node.…”

“…A trade‐off exists between these costs as a higher number of probing stations allow a selection of fewer and/or shorter length probes. A few techniques have been proposed to select probing stations and probes, where the goal is to minimize the probing costs, yet provide a wide coverage to locate faults anywhere in the network …”

“…A few techniques have been proposed to select probing stations and probes, where the goal is to minimize the probing costs, yet provide a wide coverage to locate faults anywhere in the network. [21][22][23] The architectures proposed for active probing solutions in Brodie et al, 1 Rish et al, 3 and Natu and Sethi 11 follow the same basic steps, and the steps are outlined in Figure 1. The first step is probe generation, in which a set of probes, called the candidate probe set (CPS), is generated using the network topology and the locations of probing stations in the network.…”