Towards the Automatic and Schedule-Aware Alerting of Internetwork Time Series

Abstract

A common factor of every network monitoring system is an alerting module for time series. This module aims at triggering a warning when any type of abnormal behavior is detected in the patterns of a time series. Such a search for anomalies can be carried out by network managers as a supervised task such that the thresholds for considering a measurement as an anomaly are set following a manual process. Alternatively, we focus on how to translate such a task to an unsupervised one, thus alleviating network managers' dedication. To this end, we have developed, based on the experience of monitoring dozens of networks, a player of real anomalies. Thus, by recreating real issues, the alerting systems' parametrization can be carried out without supervision. Additionally, as a novelty, we propose to consider the network managers' workforce as a significant parameter to configure the thresholds of the alerting moduleessentially, avoiding triggering alarms that will hardly receive attention. Then, we propose to measure and rank alarms by relevance, and relate them to the time to be solved for constructing, eventually, automatic schedules for the members of the staff-according to their time availability. Finally, all these proposals have been put into practice in various deployments of monitoring systems on networks in operation, which gives us evidence of its usefulness and low demand for resources.

Workforce capacity planning for proactive troubleshooting in the Network Operations Center

“…While the above approaches have proven relevant for changes at short timescales [31][32][33][34], such as flash crowds or Denial of Service (DoS) attacks (where changes in load or the number of connections occur in a few seconds or minutes) or useful when a network component goes down (a router whose latency and number of retransmissions peak [35] immediately), we note that they are not able to detect progressive changes. That is, changes that do not occur suddenly, whose impact is not going to be in the range of some seconds or minutes, and that are maintained over time.…”