Results 1  10
of
39
Communicationefficient online detection of networkwide anomalies
 In IEEE Conference on Computer Communications (INFOCOM
, 2007
"... Abstract—There has been growing interest in building largescale distributed monitoring systems for sensor, enterprise, and ISP networks. Recent work has proposed using Principal Component Analysis (PCA) over global traffic matrix statistics to effectively isolate networkwide anomalies. To allow suc ..."
Abstract

Cited by 50 (10 self)
 Add to MetaCart
(Show Context)
Abstract—There has been growing interest in building largescale distributed monitoring systems for sensor, enterprise, and ISP networks. Recent work has proposed using Principal Component Analysis (PCA) over global traffic matrix statistics to effectively isolate networkwide anomalies. To allow such a PCAbased anomaly detection scheme to scale, we propose a novel approximation scheme that dramatically reduces the burden on the production network. Our scheme avoids the expensive step of centralizing all the data by performing intelligent filtering at the distributed monitors. This filtering reduces monitoring bandwidth overheads, but can result in the anomaly detector making incorrect decisions based on a perturbed view of the global data set. We employ stochastic matrix perturbation theory to bound such errors. Our algorithm selects the filtering parameters at local monitors such that the errors made by the detector are guaranteed to lie below a userspecified upper bound. Our algorithm thus allows network operators to explicitly balance the tradeoff between detection accuracy and the amount of data communicated over the network. In addition, our approach enables realtime detection because we exploit continuous monitoring at the distributed monitors. Experiments with traffic data from Abilene backbone network demonstrate that our methods yield significant communication benefits while simultaneously achieving high detection accuracy. I.
Network Topologies: Inference, Modelling and Generation
 IEEE COMMUNICATIONS SURVEYS & TUTORIALS
"... Accurate measurement, inference and modelling techniques are fundamental to Internet topology research. Spatial analysis of the Internet is needed to develop network planning, optimal routing algorithms and failure detection measures. A first step towards achieving such goals is the availability of ..."
Abstract

Cited by 39 (11 self)
 Add to MetaCart
Accurate measurement, inference and modelling techniques are fundamental to Internet topology research. Spatial analysis of the Internet is needed to develop network planning, optimal routing algorithms and failure detection measures. A first step towards achieving such goals is the availability of network topologies at different levels of granularity, facilitating realistic simulations of new Internet systems. The main objective of this survey is to familiarize the reader with research on network topology over the past decade. We study techniques for inference, modelling and generation of the Internet topology at both router and administrative level. We also compare the mathematical models assigned to various topologies and the generation tools based on them. We conclude with a look at emerging areas of research and potential future research directions.
Simplifying the synthesis of Internet traffic matrices
, 2005
"... A recent paper [8] presented methods for several steps along the road to synthesis of realistic traffic matrices. Such synthesis is needed because traffic matrices are a crucial input for testing many new networking algorithms, but traffic matrices themselves are generally kept secret by providers. ..."
Abstract

Cited by 38 (11 self)
 Add to MetaCart
A recent paper [8] presented methods for several steps along the road to synthesis of realistic traffic matrices. Such synthesis is needed because traffic matrices are a crucial input for testing many new networking algorithms, but traffic matrices themselves are generally kept secret by providers. Furthermore, even given traffic matrices from a real network, it is difficult to realistically adjust these to generate a range of scenarios (for instance for different network sizes). This note is concerned with the first step presented in [8]: generation of a matrix with similar statistics to that of a real traffic matrix. The method applied in [8] is based on fitting a large number of distributions, and finding that the lognormal distribution appears to fit most consistently. Best fits (without some intuitive explanation for the fit) are fraught with problems. How general are the results? How do the distribution parameters relate? This note presents a simpler approach based on a gravity model. Its simplicity provides us with a better understanding of the origins of the results of [8], and this insight is useful, particularly because it allows one to adapt the synthesis process to different scenarios in a more intuitive manner. Additionally, [8] measures the quality of its fit to the distribution's body. This note shows that the tails of the distributions are less heavy than the lognormal distribution (a counterintuitive result for Internet traffic), and that the gravity model replicates these tails more accurately.
An independentconnection model for traffic matrices
 Proc. of the ACM SIGCOMM Internet Measurement Conf. (IMC). Rio de Janeriro
, 2006
"... Abstract A common assumption made in traffic matrix (TM) modeling and estimation is independence of a packet'snetwork ingress and egress. We argue that in real IP networks, this assumption should not and does not ..."
Abstract

Cited by 27 (2 self)
 Add to MetaCart
(Show Context)
Abstract A common assumption made in traffic matrix (TM) modeling and estimation is independence of a packet'snetwork ingress and egress. We argue that in real IP networks, this assumption should not and does not
The many facets of Internet topology and traffic
 Networks and Heterogeneous Media
"... ABSTRACT. The Internet’s layered architecture and organizational structure give rise to a number of different topologies, with the lower layers defining more physical and the higher layers more virtual/logical types of connectivity structures. These structures are very different, and successful Inte ..."
Abstract

Cited by 24 (12 self)
 Add to MetaCart
(Show Context)
ABSTRACT. The Internet’s layered architecture and organizational structure give rise to a number of different topologies, with the lower layers defining more physical and the higher layers more virtual/logical types of connectivity structures. These structures are very different, and successful Internet topology modeling requires annotating the nodes and edges of the corresponding graphs with information that reflects their networkintrinsic meaning. These structures also give rise to different representations of the traffic that traverses the heterogeneous Internet, and a traffic matrix is a compact and succinct description of the traffic exchanges between the nodes in a given connectivity structure. In this paper, we summarize recent advances in Internet research related to (i) inferring and modeling the routerlevel topologies of individual service providers (i.e., the physical connectivity structure of an ISP, where nodes are routers/switches and links represent physical connections), (ii) estimating the intraAS traffic matrix when the AS’s routerlevel topology and routing configuration are known, (iii) inferring and modeling the Internet’s ASlevel topology, and (iv) estimating the interAS traffic matrix. We will also discuss recent work on Internet connectivity structures that arise at the higher layers in the TCP/IP protocol stack and are more virtual and dynamic; e.g., overlay networks like the WWW graph, where nodes are web pages and edges represent existing hyperlinks, or P2P networks like Gnutella, where nodes represent peers and two peers are connected if they have an active network connection. 1. Introduction. The
Relaxed Multiple Routing Configurations: IP Fast Reroute for Single and Correlated Failures
"... Multitopology routing is an increasingly popular IP network management concept that allows transport of different traffic types over disjoint network paths. The concept is of particular interest for implementation of IP fast reroute (IP FRR). First, it can support guaranteed, instantaneous recovery ..."
Abstract

Cited by 15 (1 self)
 Add to MetaCart
(Show Context)
Multitopology routing is an increasingly popular IP network management concept that allows transport of different traffic types over disjoint network paths. The concept is of particular interest for implementation of IP fast reroute (IP FRR). First, it can support guaranteed, instantaneous recovery from any single link or node failure as well as from many combined failures. Second, different failures result in routing over different network topologies, which gives better control of the traffic distribution in the networks after a failure. The authors have previously proposed an IP FRR scheme based on multitopology routing called Multiple Routing Configurations (MRC). In this paper we present two contributions. First we define an enhanced IP FRR scheme which we call ”relaxed MRC” (rMRC). Through experiments we demonstrate that rMRC is an improvement over MRC in all important aspects. Resource utilization in the presence of failures is significantly better, both in terms of paths lengths and in terms of load distribution between the links. The requirement to internal state in the routers is reduced as rMRC requires fewer backup topologies to provide the same degree of protection. In addition to this, the preprocessing needed to generate the backup topologies is simplified. The second contribution is an extension of rMRC that can provide fast reroute in the presence of multiple correlated failures. Our evaluations demonstrate only a small penalty in path lengths and in the number of backup topologies required.
A toolchain for simplifying network simulation setup
 In Proceedings of SIMUTOOLS
, 2013
"... Arguably, one of the most cumbersome tasks required to run a network simulation is the setup of a complete simulation scenario and its implementation in the target simulator. This process includes selecting a topology, provision it with all required parameters and, finally, configure traffic sources ..."
Abstract

Cited by 8 (3 self)
 Add to MetaCart
(Show Context)
Arguably, one of the most cumbersome tasks required to run a network simulation is the setup of a complete simulation scenario and its implementation in the target simulator. This process includes selecting a topology, provision it with all required parameters and, finally, configure traffic sources or generate traffic matrices. Many tools exist to address some of these tasks. However, most of them do not provide methods for configuring network and traffic parameters, while others only support a specific simulator. As a consequence, a user often needs to implement the desired features personally, which is both timeconsuming and errorprone. To address these issues, we present the Fast Network Simulation Setup (FNSS) toolchain. It provides capabilities for parsing topologies from datasets or generating them synthetically, assign desired configuration parameters and generate traffic matrices or event schedules. It also provides APIs for a number of programming languages and network simulators to easily deploy the simulation scenario in the target simulator.
Optimal monitoring in large networks by successive coptimal designs
 in Teletraffic Congress (ITC), 2010 22nd International
, 2010
"... Abstract—We address the problem of optimizing the use of Network monitoring tools, such as Netflow, on a large IP network. We formulate a convex optimization problem which allows one to handle, in a unified framework, the combinatorial problem of selecting the “best ” set of interfaces on which Netf ..."
Abstract

Cited by 6 (4 self)
 Add to MetaCart
(Show Context)
Abstract—We address the problem of optimizing the use of Network monitoring tools, such as Netflow, on a large IP network. We formulate a convex optimization problem which allows one to handle, in a unified framework, the combinatorial problem of selecting the “best ” set of interfaces on which Netflow should be activated, and the problem of finding the optimal sampling rates of the networkmonitoring tool on these interfaces, when the aim is to infer the traffic on each internal OriginDestination (OD) pair. We develop a new method, called “Successive coptimal Design”, which is much faster than the classical ones. It reduces to solving a stochastic sequence of Second Order Cone Programs. We give experimental results relying on real data from a commercial network, which show that our approach can be used to solve instances that were previously intractable, and we compare our method with previously proposed ones. A. Background I.
Graceful Network Operations
"... Abstract—A significant fraction of network events (such as topology or route changes) and the resulting performance degradation stem from premeditated network management and operational tasks. This paper introduces a general class of Graceful Network Operation (GNO) problems, where the goal is to di ..."
Abstract

Cited by 6 (0 self)
 Add to MetaCart
(Show Context)
Abstract—A significant fraction of network events (such as topology or route changes) and the resulting performance degradation stem from premeditated network management and operational tasks. This paper introduces a general class of Graceful Network Operation (GNO) problems, where the goal is to discover the optimal sequence of operations that progressively transition the network from its initial to a desired final state while minimizing the overall performance disruption. We investigate two specific GNO problems: (a) Link Weight Reassignment Scheduling (LWRS) studies the optimal ordering of link weight updates to migrate from an existing to a new link weight assignment, and (b) Link Maintenance Scheduling (LMS) looks at how to schedule link deactivations and subsequent reactivations for maintenance purposes. LWRS and LMS are both combinatorial optimization problems. We use dynamic programming to find the optimal solutions when the problem size is small, and leverage Ants Colony Optimization to get nearoptimal solutions for large problem sizes. Our simulation study reveals that judiciously ordering network operations can achieve significant performance gains. Our GNO solution framework is generic and applies to similar problems with different operational contexts, underlying network protocols or mechanisms, and performance metrics. I.
Balancing performance, robustness and flexibility in routing systems
 In CONEXT
, 2008
"... Modern networks face the daunting task of handling increasingly diverse traffic that is displaying a growing intolerance to disruptions. This has given rise to many initiatives, and in this paper we focus on multiple topology routing as the primary vehicle for meeting those demands. Specifically, we ..."
Abstract

Cited by 5 (0 self)
 Add to MetaCart
(Show Context)
Modern networks face the daunting task of handling increasingly diverse traffic that is displaying a growing intolerance to disruptions. This has given rise to many initiatives, and in this paper we focus on multiple topology routing as the primary vehicle for meeting those demands. Specifically, we seek routing solutions capable of not just accommodating different performance goals, but also preserving them in the presence of disruptions. The main challenge is computational, i.e., to identify among the enormous number of possible routing solutions the one that yields the best compromise between performance and robustness. This is where our principal contribution lies, as we expand the definition of critical links – a key concept in improving the efficiency of routing computation – and develop a precise methodology to efficiently converge on those solutions. Using this new methodology, we demonstrate that one can compute routing solutions that are both flexible in accommodating different performance requirements and robust in maintaining them in the presence of failures and traffic fluctuations. 1.