Search

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2010.01.013 Byline: P. Casas (a)(c), S. Vaton (a), L. Fillatre (b), I. Nikiforov (b) Keywords: Network Monitoring and Traffic Analysis; Traffic Matrix; Network Traffic Modeling; Optimal Volume Anomaly Detection and Isolation Abstract: Recent studies from major network technology vendors forecast the advent of the Exabyte era, a massive increase in network traffic driven by high-definition video and high-speed access technology penetration. One of the most formidable difficulties that this forthcoming scenario poses for the Internet is congestion problems due to traffic volume anomalies at the core network. In the light of this challenging near future, we develop in this work different network-wide anomaly detection and isolation algorithms to deal with volume anomalies in large-scale network traffic flows, using coarse-grained measurements as a practical constraint. These algorithms present well-established optimality properties in terms of false alarm and miss detection rate, or in terms of detection/isolation delay and false detection/isolation rate, a feature absent in previous works. This represents a paramount advantage with respect to current in-house methods, as it allows to generalize results independently of particular evaluations. The detection and isolation algorithms are based on a novel linear, parsimonious, and non-data-driven spatial model for a large-scale network traffic matrix. This model allows detecting and isolating anomalies in the Origin-Destination traffic flows from aggregated measurements, reducing the overhead and avoiding the challenges of direct flow measurement. Our proposals are analyzed and validated using real traffic and network topologies from three different large-scale IP backbone networks. Author Affiliation: (a) Telecom Bretagne, Brest, France (b) Universite de Technolgie de Troyes, Troyes, France (c) Universidad de la Republica, Montevideo, Uruguay Article History: Received 10 August 2009; Revised 13 January 2010; Accepted 23 January 2010 Article Note: (miscellaneous) Responsible Editor: A. Popescu

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2006.04.013 Byline: G. Carofiglio, M. Garetto, E. Leonardi, A. Tarello, M. Ajmone Marsan Keywords: Stochastic processes; Queueing theory; Simulation; IP networks; TCP mice; Fluid models Abstract: Fluid models of IP networks are based on a set of ordinary differential equations, that provide an abstract deterministic description of the average network dynamics. When IP networks operate close to saturation, fluid models were proved to provide reliable performance estimates. Instead, when the network load is well below saturation, standard fluid models lead to wrong performance predictions, since all buffers are forecasted to be always empty, so that the packet discard probability is predicted to be zero. These incorrect predictions are due to the fact that fluid models, being deterministic in nature, do not account for the random traffic variations that may induce temporary congestion of some network elements. In this paper we discuss three different approaches to describe random traffic variations in fluid models, considering randomness at both the flow and packet levels. With these approaches, fluid models allow reliable results to be obtained also in the case of IP networks that operate well below their saturation load. Numerical results are presented to prove the accuracy and the versatility of the proposed approaches, considering both stationary and non-stationary traffic regimes. Author Affiliation: Dipartimento di Elettronica, Politecnico di Torino, Italy Article History: Received 7 September 2005; Accepted 10 April 2006 Article Note: (miscellaneous) Responsible Editor: I. Matta