Measurement-based network monitoring and inference: scalability and missing information

Using measurements collected at network monitors to infer network conditions is a promising approach for network-centric monitoring. In this context, an important question arises: given the number and locations of network monitors, how much network management resources (e.g., the number of measurements) are needed to obtain an accurate estimate of network states? We define the scalability of measurement-based network monitoring as the growth rate of the number of measurements required for accurate network monitoring/inference with respect to the size of a network. We develop a framework for investigating the scalability in the context of multicast inference with the monitors at the edges of a network. In such a framework, network monitoring/inference can be formulated as probability density estimation of network states. The growth rate is characterized through the sample complexity, which is the number of measurements needed to accurately estimate the density. The missing data framework is introduced to estimate the growth rate, where the missing data reflect unavailable measurements at the unobservable nodes without resident monitors, and the underlying nodal packet losses. We show that when the missing information is mainly due to the number of unobservable nodes, the number of measurements needed grows linearly with the size of the network, and the measurement-based inference approach is, thus, scalable. When the missing information is mainly due to the underlying nodal packet losses, the number of measurements needed grows faster than linear with the size of the network, and the measurement-based inference approach is, thus, not scalable. Our results provide guidelines for accessing feasibility of the measurement-based inference approach, and the number of probes required. We give numerical examples to illustrate some of our results.

[1]  Andrew R. Barron,et al.  Minimum complexity density estimation , 1991, IEEE Trans. Inf. Theory.

[2]  B. Yu,et al.  Time-varying network tomography: router link data , 2000, 2000 IEEE International Symposium on Information Theory (Cat. No.00CH37060).

[3]  Nicole A. Lazar,et al.  Statistical Analysis With Missing Data , 2003, Technometrics.

[4]  Chuanhai Liu,et al.  Broadcast audience estimation , 2000, Proceedings IEEE INFOCOM 2000. Conference on Computer Communications. Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies (Cat. No.00CH37064).

[5]  K. G. Ramakrishnan,et al.  ATM network design and optimization: a multirate loss network framework , 1996, Proceedings of IEEE INFOCOM '96. Conference on Computer Communications.

[6]  D. Rubin,et al.  Parameter expansion to accelerate EM : The PX-EM algorithm , 1997 .

[7]  Marina Thottan,et al.  Proactive anomaly detection using distributed intelligent agents , 1998, IEEE Netw..

[8]  Yechiam Yemini,et al.  Managing Communication Networks by Monitoring Databases , 1991, IEEE Trans. Software Eng..

[9]  C. Ji,et al.  Measurement-based network monitoring: missing data formulation and scalability analysis , 2000, 2000 IEEE International Symposium on Information Theory (Cat. No.00CH37060).

[10]  Cheng Jin,et al.  MATE: MPLS adaptive traffic engineering , 2001, Proceedings IEEE INFOCOM 2001. Conference on Computer Communications. Twentieth Annual Joint Conference of the IEEE Computer and Communications Society (Cat. No.01CH37213).

[11]  Muriel Médard,et al.  Attack Detection Methods for All-Optical Networks , 1998, NDSS.

[12]  Y. Vardi,et al.  Network Tomography: Estimating Source-Destination Traffic Intensities from Link Data , 1996 .

[13]  Donald F. Towsley,et al.  Multicast-based loss inference with missing data , 2002, IEEE J. Sel. Areas Commun..

[14]  D. Rubin,et al.  Maximum likelihood from incomplete data via the EM - algorithm plus discussions on the paper , 1977 .

[15]  Donald F. Towsley,et al.  Multicast-based inference of network-internal loss characteristics , 1999, IEEE Trans. Inf. Theory.

[16]  Robert Nowak,et al.  Internet tomography , 2002, IEEE Signal Process. Mag..