The Network Link Outlier Factor (NLOF) for Fault Localization

We describe and experimentally evaluate the performance of our Network Link Outlier Factor (NLOF) for locating faults in communication networks. The NLOF is a unique outlier score assigned to each link in a network. It is computed using four distinct stages in a data analytics pipeline. The input to the pipeline are flow records (e.g., NetFlow) and network topology data (e.g., Link Layer Discovery Protocol (LLDP)). In the first stage, flow record throughput values are clustered in two sub-stages: using Density-Based Spatial Clustering of Applications with Noise (DBSCAN) and then our novel domain-specific ThroughPut Cluster (TPCluster) technique. In the second stage, flow outlier scores are determined within each cluster using a measure of proximity to a selected performance exemplar. In the third stage, flows are associated with network links using topology data. Finally, in the fourth stage the flow outliers are used to compute the outlier factor or score for each network link. The network link outlier scores are used with a detection rule to locate faults. We present the results of a wide set of Mininet experiments that appraise the fault detection/localization performance of NLOF. We find that NLOF allows for the detection of errors on edge links with a simple detection rule and the detection of errors on core links with a rule that includes topology relationships. NLOF is also compared to an abrupt change detection technique; while both have roughly the same detection power, the precision of NLOF is 42% higher and NLOF required 40% less time to detect failures on average.