SYNERGY : Detecting and Diagnosing Correlated Network Anomalies

Network anomalies occur in operational networks and may be logged by a number of network measurement tools such as SNMP and NetFlow. However, accurate and efficient detection of these anomalies in the logged data is very challenging due to the huge data volume and complex characteristics of anomalies. The existing approaches are limite d by the nature of underlying mathematical models and might be incapable of capturing some abnormal patterns. More importantly, existing approaches do not provide insights o n the root causes or impact of the detected anomalies, which makes it hard for a network operator to troubleshoot network performance issues. In this paper, we design and prototype a novel system, SYNERGY, that can detect network anomalies with high confidence by correlating across multiple data sources. It can report the root causes/impact assoc iated with the detected anomalies, which significantly facil itates the work of network operators. In addition, SYNERGY provides a great facility for the area of anomaly detection research – it can serve as a general framework to evaluate the performance of different anomaly detection methods . We evaluate SYNERGY using data collected at a tier-1 ISP network and show that it performs very well compared to the manually identified anomalies found in the operational practice. The methodology and algorithms in SYNERGY promise to be of immense use to network operations.