KL-Dection: : An Approach to Detect Network Outages Based on Key Links
Authors: 
Ye Kuang, Dandan Li, Xiaohong Huang Academic Editor: Shalli RaniAuthors Info & Claims
Ye Kuang, Dandan Li, Xiaohong Huang Academic Editor: Shalli RaniAuthors Info & ClaimsAbstract
Monitoring the states of network links is essential to detect network outages and improve Internet reliability. Currently, existing work detects network outages by monitoring all the links, which requires thousands of probes and large-scale measurements, resulting in high resource occupancy and cost. To solve this problem, this paper proposes the KL-Dection approach, which detects network outages via key links instead of all links. Firstly, we recognize the key links based on flow density, degree centrality, and probe-distance centrality. Next, based on the recognized key links, we give the critical value of their Round-Trip Time (RTT). Then, we detect the network outages by observing whether the RTT of the key link exceeds the critical value. Finally, we leverage two historical events to evaluate our approach, and the results demonstrate that our approach can detect the network outages effectively by only monitoring less than 0.06% of the links in detection area.
References
[1]
R. Fontugne, A. Shah, and K. Cho, “Persistent last-mile congestion:not so uncommon,” in Proceedings of the Internet Measurement Conference (IMC), pp. 420–427, New York, 2020.
[2]
J. Kučera, R. B. Basat, M. Kuka, G. Antichi, M. Yu, and M. Mitzenmacher, “Detecting routing loops in the data plane,” in Proceedings of the 2020 ACM CoNEXT Conference, pp. 466–473, Barcelona, 2020.
[3]
G. Kumar, N. Dukkipati, K. Jang, H. M. Wassel, X. Wu, B. Montazeri, Y. Wang, K. Springborn, C. Alfeld, M. Ryan, and D. Wetherall, “Swift: delay is simple and effective for congestion control in the datacenter,” in Proceedings of the ACM Special Interest Group on Data Communication (SIGCOMM), pp. 514–528, New York, 2020.
[4]
B. Hou, C. Hou, T. Zhou, Z. Cai, and F. Liu, “Detection and characterization of network anomalies in large-scale RTT time series,” IEEE Transactions on Network and Service Management, vol. 18, no. 1, pp. 793–806, 2021.
[5]
L. Quan, J. Heidemann, and Y. Pradkin, “Trinocular: understanding internet reliability through adaptive probing,” in Proceedings of the ACM Special Interest Group on Data Communication (SIGCOMM), pp. 255–266, Hong Kong, 2013.
[6]
R. Fontugne, C. Pelsser, E. Aben, and R. Bush, “Pinpointing delay and forwarding anomalies using large-scale traceroute measurements,” in Proceedings of the Internet Measurement Conference (IMC), pp. 15–28, London, 2017.
[7]
R. Padmanabhan, A. Schulman, D. Levin, and N. Spring, “Residential links under the weather,” in Proceedings of the ACM Special Interest Group on Data Communication (SIGCOMM), pp. 145–158, Beijing, 2019.
[8]
N. Gaur, A. Chakraborty, and B. S. Manoj, “Delay optimized small-world networks,” IEEE Communications Letters, vol. 18, no. 11, pp. 1939–1942, 2014.
[9]
M. Hasib and J. A. Schormans, “Limitations of passive & active measurement methods in packet networks,” in London Communi- cations Symposium (LCS), London, UK, 2003.
[10]
J. Badshah, M. Alhaisoni, N. Shah, and M. Kamran, “Cache servers placement based on important switches for SDN-based ICN,” Electronics, vol. 9, no. 1, pp. 39–65, 2020.
[11]
T. Yingying Cheng and X. Jia, “Compressive traffic monitoring in hybrid SDN,” IEEE Journal on Selected Areas in Communications, vol. 36, no. 12, pp. 2731–2743, 2018.
[12]
D. Perdices, D. Muelas, I. Prieto, L. de Pedro, and L. de Vergara, “On the modeling of multi-point RTT passive measurements for network delay monitoring,” IEEE Transactions on Network and Service Management, vol. 16, no. 3, pp. 1157–1169, 2019.
[13]
M. S. Kang, S. B. Lee, and V. D. Gligor, “The crossfire attack,” in 2013 IEEE Symposium on Security and Privacy, pp. 127–141, Berkeley, CA, 2013.
[14]
M. Di Bartolomeo, V. Di Donato, M. Pizzonia, C. Squarcella, and M. Rimondini, “Extracting routing events from traceroutes: a matter of empathy,” IEEE/ACM Transactions on Networking, vol. 27, no. 3, pp. 1000–1012, 2019.
[15]
R. Fontugne, J. Mazel, and K. Fukuda, “An empirical mixture model for large-scale RTT measurements,” in 2015 IEEE Conference on Computer Communications (INFOCOM), pp. 2470–2478, Hong Kong, China, 2015.
[16]
B.-Y. Choi, S. Moon, Z.-L. Zhang, K. Papagiannaki, and C. Diot, “Analysis of point-to-point packet delay in an operational network,” Computer Networks, vol. 51, no. 13, pp. 3812–3827, 2007.
[17]
S. Shakkottai, N. Brownlee, A. Broido, and K. Claffy, “The RTT distribution of TCP flows on the internet and its impact on TCP based flow control,” Technical report, Cooperative Association for Internet Data Analysis (CAIDA), 2004.
[18]
G. Maier, A. Feldmann, V. Paxson, and M. Allman, “On dominant characteristics of residential broadband internet traffic,” in Proceedings of the Internet Measurement Conference (IMC), pp. 90–102, Chicago, 2009.
[19]
A. Dainotti, C. Squarcella, E. Aben, K. C. Claffy, M. Chiesa, M. Russo, and A. Pescape, “Analysis of country-wide internet outages caused by censorship,” IEEE/ACM Transactions on Networking, vol. 22, no. 6, pp. 1964–1977, 2014.
[20]
J. Heidemann, L. Quan, and Y. Pradkin, “A preliminary analysis of network outages during hurricane sandy,” Tech. Rep, ISI-TR-685b, University of Southern California, Information Sciences Institute, 2012.
[21]
A. Schulman and N. Spring, “Pingin’ in the rain,” in Proceedings of the Internet Measurement Conference (IMC), pp. 19–28, New York, 2011.
[22]
A. Milolidakis, R. Fontugne, and X. Dimitropoulos, “Detecting network disruptions at colocation facilities,” in 2019 IEEE Conference on Com- puter Communications (INFOCOM), pp. 2161–2169, Paris, France, 2019.
[23]
G. Aceto and A. Pescapé, “Internet censorship detection: a survey,” Com- puter Networks, vol. 83, pp. 381–421, 2015.
[24]
J. H. Wang and C. An, “A study on geographic properties of internet routing,” Computer Networks, vol. 133, pp. 183–194, 2018.
[25]
G. H. Golub and C. F. Van Loan, Matrix Computations, vol. 3, The Johns Hopkins Univ. Press, Baltimore, MD, USA, 2012.
[26]
K. L. Spafford, J. S. Meredith, and J. S. Vetter, “Quartile and outlier detection on heterogeneous clusters using distributed radix sort,” in 2011 IEEE International Conference on Cluster Computing, pp. 412–419, Austin, TX, USA, 2011.
[27]
R. Zhao, Z. Li, Z. Xue, T. Ohtsuki, and G. Gui, “A novel approach based on lightweight deep neural network for network intrusion detection,” in 2021 IEEE Wireless Communications and Networking Conference (WCNC), pp. 1–6, Nanjing, China, 2021.
[28]
P. Thorat, N. K. Dubey, K. Khetan, and R. Challa, “SDN-based predictive alarm manager for security attacks detection at the IoT gateways,” in 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC), pp. 1–2, Las Vegas, NV, USA, 2021.
[29]
N. Leslie, “An unsupervised learning approach for in-vehicle network intrusion detection,” in 2021 55th Annual Conference on Information Sciences and Systems (CISS), pp. 1–4, Baltimore, MD, USA, 2021.
[30]
G. C. M. Moura, J. Heidemann, M. Müller, R. O. de Schmidt, and M. Davids, “When the dike breaks: dissecting DNS defenses during DDoS,” in Proceedings of the Internet Measurement Conference (IMC), pp. 8–21, Boston, MA, USA, 2018.
[31]
S. Mansfield-Devine, “DoS goes mainstream: how headline-grabbing attacks could make this threat an organisation’s biggest nightmare,” Network Security, vol. 2016, no. 11, pp. 7–13, 2016.
[32]
“Electric disturbance events (oe-417) annual summaries,” https://www.oe. http://netl.doe.gov//OE417annualsummary.aspx.
Recommendations
The role of KL divergence in anomaly detection
SIGMETRICS '11: Proceedings of the ACM SIGMETRICS joint international conference on Measurement and modeling of computer systemsWe study the role of Kullback-Leibler divergence in the framework of anomaly detection, where its abilities as a statistic underlying detection have never been investigated in depth. We give an in-principle analysis of network attack detection, showing ...
On the dualization of hypergraphs with bounded edge-intersections and other related classes of hypergraphs
Given a finite set V , and integers k ý1 and r ý0, let us denote by the class of hypergraphs with ( k,r )-bounded intersections, i.e. in which the intersection of any k distinct hyperedges has size at most r . We consider the problem : given a ...
Return-to-zero transmitter for WDM-PONs using incoherent-light-injected Fabry-Perot laser diodes
Special issue on next-generation broadband optical access network technologiesThanks to colorless operation and cost-effectiveness, an incoherent-light-injected Fabry-Perot laser diode (FP-LD) is considered as a promising optical transmitter for wavelength-division-multiplexed (WDM) passive optical networks (PONs). However, the ...
Comments
Information & Contributors
Information
Published In
Copyright © 2022 Ye Kuang et al.
This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
Publisher
John Wiley and Sons Ltd.
United Kingdom
Publication History
Published: 01 January 2022
Qualifiers
- Research-article
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- 0Total Citations
- 0Total Downloads
- Downloads (Last 12 months)0
- Downloads (Last 6 weeks)0
Reflects downloads up to 12 Aug 2024
Other Metrics
Citations
View Options
View options
Get Access
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign in