Adarshpal S. Sethi

A survey of fault localization techniques in computer networks

Fault localization, a central aspect of network fault management, is a process of deducing the exact source of a failure from a set of observed failure indications. It has been a focus of research activity since the advent of modern communication systems, which produced numerous fault localization techniques. However, as communication systems evolved becoming more complex and offering new capabilities, the requirements imposed on fault localization techniques have changed as well. It is fair to say that despite this research effort, fault localization in complex communication systems remains an open research problem. This paper discusses the challenges of fault localization in complex communication systems and presents an overview of solutions proposed in the course of the last ten years, while discussing their advantages and shortcomings. The survey is followed by the presentation of potential directions for future research in this area.

Probabilistic fault localization in communication systems using belief networks

We apply Bayesian reasoning techniques to perform fault localization in complex communication systems while using dynamic, ambiguous, uncertain, or incorrect information about the system structure and state. We introduce adaptations of two Bayesian reasoning techniques for polytrees, iterative belief updating, and iterative most probable explanation. We show that these approximate schemes can be applied to belief networks of arbitrary shape and overcome the inherent exponential complexity associated with exact Bayesian reasoning. We show through simulation that our approximate schemes are almost optimally accurate, can identify multiple simultaneous faults in an event driven manner, and incorporate both positive and negative information into the reasoning process. We show that fault localization through iterative belief updating is resilient to noise in the observed symptoms and prove that Bayesian reasoning can now be used in practice to provide effective fault localization.

Probabilistic fault diagnosis in communication systems through incremental hypothesis updating

This paper presents a probabilistic event-driven fault localization technique, which uses a probabilistic symptom-fault map as a fault propagation model. The technique isolates the most probable set of faults through incremental updating of a symptom-explanation hypothesis. At any time, it provides a set of alternative hypotheses, each of which is a complete explanation of the set of symptoms observed thus far. The hypotheses are ranked according to a measure of their goodness. The technique allows multiple simultaneous independent faults to be identified and incorporates both negative and positive symptoms in the analysis. As shown in a simulation study, the technique offers close-to-optimal accuracy and is resilient both to noise in the symptom data and to inaccuracies of the probabilistic fault propagation model.

Increasing robustness of fault localization through analysis of lost, spurious, and positive symptoms

This paper utilizes belief networks to implement fault localization in communication systems taking into account comprehensive information about the system behavior. Most previous work on this subject performs fault localization based solely on the information about malfunctioning system components (i.e., negative symptoms). We show that positive information, i.e., the lack of any disorder in some system components, may be used to improve the accuracy of this process. The technique presented allows lost and spurious symptoms to be incorporated in the analysis. We show through simulation that in a noisy network environment the analysis of lost and spurious symptoms increases the robustness of fault localization with belief networks. We also demonstrate that belief networks yield high accuracy even for approximate probability input data and therefore are a promising model for non-deterministic fault localization.

End-to-end service failure diagnosis using belief networks

We present fault localization techniques suitable for diagnosing end-to-end service problems in communication systems with complex topologies. We refine a layered system model that represents relationships between services and functions offered between neighboring protocol layers. In a given layer, an end-to-end service between two hosts may be provided using multiple host-to-host services offered in this layer between two hosts on the end-to-end path. Relationships among end-to-end and host-to-host services form a bipartite probabilistic dependency graph whose structure depends on the network topology in the corresponding protocol layer. When an end-to-end service fails or experiences performance problems it is important to efficiently find the responsible host-to-host services. Finding the most probable explanation (MPE) of the observed symptoms is NP-hard. We propose two fault localization techniques based on Pearls (1988) iterative algorithms for singly connected belief networks. The probabilistic dependency graph is transformed into a belief network, and then the approximations based on Pearls algorithms and exact bucket tree elimination algorithm are designed and evaluated through extensive simulation study.

Analysis of wormhole intrusion attacks in MANETS

Wormhole refers to an attack on MANET routing protocols in which colluding nodes create an illusion that two remote regions of a MANET are directly connected through nodes that appear to be neighbors but are actually distant from one another. Our focus in this paper is a particular form of the wormhole attack called the self-contained in-band wormhole. In this paper we analyze the criterion for successful wormhole attack on a MANET. Based on results collected from a Qualnet simulation, we evaluate the likelihood of such an attack. We further classify the wormhole scenarios into successful, unsuccessful, doubtful, interesting, and uninteresting. We also define wormhole strength and observe that the detection ratio of the technique proposed in varies with wormhole strength as well as with the network topology. The simulation statistics also show that the wormholes having higher strength have a higher detection ratio as compared to the ones with lower strength.

Performance analysis of token ring local area networks

Abstract In this paper, we present an analytic model for the performance evaluation of Token Ring Local Area Networks which use the “round-robin” message transmission strategy. Message arrivals are assumed to be Markovian while both constant and exponentially-distributed message lengths are considered. The model derives expressions for the mean token rotation time, and the average number of active stations in each rotation, and also obtains the Laplace Transform of the distribution of the token rotation time. Each ring station is modeled as a “gated” M/G/1 queue and expressions for the mean delay and mean queue length are derived.

Active Probing Approach for Fault Localization in Computer Networks

Active probing is an active network monitoring technique that has potential for developing effective solutions for fault localization. In this paper we use active probing to present an approach to develop tools for performing fault localization. We discuss various design issues involved and propose architecture for building such a tool. We describe an algorithm for probe set selection for problem detection and present simulation results to show its effectiveness. We demonstrate through analysis and experiments that active probing has the potential to greatly reduce the probe traffic and the fault diagnosis time.

Non-deterministic diagnosis of end-to-end service failures in a multi-layer communication system

Fault localization is a process of isolating faults responsible for the observable malfunctioning of the managed system. Previously, fault localization efforts concentrated mostly on diagnosing faults related to the availability of network resources in the lowest layers of the protocol stack. This paper focuses on end-to-end service failure diagnosis as a critical step towards multi-layer fault localization in an enterprise environment. By refining a previously proposed modeling technique, we present a universal method of modeling both availability and performance related problems associated with end-to-end services in a non-deterministic fashion. We introduce and evaluate a novel algorithm that allows an event-driven, incremental diagnosis of end-to-end service failures.

An analysis of Memnet—an experiment in high-speed shared-memory local networking

Memnet is a shared-memory local area network under development at the University of Delaware that provides close coupling to the processors of a physically distributed multiprocessor system. The Memnet local network appears as memory in the physical address space of each processor (host) on the network. This paper describes an analysis of the Memnet system performed to predict the possible performance levels attainable by a Memnet system. One objective of this analysis is to provide analytic results demonstrating the intrinsic soundness of the Memnet architecture. This is in support of the intuitive arguments of the shared-memory network model over the I/O modeled local network schemes. Another function of this analysis has been to provide design feedback for the choice of values for parameters such as page size. The analysis results indicate that the Memnet approach to networking should significantly speed communication compared to alternative networking schemes. Due to space limitations, the details of the analysis have not been included. The full text is available as TR-88-6-1 from: Department of Electrical Engineering, University of Delaware, Newark DE, 19716.