Binay Sugla

A conceptual framework for network management event correlation and filtering systems

Event correlation is a key functionality of a network management system that is used to determine the root cause of faults in a network, and to filter out redundant and spurious events. A number of event correlation systems have been proposed. The event correlation systems generally combine causal and temporal correlation models with the topology of a network. The power and robustness of the models used and the algorithms developed vary from system to system. However, in the absence of a simple, uniform, and precise presentation of the event-correlation problem, it is impossible to compare their relative power or even analyze them for their properties. In general, causal and temporal-based correlation models have not been rigorously presented or thoroughly investigated. In this paper we formalize the concepts of causal and temporal correlation using a single conceptual framework. We characterize various properties of the framework. We can characterize existing systems based on the formal properties of our framework, and we consider one system as an illustrative example.

Utility of co-operating Web proxy caches

Abstract In this paper, we study the utility of co-operation among intranet proxy caches. We target our study to a corporate intranet environment having multiple Web proxies that each serve a set of hosts. Experiments with our co-operation methods and architectures with real data suggest that daily hit rate improvements due to co-operation can vary from 0.7–28.9%. We study the effect of community size on co-operation performance, and analyze the other side-effects of co-operation, e.g., the extra intranet traffic and server load. We develop metrics to deduce information relevant to making decisions about the effectiveness of co-operation, and draw intuitions on when it makes sense for the caches to co-operate. Our work demonstrates a feasible set of metrics that proxies should measure to help in their evaluation of caching effectiveness and their configuration.

Toward efficient monitoring

In many cases, data networks need to be monitored to ensure that they stay within acceptable parameters. The monitoring consists of measuring properties of the network, and of inferring an aggregate predicate from these measurements. In many cases it is too complex, or too expensive, to conduct explicit monitoring at all times. In these cases, information (integrity constraints) on the evolution of the network status can often allow us to use past measurements to infer the future behavior, thus reducing the monitoring cost. We provide a formal description of the problem of monitoring rapidly changing data, which we call the monitoring problem. We then classify this problem in terms of the integrity constraints that govern the evolution of the environment, and propose different algorithms for each of these classes. For the most restricted case, we can find a greedy algorithm which is optimal, while for the more general cases, we use competitive analysis and show that optimal worst and average case cost measuring algorithms exist. We then present heuristics for low-cost low-complexity measuring algorithms. We believe that the results of this paper can serve as a framework for further studies.

An XML-based Framework for Dynamic SNMP MIB Extension

Current SNMP-based management frameworks make it difficult for a network administrator to dynamically choose the variables comprising the MIB at managed elements. This is because most SNMP implementations represent the MIB implicitly as part of the agent code - an approach which impedes the runtime transfer of the MIB as a separate entity to be easily shipped around the network and incorporated into different applications. We propose the use of XML to represent MIBs at managed elements. We describe a network management toolkit which uses XML and the Document Object Model (DOM) to specify a MIB at runtime. This approach allows the MIB structure to be serialized and shipped over the network between managers and agents. This use of the DOM for MIB specification facilitates dynamic MIB modification. The use of XML also allows the MIB to be easily browsed and seamlessly integrated with online documentation for management tasks. XML further allows for the easy interchange of data between network management applications using different information models.

Economically managing multiple private data networks

In many cases, there is a need to manage a local addressing realm from a manager site located outside the realm. A particular important example is the case of NM service providers who provide network management services from a remote site. Such providers may have many customers, each using the same private address space. When all these networks are to be managed from a single management station, address collision may occur. One way to overcome address collision is to use network address translation (NAT). The problem is that many network management applications use IP address information at the application level. Therefore, in order to work correctly, these NM applications should be aware of NAT. However, most commonly used NM applications are unaware of NAT and are most likely to remain so in the near future (due to the large investment involved). This paper describes a design and implementation of a solution that is transparent to the network management application (but not to the user), and does not require a general reconfiguration of a large portion of the network. It converts conflicting addresses into non-conflicting addresses by combining NAT and SNMP payload translation, and allows multiple private networks to be managed on a single management platform.

Minimizing the monitoring cost in network management

Many rapidly-changing environments need to be monitored to ensure that they stay within acceptable parameters. The monitoring consists of measuring properties of the environment, and of inferring an aggregate predicate from these measurements. In many cases it is too complex, or too expensive to conduct explicit monitoring at all times. In these cases, information (integrity constraints) on the evolution of this environment can often allow us to use past measurements to infer the future behavior, thus reducing the monitoring cost. We provide a formal description of the problem of monitoring rapidly-changing data, which we call the monitoring problem. We then classify this problem in terms of the integrity constraints that govern the evolution of the environment, and propose different algorithms for each of these classes. For the most restricted case, we can find a greedy algorithm which is optimal, while for the more general cases we use competitive analysis and show that optimal worst- and average-case cost measurement algorithms exist. We then present heuristics for low-cost low-complexity measurement algorithms. We believe that the results of this paper can serve as a framework for further studies.

An architecture for provisioning IP services in an operations support system

The paper discusses an architecture for a provisioning system that meets the challenges currently facing service providers in a service and subscriber-based OSS (operations support system) environment. The architecture makes a clear separation between a provisioning core, which is a general framework for provisioning services, and service definitions that model the provisioning view of a service. The architecture is distributed, scalable and extensible and is especially suited for scenarios where a large number of services is expected to be offered, deployed, and managed. The service definitions can be used by the other OSS components to correlate information to provide complete device-to-service-to-subscriber diagnostics for faults, performance degradations, and accounting. It is argued that this approach leads to natural, efficient and effective management solutions.

An automated technique for designing and improving provisioning processes

Network management is an increasingly important area of research dealing with continuously evolving artificial complex systems. We look at the important network management process of provisioning, which involves all activities to implement changes to the network. Typical provisioning activities include addition or deletion of customers and network elements, growth of the network, and load balancing. We present a new method for specifying and analyzing provisioning workflow. Our method is based on representing workflow by finite state machines augmented with the notion of attribute sets. Such a representation allows us to study important properties of the workflow, and analyze it to detect inefficiencies. We also provide an example of the application of this technique to a trunk provisioning workflow.