Naoki Tateishi

Evaluation of network fault-detection method based on anomaly detection with matrix eigenvector

To provide high-quality and highly reliable services in IP networks, the service down time after network faults have occurred needs to be reduced. However, there are network faults that operators cannot detect with network monitoring alarms, such as Simple Network Management Protocol Trap, or by monitoring device statuses from collected network data. To solve this problem, we focused on anomaly-detection methods. Although these methods have been proposed for computer systems, few studies have focused on IP networks. Therefore, we focused an anomaly-detection method based on a matrix eigenvector for detecting faults in IP networks and evaluated whether this method can be applied to IP networks by using network fault simulations. Evaluation results show that the anomaly-detection method based on a matrix eigenvector is effective in detecting network faults in IP networks, but it has two problems. One is that this method may detect normal states as anomalies and the other is that optimizing the discounting factor for detecting sequential faults is difficult.

Methods for Rapidly Testing Node Reachability with Congestion Control and Evaluation

Most ISPs and telecom carriers test reachability to their nodes and interfaces by SNMP or ICMP echo. However, testing for on the order of 10,000-100,000 nodes by traditional techniques takes a long time. Furthermore, huge numbers of short packets occupy the capacity of the links and interfere with other flows. At this time, test software using traditional techniques cannot distinguish whether the reason for packet loss is unreachability or congestion. We should use methods for sending many packets, a congestion detection method, and congestion control method when we test for node reachability. By using these methods, ISP and telecom carriers will obtain reliable results. In this paper, we report such methods and experimental results of this implementation.

Detecting and recovering prefix hijacking using multi-agent inter-AS diagnostic system

The Internet is a collection of autonomous systems (ASes), and each AS exchanges routing information with neighboring ASes using the Border Gateway Protocol (BGP). Prefix hijacking is a representative example of communication failure caused by wrong routing information exchange. When an ASs prefix is hijacked by invalid BGP routing information advertisement from another AS, the hijacked AS cannot communicate with other ASes because the traffic is delivered to the hijacking AS, not to the hijacked AS. To solve this problem, we have been researching and developing technologies that detect, recover, and prevent prefix hijacking. In this paper, we focus on detection and recovery functions. We propose two detection techniques using ping tests and checking AS_PATH change to improve the accuracy of prefix hijacking detection. For the recovery function, we propose two methods to reduce the downtime of communication failure: retaking the hijacked prefix and preventing distribution of the hijacked prefix.

High-speed traceroute method for large scale network

As the scale of IP networks becomes larger, network management becomes more complex and the turn-around time of fault recovery is longer. This is because there are problems in adopting current essential tools for network management, such as a ping, Traceroute, and Simple Network Management Protocol (SNMP) to large-scale IP networks. We have been investigating ways to improve the performance of these tools, and proposed a high-speed ping and showed its advantage. For this paper, we propose and evaluate a high-speed traceroute method for collecting topology information from large scale networks. Our method is used to increase the speed of network topology collection to reduce topology-searching packets, which are sent in excess using the current traceroute method, as well as adopting our high-speed ping technology. In terms of reducing packets, our method can be used to send these searching packets to end points first (with the current traceroute method, they are sent last), detect nodes on the shared routes to those end points, and send searching packets to these nodes only. By implementing the above, we show that our proposed method can be used to reduce searching packets by 70% and the time to collect topology information by 95% compared with the current traceroute.