Abstract-In this paper, we propose an algorithm to efficiently diagnose large-scale clustered failures. The algorithm, Cluster-MAX-COVERAGE (CMC), is based on greedy approach. We address the challenge of determining faults with incomplete symptoms. CMC makes novel use of both positive and negative symptoms to output a hypothesis list with a low number of false negatives and false positives quickly. CMC requires reports from about half as many nodes as other existing algorithms to determine failures with 100% accuracy. Moreover, CMC accomplishes this gain significantly faster (sometimes by two orders of magnitude) than an algorithm that matches its accuracy. Furthermore, we propose an adaptive algorithm called Adaptive-MAX-COVERAGE (AMC) that performs efficiently during both kinds of failures, i.e., independent and clustered. During a series of failues that include both independent and clustered, AMC results in a reduced number of false negatives and false positives. [13] is proposed to localize largescale failures in networks. It is shown that by considering the failure patterns of large-scale outages, this algorithm can achieve higher accuracy than existing algorithms developed for independent failures [10]. However, the drawback of netCSI is that the run-time complexity of the algorithm increases exponentially with the increase in size of networks since it is a combinatorial approach.
Keywords-FaultIn this paper, we propose a new algorithm called Cluster-MAX-COVERAGE (CMC) that diagnoses large-scale clustered failures. To identify the faulty network elements (i.e., network nodes, routers, and links) CMC utilizes a knowledge base of possible network paths and end-to-end symptom information. The observed end-to-end symptoms during failures include both negative symptoms, such as which source-destination pairs are disconnected, as well as positive symptoms, such as which source-destination pairs can still communicate. This information is reported to the network manager by a few selected nodes in the network called reporting nodes; a complete list of symptoms is not required. Using this information, CMC outputs a hypothesis list which consists of a set of network elements whose failures are consistent with the symptoms.To solve the issue of run-time complexity, CMC adopts a greedy approach when generating the hypothesis list of faulty network elements, as opposed to the combinatorial approach in netCSI. Our greedy approach is similar to a fault diagnosis algorithm called MAX-COVERAGE (MC) [10], which is developed to diagnose black holes or silent failures (independent failures) in IP networks. During clustered failures, the performance of MC degrades significantly-in particular it produces a prohibitively high number of false negatives (see Section V-C1). To overcome this limitation, CMC uses clusters of objects instead of single objects when forming the hypothesis list.The major contributions of CMC include:• Clustering models: To diagnose large-scale failures, CMC selects clusters of objects greedily based on c...