Remediating Anomalous Traffic Behaviour in Future Networked Environments

Abstract

Abstract. The diverse characteristics of network anomalies and the different recovery approaches that can subsequently be employed to remediate their effects, constitute static defence mechanisms tuned at responding to specific abnormalities suboptimal for providing an overall resilience framework. The emerging autonomic network environments in particular, require always-on, adaptive, and generic mechanisms that can integrate with the core networking infrastructure and provide for a range of self-* capabilities, ranging from selfprotection to self-tuning. In this paper we present the design and implementation of an adaptive remediation component built on top of an autonomic network node architecture [2]. A set of pluggable modules that employ diverse algorithms and explicit cross-layer interaction have been engineered to mitigate different classes of anomalous traffic behaviour in response to both legitimate and malicious external stimuli. In collaboration with an always-on measurement-based anomaly detection component, our prototype empowers the properties of self-optimisation and self-healing.

Framework for distributed autonomic self‐healing in fixed IPv6 networks

“…Besides, the applicability of the UniFAFF to traditional IP networks has not been evaluated. Sterbenz et al [28] propose the so called D 2 R 2 + DR strategy (Defend, Detect, Remediate, Recover, plus Diagnose and Refine), which provides a framework for the implementation of different resilient behaviors [28,44]. However, these behaviors are implemented on a case by case basis while at the same time complying with the very generic D 2 R 2 + DR principles.…”

“…However, OMEGA does not provide a detailed description of the different phases of a control loop, which we arrived at after the implementation and experimentation with our framework. In addition, OMEGA (as well as the D 2 R 2 + DR case study ) employs Bayesian Networks to tackle the Fault‐Isolation task, which proved to have worse scalability properties than the Markov Chain based algorithm used for AFH. As Fault‐Isolation is a key process, this has an enormous impact on the overall scalability of the approach.…”

Computação autonômica aplicada ao diagnóstico e solução de anomalias de redes de computadores

“…Isso permite uma reavaliação das tarefas atribuídas ao administrador humano, permitindo que ele se concentre em aspectos mais estratégicos e de mais alto nível da gerência de rede. A computação autonômica também tem o potencial de prover maior resiliência à rede, permitindo maior disponibilidade e a confiabilidade dos serviços prestados [44].…”

“…A habilidade do sistema de diagnosticar e aplicar ações corretivas para solucionar o problema é denominada no contexto da computação autonômica de autorreparo [41]. Marnerides et al [44] destacam que dependendo do contexto de atuação do sistema (e.g., detecção de anomalias) essa é uma das propriedades mais complexas a ser realizada pelo sistema.…”

“…As A modelagem e a implementação de um componente voltado para detectar e remediar anomalias de rede é proposto em [44]. Segundo os autores, garantir a resiliência de rede é complexo em função dos diferentes tipos de anomalias.…”