Towards an approximate graph entropy measure for identifying incidents in network event data

Abstract

Abstract-A key objective of monitoring networks is to identify potential service threatening outages from events within the network before service is interrupted. Identifying causal events, Root Cause Analysis (RCA), is an active area of research, but current approaches are vulnerable to scaling issues with high event rates. Elimination of noisy events that are not causal is key to ensuring the scalability of RCA. In this paper, we introduce vertex-level measures inspired by Graph Entropy and propose their suitability as a categorization metric to identify nodes that are a priori of more interest as a source of events.We consider a class of measures based on Structural, Chromatic and Von Neumann Entropy. These measures require NPHard calculations over the whole graph, an approach which obviously does not scale for large dynamic graphs that characterise modern networks. In this work we identify and justify a local measure of vertex graph entropy which behaves in a similar fashion to global measures of entropy when summed across the whole graph. We show that such measures are correlated with nodes that generate incidents across a network from a real data set.

Constraints and entropy in a model of network evolution

“…Motivated by the interesting results when applying concepts from statistical mechanics, and the results for vertex entropy arrived at in [8], we also set out to see if scale free models could be arrived at from pure thermodynamic principles of entropic force. In Section 4 we were able to obtain, from first principles, an evolution equation for the degree of a random node, which although soluble analytically, presents challenges when deriving the degree distributions according to the continuum analysis.…”

“…The Twitter follower data is provided by [25], and the rest of the datasets are reproduced from publications such as [1], the Internet Topology Zoo [26]. We have one proprietary graph built from the topology taken from a large commercial deployment of network infrastructure used to deliver a top 10 Internet portal service (see [8] Analysis of the data was undertaken using a program and graph datastore which is available from the authors on request. The source data was often very large (the Twitter data contains for example over 10 million edges), and extracting values for the max degree and k is not necessarily evident.…”

“…In recent work [8] we built upon this formulation to define a local vertex measure (referred to in [8] as N V E , and equivalent to our definition of S i here) in terms of its relative degree as:…”

Vertex Entropy As a Critical Node Measure in Network Monitoring

“…The focus of our research has been with graph entropy, building on the entropy metric presented by Tee et al in [17]. Entropy has been studied in other contexts for anomaly detection (recently [18], and [19] applied the approach to traffic anomaly detection), but graph entropy has received little attention in the context of fault management.…”

“…This can be done using Lagrange multipliers with the constraint i p i = C, where C is the constant from equation (17). This yields an expression for the p i as p i = 2 (C−1−λ) , where λ is the Lagrange multiplier, confirming that the entropy has a maximal value for a graph whose degrees are equal.…”