Towards Efficient Large-Scale VPN Monitoring and Diagnosis under Operational Constraints

Joint optimization of monitor location and network anomaly detection

“…We adopt the most common approach of anomaly detection that is monitoring a covering path set that do not distinguish link anomalies 1 (e.g. [1], [2], [6]). The aim of such an approach is to minimize the monitoring overhead when the network is operational.…”

“…In the second scenario ( Fig.1), we locate three monitoring devices on nodes 1, 6 and 8. S2 = {P3 (1,4,6), P4 (1,3,6,7,8), P5 (1,2,5,4,7,8)} is an optimal corresponding path set. In the first scenario, the links (1, 3), (3,6) and (7,8) are monitored twice; they belong each to two monitored paths.…”

“…[7]- [9]). The works in [1]- [6] addressed the minimization of the overhead of the inference techniques. Given an optimal set of monitor locations, they proposed inference schemes that monitor a small set of paths toward minimizing the communication cost.…”

“…One of the most common approaches is to perform the monitoring task over two phases: anomaly detection phase and anomaly localization phase (e.g. [1], [2], [6]). The key goal is to reduce the monitoring overhead when the network behaves well, i.e.…”

“…Recently, Zhao et al [1] proposed an interesting formulation of the monitoring problem. Indeed, they argued that the capacities of links and monitors to handle monitoring flows should be considered while selecting monitor locations.…”