Statistical analysis of network traffic for adaptive faults detection

IEEE Transactions on Neural Networks

Volumn 16, Issue 5, 2005, Pages 1053-1063

  Hajji, Hassan ^a  

^a IBM JAPAN LTD   (Japan)

Author keywords

Normal operation baselining; Online anomaly detection; Online change detection; Remote monitoring (RMON) management information base (MIB); Traffic model

Indexed keywords

ADAPTIVE SYSTEMS; APPROXIMATION THEORY; COMPUTER NETWORKS; LEARNING ALGORITHMS; MATHEMATICAL MODELS; MAXIMUM LIKELIHOOD ESTIMATION; RANDOM PROCESSES; STATISTICAL METHODS;

MANAGEMENT INFORMATION BASE; NORMAL OPERATION BASELINING; ONLINE ANOMALY DETECTION; ONLINE CHANGE DETECTION; REMOTE MONITORING; TRAFFIC MODEL;

TELECOMMUNICATION TRAFFIC;

ALGORITHM; ARTICLE; ARTIFACT; ARTIFICIAL INTELLIGENCE; AUTOMATED PATTERN RECOGNITION; COMPUTER SIMULATION; EVALUATION; INFORMATION RETRIEVAL; INTERNET; METHODOLOGY; SIGNAL PROCESSING; STATISTICAL MODEL; TELECOMMUNICATION;

ALGORITHMS; ARTIFACTS; ARTIFICIAL INTELLIGENCE; COMPUTER SIMULATION; INFORMATION STORAGE AND RETRIEVAL; INTERNET; MODELS, STATISTICAL; PATTERN RECOGNITION, AUTOMATED; SIGNAL PROCESSING, COMPUTER-ASSISTED; TELECOMMUNICATIONS;

EID: 26844499879     PISSN: 10459227     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNN.2005.853414     Document Type: Article

References (31)

1. F. Barceló and J. Jordán, "Channel holding time distribution in public telephony system (PAMR and PCS)," IEEE Trans. Veh. Technol., vol. 49, no. 5, pp. 1615-1625, Sep. 2000.
2. M. Basseville and I. V. Nikiforov, Detection of Abrupt Changes: Theory and Application. Englewood Cliffs, NJ: Prentice-Hall, 1993.
3. V. A. Bolotin, "Telephone circuit holding time distributions," in Proc. 14th Int. Conf. Fundamanetal Role of Teletraffic in the Evolution of Telecommunications Networks, vol. 1a, Amsterdam, The Netherlands, 1994, pp. 125-134.
4. V. A. Bolotin, "Modeling call holding time distributions for CCS network design and performance analysis," IEEE J. Sel. Areas Commun., vol. 12, pp. 433-438, Apr. 1994.
5. V. A. Bolotin, Y. Levi, and D. Liu, "Characterizing data connection and messages by mixtures of distributions on logarithmic scale," in Proc. 16th Int. Conf. Teletraffic Engineering in a Competitive World. Amsterdam, The Netherlands, 1993.
6. T. J. Brailsford, J. H. W. Penm, and R. D. Terrell, "Selecting the forgetting factor in subset autoregressive modeling," J. Time-Series Anal., vol. 23, no. 6, pp. 1-21, 2002.
7. A. Dempster, N. Laird, and D. Rubin, "Maximum likelihood from incomplete data via the EM algorithm," J. Roy. Statist. Soc. B, vol. 39, pp. 1-38, 1977.
8. A. Erramilli, O. Narayan, and W. Willinger, "Experimental queueing analysis with long-range dependent packet traffic," IEEE/ACM Trans. Netw., vol. 4, no. 2, pp. 209-223, 1996.
9. G. Goldzsmidt and Y. Yemini, "Distributed management by delegation," in Proc. 15th Int. Conf. Distributed Computing Systems, 1995.
10. H. Hajji and B. H. Far, "Continuous network monitoring for fast detection of performance problems," in Proc Int. Symp. Performance Evaluation of Computer and Telecommunication Systems, 2001.
11. H. Hajji, B. H. Far, and J. Cheng, "Detection of network faults and performance problems," in Proc. Internet Conf., Japan, pp. 159-168.
12. H. Hajji, "Baselining network traffic and online faults detection," in Proc. IEEE Int. Conf. Communications, vol. 26, May 2003, pp. 301-308.
13. S. C. Hood and C. Ji, "Proactive network fault detection," in Proc. INFOCOM'97, 1997, pp. 1147-1155.
14. G. Jakobson and M. D. Weissman, "Alarm correlation," IEEE Network, pp. 52-59, 1993.
15. I. Katzela and M. Schwarz, "Schemes for fault identification is communication networks," IEEE/ACM Trans. Netw., vol. 3, pp. 753-764, 1995.
16. W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson, "On the self-similar nature of ethernet traffic," IEEE/ACM Trans. Netw., vol. 2, no. 1, pp. 1-15, Feb. 1994.
17. V. Paxson and S. Floyd, "Wide-area traffic: The failure of poisson modeling," IEEE/ACM Trans. Netw., vol. 3, no. 3, pp. 226-244, Jun. 1995.
18. V. Paxson, "Empirically-derived analytic models of wide-area TCP connections," IEEE/ACM Trans. Netw., vol. 2, no. 4, Aug. 1994.
19. L. LaBarre, "Management by exception: OSI event generation, reporting, and logging," in Proc. 2nd Int. Symp. Integrated Network Management, 1991.
20. G. Lorden, "Procedures for reacting to a change in distribution," Ann. Math. Statist., vol. 42, pp. 1897-1908, 1971.
21. R. A. Maxion and F. E. Feather, "A case study of ethernet anomalies in a distributed computing environments," IEEE Trans. Reliab., vol. 39, no. 4, pp. 433-443, 1990.
22. J. P. Martin-Flatin, S. Znaty, and J. P. Hubaux, "A survey of distributed enterprise network and systems management paradigms," J. Netw. Syst. Manage., vol. 7, no. 1, pp. 9-26, 1999.
23. E. S. Page, "Continuous inspection schemes," Biometrika, vol. 41, pp. 100-115, 1954.
24. R. A. Redner and H. F. Walker, "Mixture densities, maximum likelihood and the EM algorithm," SIAM Rev., vol. 26, no. 2, pp. 195-239, 1984.
25. D. Seigmund and E. S. Venkatraman, "Using the generalized likelihood ratio statistic for sequential detection of a change points," Ann. Statist., vol. 23, no. 1, pp. 255-271, 1995.
26. D. Siegmund, Sequential Analysis: Tests and Confidence Intervals. New York: Springer-Verlag, 1985.
27. M. Thottan and C. Ji, "Statistical detection of enterprise network problems," J. Netw. Syst. Manage., vol. 7, no. 1, 1999.
28. D. M. Titterington, "Recursive parameter estimation using incomplete data," J. Roy. Statist. Soc., ser. B, vol. 46, no. 2, pp. 257-267, 1984.
29. N. A. Vlassis, "A kurtosis-based dynamic approach to Gaussian mixture modeling," IEEE Trans. Syst., Man, Cybern. A, Syst., Humans, vol. 29, no. 4, pp. 393-399, 1999.
30. E. Weinstein, M. Feder, and A. V. Oppenheim, "Sequential algorithms for parameter estimation based on Kullback-Leibler information measure," IEEE Trans. Acoust., Speech, Signal Process., vol. 38, no. 9, pp. 1652-1654, Sep. 1990.
31. S. Yemini, S. Kliger, E. Mozes, Y. Yemini, and D. Ohsie, "High speed and robust event correlation," IEEE Commun. Mag., pp. 82-90, 1996.