Slide 119/10/2015 INTERMON Advanced architecture for INTER-domain quality of service MONitoring, modelling and visualisation U. Hofmann*, I.Miloucheva, T.Pfeiffenberger, F. Strohmeier Salzburg Research,*Univ. of Applied Sciences, Salzburg Austria

Slide 219/10/ INTERMON Overview 2. CM Toolset active QoS monitoring and analysis toolkit - Motivation - Components - Scenario - Results 3. Future Work

Slide 319/10/2015 Motivation : ISP wants to enhance the inter-domain Quality of Service (QoS) analysis in large-scale, multi-domain to offer stabile inter-domain services ISP S1/2 are competitors ISP* offers SourceEndSystem the aggregate QoS best_of {ISP T1/T2}...ISP D* 1. Overview

Slide 419/10/2015 => scalable inter-domain QoS monitoring and analysis effect of inter-domain routing and BGP-4 protocol behaviour monitoring : IPFIX modelling load QoS : simulation ( fluid, hybrid analytical M/G/* visual data mining architecture measurement based simulation technologies IPFIX => Simulation pattern detection, outlier elimination pattern compression PLA using common QoS database with policy-controlled interworking of components

Slide 519/10/2015

Slide 619/10/2015 QoS is different for different paths : s->A->B->d, s->A->C->d QoS is different for different SLS : VoIP (160 Byte), FTP (1500 Byte) ISP_A ISP_C ISP_B source destination QoS offer S->D Salzburg-Madrid  t=20ms 2. CM Toolset active QoS monitoring and analysis toolkit Motivation

Slide 719/10/2015 Components

Slide 819/10/2015 CM Toolset Scenario for complex QoS analysis and data mining -capacity planning -patterns dependent on topology change -application emulation and QoS study - VoIP Spatio temporal QoS Analyser -Pattern detection (generic patterns for data mining rules) -Outlier -Similarity detection Spatio temporal QoS Analyser -Pattern detection (generic patterns for data mining rules) -Outlier -Similarity detection QoS measurement for secified scenario QoS monitoring data base Pattern data base detect router anomaly define pattern owd>2s & singular specify measurements rate, p_size, duration, source, destination,.. measurements analysis if(owd>2s & singular) then anomaly else path_change Scenario:

Slide 919/10/2015 Results (1): Active Topology discovery using traceroute data base  Objective: study of topology properties of the connection  number hops,  availability of the routers  long term reporting : per hour, day  BGP issues ( security,...)  Separation of measurement results per path Salzburg-Madrid red: router not responding brightness: RTT blue: some RTT > e2e_RTT

Slide 1019/10/2015 Results (2) Piecewise linear approximation data as sequences of straight lines, optimise the tradeoff between high level of aggregation of measurement results „pieces“: set of consecutive measurement points with „similar“ gradient d_measurement(t)/dt plain : gradient =0 increasing : gradient >0 decreasing: gradient <0 „similarity“ : tolerance parameter d Pattern Description Language (PDL)

Slide 1119/10/2015 Salzburg-Sao Paulo: router anomaly ?

Slide 1219/10/2015 improved outlier analysis e.g. prediction optimised (ARIMA) symbolic representation for pattern detection {R} -> {a,b,c,..} evaluation tradeoff : information loss, compression InterDomain Forum Cluster audio QoS pattern analysis ( ITU E.855, perceptual QoS ) prototype for global controller ( GEANT ?) MOME cluster anomaly detection for network security monitoring and modelling for network planning 3. Future Work