1. Maximum Likelihood Network Topology Identification Mark Coates McGill University Robert Nowak Rui Castro Rice University DYNAMICS May 5 th,2003

2. Network Tomography Inferring network topology based on “external” end-to-end measurements. Traceroute requires cooperation of routers: May not be met in practice This paper assumes no internal network cooperation Solely host-based unicast measurements

4. How does it work? The Problem Statement R Unique Sender

5. How does it work? Information we have End-to-end measurements that measure the degree of correlation between receivers Associate metric  i,j with pair of receivers i,j  R Monotonicity property: p i,p j,p k : Paths from sender to i,j,k If p i shares more links with p j than with p k, then  i,j >  i,k

6. An example Here  18,19 >  i,19 for all other i Examples ? Simple Bottom-up merging algorithms can be used to identify full, logical topology

7. Two-fold Contribution Novel measurement scheme: –Sandwich Probing –Each probe: three packets –Main Idea: Small packets queues behind the large, inducing extra seperation between small packets on shared links A stochastic search method for topology identification

8. Sandwich Probing  01 : queuing delay of p 2 on link 0  1,  35 =  01  ij : sum of  ’s on the shared links to receiver i and j no cross-traffic: p1p1 p2p2

9. more shared queues  larger   34 =  01 +  12  35 =  01 Sandwich Probing

10. Advantages over loss and delay based metrics  Probe loss is rare on Internet. Large number of measurements required  For measuring delay, clock sync required  Each measurement contributes here.

11. Measurement framework Measurement of  ij contaminated by cross traffic Multiple measurements CLT Cross traffic: zero-mean effect on

12. Likelihood Formulation Estimated metrics are randomly distributed according to density p p parameterized by underlying topology T and set of true metric values When is viewed as function of T and , it is called the likelihood of T and .

13. Likelihood Formulation Maximum Likelihood Tree is given by: F denotes forest of all possible trees G denotes set of all metrics satisfying monotonicity property Maximization involved is formidable Brute Force method: for N = 10, more than 1.8 x 10 6 trees

14. Simplifying the problem Parameters  are chosen to maximize the value for a given tree T To provide the very best fit T can provide to Data Log likelihood of T Maximum Likelihood Tree is the one in the forest that has the largest likelihood value

15. Stochastic Search Reversible Markov Chain Monte Carlo Method Using above techniques, authors devise a rapid search method to find optimal trees. “Learning using Bayesian Statistics” Prior and Posterior distributions Main Idea: Posterior Distribution gives the region of high likelihood trees in F

16. Birth Move (insert node) T 1 T 2

17. Death Move (delete node) T 2 T 1

18. ns-2 Simulations source 1 234 5 6 7 8 9

19. 20 40 60 80 100 400060008000 Simulation results % Correct Number of Probes DBT MPLT

20. MCMC Algorithm true topologyMCMC topology Can Layer 2 branching points High speed connections can fool tomography

21. Summary Delay-based measurement, no need for clock synchronization MCMC algorithm to explore forest and identify maximum (penalized) likelihood tree