1. MBD Techniques for Internet Delay Diagnosis Roni Stern and Meir Kalech Information Systems Engineering, Ben-Gurion University, Israel 7. Future Work Diagnosing delays in more complex network models: Dynamic routing – a traffic flow has several routes. Different levels of Quality of Service (QoS) Robustness to incomplete or inaccurate network model. Evaluation on a real large scale computer network. 7. Future Work Diagnosing delays in more complex network models: Dynamic routing – a traffic flow has several routes. Different levels of Quality of Service (QoS) Robustness to incomplete or inaccurate network model. Evaluation on a real large scale computer network. 1. Motivation Computer networks are growing in size and complexity. Network administrators and ISPs wish to maintain a high quality of service. Faulty network component causes abnormal delays, experienced by users. How to identify faulty network components causing abnormal delays? 1. Motivation Computer networks are growing in size and complexity. Network administrators and ISPs wish to maintain a high quality of service. Faulty network component causes abnormal delays, experienced by users. How to identify faulty network components causing abnormal delays? 2. Problem Description Given: a network model and a set of abnormal observed delays. Model: 1. A graph of computers and network components, 2. Expected delays Abnormal observed delay [γ(flow)]: Unexpected delay observed by end-user. 2. Problem Description Given: a network model and a set of abnormal observed delays. Model: 1. A graph of computers and network components, 2. Expected delays Abnormal observed delay [γ(flow)]: Unexpected delay observed by end-user. R1R1 A1A1 A5A5 A3A3 R8R8 R2R2 R3R3 R4R4 A2A2 R7R7 R6R6 A4A4 A7A7 A8A8 R5R5 γ(F 5,8 )=1 γ(F 1,6 )=2 γ(F 2,7 )=0 γ(F 2,4 )=0 γ(F 3,6 )=1 γ(F 2,8 )=1 R9R9 A6A6 3. Goal Find a set of network components that explains the observed delay if abnormal 3. Goal Find a set of network components that explains the observed delay if abnormal y(F i,j ) = Abnormal delay in network flow from i to j = # network components (R i ) that are abnormal Find {Ri,..Rj} such that if abnormal, the observed delay is explained (for example: {R 1,R 3,R 8 }). 4. MBD Approach Formalize the problem as an MBD problem. Apply a diagnosis engine to find the abnormal delays. 4. MBD Approach Formalize the problem as an MBD problem. Apply a diagnosis engine to find the abnormal delays. Example 4.1 Network Delay Diagnosis Engine (NDDE) For every abnormal observed delay in size O choose γ(O) components. A diagnosis is a subset of components that satisfy all the observations. NDDE+: Prune network components that are part of normal flows. 4.1 Network Delay Diagnosis Engine (NDDE) For every abnormal observed delay in size O choose γ(O) components. A diagnosis is a subset of components that satisfy all the observations. NDDE+: Prune network components that are part of normal flows. 5. Linear Programming Approach Formalize the problem as a linear program. Run a linear programming solver (e.g. cvxopt) 5. Linear Programming Approach Formalize the problem as a linear program. Run a linear programming solver (e.g. cvxopt) Assumption: Delays are binary – zero or one Example 6. Experimental Results Real networks were simulated with the standard network simulator NS2. Generated scale-free networks using the Barabasi-Albert (1999) model. Varied with Probability of a network component to add abnormal delay The number of available observations The size of the network 6. Experimental Results Real networks were simulated with the standard network simulator NS2. Generated scale-free networks using the Barabasi-Albert (1999) model. Varied with Probability of a network component to add abnormal delay The number of available observations The size of the network No need for binary delays assumption 20% abnormals 70 observations 20% abnormals 5 observations LP is better for large number of observations Solving an LP is polynomial, while NDDE is exponential NDDE is better for small number of observations, due to LP overhead.