Date of Award

2021-12-01

Degree Name

Doctor of Philosophy

Department

Engineering

Advisor(s)

Michael P. McGarry

Abstract

This work presents the Network Link Outlier Factor (NLOF), a data analytics pipeline for network fault detection and localization solution that consists of four stages. In the first stage, flow record throughput values are clustered in two sub-stages: using Density-Based Spatial Clustering of Applications with Noise (DBSCAN) and then a novel domain-specific ThroughPut Cluster (TPCluster) technique. In the second stage, Flow Outlier Factor (FOF) scores are computed for each flow. In the third stage, flows are traced onto the network. Finally, in the fourth stage, each link is given a Network Link Outlier Factor (NLOF) score which is the ratio of outlier flows to all flows that traversed the link. The performance of NLOF scores used to localize faults was appraised using NS-3 simulations and Mininet emulations. It was found that the NLOF score of a link is correlated with a fault, as faulty links will have significantly higher NLOF scores than links that are not faulty. NLOF is also able to localize both edge and core link faults in as little as 220 seconds of the fault occurring. NLOF only produced false positives in the case of faults on core links which was mitigated using topological relationships, greatly reducing the number of false positives. To further reduce false positives, the Most Likely Links (NLOF:MLL) method replaces the third and fourth stages of the NLOF pipeline with an iterative weight-based algorithm for estimating the likelihood that a link is the source of a fault. The performance of NLOF:MLL is compared with NLOF without MLL, a traditional abrupt change detection technique, and a recent fault localization technique known as 007. 54 scenarios on 3 different topologies, with varying locations and severities for the faults generated, were emulated to compare the 4 solutions. 007, the abrupt change solution, NLOF, and NLOF:MLL had average F1-scores of 0.018, 0.110, 0.350, and 0.837, respectively. A pairwise t-test showed a statistically significant difference between F1-scores of all 4 solutions. The experimental results indicate that NLOF:MLL can accurately localize network link faults over a wide range of scenarios and can outperform both traditional and recent similar works.

Language

en

Provenance

Received from ProQuest

File Size

174 p.

File Format

application/pdf

Rights Holder

Christopher Mendoza

Download

Share

COinS