Adaptive and automated detection of service anomalies intransaction-oriented WANs: network analysis, algorithms, implementation,and deployment

摘要

Algorithms and software for proactive and adaptive detection ofnnetwork/service anomalies (i.e., performance degradations) have beenndeveloped, implemented, deployed, and field-tested forntransaction-oriented wide area networks (WANs). A real-time anomalyndetection system called TRISTAN (transaction instantaneous anomalynnotification) has been implemented, and is deployed in the commerciallynimportant AT&T transaction access services (TAS) network. TAS is anhigh volume, multiple service classes, hybrid telecom and data WAN thatnservices transaction traffic in the U.S. and neighboring countries.nTRISTAN adaptively and preactively detects network/service performancenanomalies in multiple-service-class-based and transaction-orientednnetworks, where performances of service classes are mutually dependentnand correlated, where environmental factors (e.g., nonmanaged ornnonmonitored equipment within customer premises) can strongly impactnnetwork and service performances. Specifically, TRISTAN implementsnalgorithms that: 1) sample and convert raw transaction records tonservice-class based performance data in which potential networknanomalies are highlighted; 2) automatically construct adaptive andnservice-class-based performance thresholds from historical transactionnrecords for detecting network and service anomalies; and 3) performnreal-time network/service anomaly detection. TRISTAN is demonstrated tonbe capable of proactively detecting network/service anomalies, whichneasily elude detection by the traditional alarm-based network monitoringnsystems