Scalable Fault Detection and Localization of Network Issues

In order to better support network management, network operators need the appropriate network analysis tools and services. However, only a small fraction of collected measurement data is ever examined or analyzed, due to the lack of automated tools. Moreover, current network/cyber analysis tools are typically associated with one specific types of network measurement data. More tools are needed to integrate multiple types of measurement data for a better analysis. All the above impair the network operators ability to accurately and quickly gain the needed understanding of network status and maintaining the network effectively and promptly. Situation is Being Addressed: To address the above issues, Intelligent Automation, Inc. (IAI) is developing NetFaultSONAR, a scalable and advanced network fault and cyber analysis tool/services. It takes network data as input from data repository, interpret network status by showing performance metrics, conduct network analysis to detect and identify potential issues, and provide analysis results to the network operators through graphic interface. What was done in Phase I: In Phase I, we successfully implemented anomaly detection algorithms for different types of network measurement data, and tested them using the real data or emulated data. We also implemented the root-cause analysis scheme on a simulation platform, and successfully tested it using the emulated anomalies and validated its feasibility, scalability and complexity. What is planned for the Phase II project: In Phase II, we will further develop NetFaultSONAR to provide better network understanding and data analysis. The core functionalities of NetFaultSONAR system include data collection and preprocessing, anomaly detection, topology/service information retrieval, event correlation across different sources and types of measurement data, root cause analysis, and data visualization. Commercial Applications and Other Benefits: The proposed network analysis tool has the potential to greatly reduce overall operational costs, whilst maintaining or even enhancing the reliability of existing networks. Moreover, due to the heterogeneous and complex nature of scientific networks, the proposed network and cyber analysis solution can be applied to the operation of a full range of DOE and partner networks, i.e., including ESnet local networks at DOE national laboratories, and those at numerous collaborating institutions and universities across the world. In addition to DOE and partner networks, a broad range of companies and organizations can also benefit from our proposed tools, such as small/ medium company networks, backbone network, DOD military networks, etc.