Agent-based Simulation Study of Behavioral Anticipation: Anticipatory Fault Management in Computer Networks

Transcription

1 Agent-based Simulation Study of Behavioral Anticipation: Anticipatory Fault Management in Computer Networs Avdhoot Saple M&SNet: AMSL (The Auburn Modeling and Simulation Laboratory) Computer Science and Software Engineering Auburn University Auburn, AL, USA Levent Yilmaz M&SNet: AMSL (The Auburn Modeling and Simulation Laboratory) Computer Science and Software Engineering Auburn University Auburn, AL, USA ABSTRACT Networ fault management is concerned with the detection, isolation, and correction of anomalous conditions that occur in a computer networ. Present state of art in fault management classifies existing methodologies into two main categories: reactive rule based approaches and intelligent monitoring systems. In this paper we explore the concept of anticipatory behavior to develop an intelligent agent-based networ management model, which uses an anticipatory agent to proactively detect occurrence of faults using a predictive model pertaining to networ performance. To compare the effectiveness of the anticipatory technique, we build a simulation model of a networ using the DEVS framewor. Two reactive rule based fault management strategies are compared against the anticipatory approach. Results of the comparative analysis are presented to demonstrate the potential of the anticipatory technique in detecting networ anomalies. Categories and Subject Descriptors I.6.5 [Simulation and Modeling]: Model Development modeling methodologies. General Terms Measurement, Performance, Design, Experimentation. Keywords Intelligent agents, anticipatory agents, simulation, DEVS. 1. INTRODUCTION Networ fault management [8] entails the detection, isolation, and correction of anomalous conditions that occur in a networ. Fault management can be decomposed into three subtass: Permission to mae digital or hard copies of all or part of this wor for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. ACM SE 06, March, 10-12, 2006, Melbourne, Florida, USA Copyright /06/0004 $5.00 fault identification [4], fault diagnosis [1], and fault remediation. Fault identification involves detecting deviation from normal behavior followed by identification of its nature, whereas fault diagnosis involves determining the root cause of the identified problem. Fault remediation is the formulation of a course of action that addresses the problem. All three stages of fault management involve reasoning and decision maing based on information about current and past states of the networ. Anticipatory fault management entails a novel approach of designing agents the precepts of which are based on the premise of anticipatory systems [9]. An anticipatory agent has a model of itself, and it uses this model to predict the future state. The predictions are then utilized to determine agent s behavior. An anticipatory agent is thus an entity which uses the nowledge of predicted future states to decide what action to be taen in the present. Our strategy consists of comparison of an anticipatory technique with two widely popular techniques: reactive rule based strategy and alarm correlation approach. We compare the three techniques based on the following networ performance metrics: throughput, turnaround time, and the drop rate of pacets. To facilitate the experiment, a simulation model of a computer networ is developed using the DEVS modeling and simulation framewor. Reactive and anticipatory agents are embedded into the networ for networ fault management. The reactive agent operates on a simple rule based engine that detects faults based on predefined fuzzy rule-base. We use a Naïve Bayesian classifier as part of the anticipatory agent. The Bayesian classifier acts as a predictive model for the anticipatory agent to facilitate prediction of faults based on past data. Our findings indicate that anticipatory fault management performs significantly better than the reactive and alarm correlation techniques under the experimental conditions the model is tested. The rest of the paper is organized as follows. Section 2 surveys the present state of art in fault management of computer networs. The design of anticipatory systems is described in section 3. In section 4, we discuss the agent based modeling of reactive and anticipatory control in computer networs. We describe the simulation and experimentation design followed by results in section 5 and 6, respectively. In section 7, we discuss open issues as well as planned future wor.

2 2. FAULT MANAGEMENT IN COMPUTER NETWORKS Various techniques such as machine learning [5] and state space modeling [10] are used for fault management. A fault is defined as a malfunction in some component of the networ, either hardware or software. At an abstract level, fault identification can be devised as a function, I, with inputs and outputs. The input to the function is a description of networ state, S, and the output is a set of hypothesis, H, concerning the existence of n different faults. Each hypothesis may specify the indications in S of the corresponding fault and may contain diagnosis information. That is, identification and diagnosis are rarely totally decoupled. Fault identification, therefore is a process of function that maps from networ states to fault hypothesis: I: S H Different approaches to fault identification define S in a distinct manner [8]. 2.1 Rule based approaches Early wor in the area of fault or anomaly detection is based on expert systems. In expert systems, an exhaustive database containing the rules of behavior of the faulty system is used to determine fault occurrence by matching predefined rules of networ anomalies. However, rule based systems are not only often slow for real time applications, but also depend on prior nowledge about the fault conditions of the networ. The identification of faults depends on symptoms that are specific to a particular manifestation of a fault. Examples of these symptoms are excessive utilization of bandwidth, number of open TCP connections, total throughput exceeded etc. [12]. An expert system model using fuzzy cognitive maps (FCMs) [7] can be used to obtain an intelligent modeling of the propagation and interaction of networ faults. 2.2 correlation using State Machines A fault is a disorder occurring in the managed networ. Faults happen within the managed networs while alarms are external manifestations of faults [10]. Finite state machines model alarm sequences that occur during and prior to fault events. For instance, a probabilistic finite state machine model is built for a nown networ fault using historical data [6]. State machines are designed with the intention of not just detecting an anomaly but also possibly identifying and diagnosing the problem. The sequences of alarms obtained from the different points in the networ are modeled as states of a finite state machine. The alarms are assumed to contain information such as the device name as well as the symptom and time of occurrence. The transitions between the states are measured using prior events [4], [10], [2]. 2.3 Pattern Matching This approach describes anomalies as deviations from normal behavior and attempts to deal with the variability in the networ environment [3]. Online learning is used to build a traffic profile for a given networ. Traffic profiles are built using symptom specific feature vectors such as lin utilization, pacet loss and number of collisions. 2.4 Statistical Analysis As the networ evolves, each of the methods described above require significant recalibration or retraining. However, using statistical approaches [12], it is possible to continuously trac the behavior of a networ. Statistical analysis has been used to detect both anomalies corresponding to networ failures [11] as well as networ intrusions. Each of these failure scenarios differ in their manifestations as well as their characteristics. Thus, it is necessary to obtain a rich set of networ information that could cover a wide variety of networ operations. 3. ANTICIPATORY SYSTEMS Anticipation is an important characteristic of intelligence. Proactive behavior requires anticipatory abilities. A seminal wor on anticipatory systems is the one written by Rosen [9]. A brief introduction to and serious concerns about anticipation follows: Strictly speaing, an anticipatory system is one in which present change of state depends upon future circumstances, rather than merely on the present or past. As such, anticipation has routinely been excluded from any ind of systematic study, on the grounds that it violates the causal foundation on which all of theoretical science must rest, and on the grounds that it introduces a telic element which is scientifically unacceptable. Nevertheless, biology is replete with situations in which organisms can generate and maintain internal predictive models of themselves and their environments, and utilize the predictions of these models about the future for purpose of control in the present. Many of the unique properties of organisms can really be understood only if these internal models are taen into account. Thus, the concept of a system with an internal predictive model seemed to offer a way to study anticipatory systems in a scientifically rigorous way" [9]. Perception ability is a required characteristic of agents. Hence, they can be designed to perceive current state of self and others. They can also be designed to create current image(s) of future state(s). Perception requires mechanisms that enable interpretive capabilities. Perception invariably involves sensory qualities, and introspection entails accessing sensations and perceptions the agent would introspect. Perceptions are derived as a result of interpretation of sensory inputs within the context of the current world and agent s self model. The prototype inference, orientation accounting, and situational classification mechanisms could be used to realize the interpretation capabilities of an agent. The interpretation process results in perceptions. An anticipatory agent needs to deliberate upon perceptions through introspection and reflection to anticipate. Figure 1. Basic Components for Anticipatory Agents

3 Introspection is deliberate and attentive because higher-order intentional states are themselves attentive and deliberate. An introspective agent should have access mechanisms to its internal representation, operations, behavioral potentials, and beliefs about its context. Reflection uses the introspective mechanisms to deliberate its situation in relation to the embedding environmental context. These features collectively result in anticipation capabilities that orient and situate an agent for accurate future projections. Figure 1 presents interpretation and introspection as critical components within the micro-architecture of an anticipatory agent. Due to lac of space, in section 4.3, we only provide a brief synopsis of the type of the predictive model used in our wor. 4. AGENT-BASED MODELING OF REACTIVE AND ANTICIPATORY CONTROL The overall architecture of the simulation is primarily composed of the following components (see Figure 2). Networ model: The first component is a basic model of a typical computer networ. The networ model is the basis of the design and experimentation of the fault management techniques. The networ model is designed on a simulation framewor and comprises of basic networ components that would include switches, routers, hosts, and lins. Figure 2. Reactive and Anticipatory Control Monitoring layer: The monitoring layer comprises of multiple monitoring agents that are embedded over individual networ components or on a group of components. (Eg: a monitoring agent is allocated for each subnet). The monitoring agents may have disjoint functions or potentially overlapping responsibilities for increased reliability. Management layer: The management layer comprises of the reactive or the anticipatory agents according to the technique being used. The reactive agent wors on a general rule based approach (if then else). It interprets the data acquired from the monitoring agents and communicates with the control layer to tae corrective action [9]. Control layer: The control layer is responsible for carrying out corrective action with respect to the information it gets from the management layer. 4.1 DEVS Networ model The Networ model is developed in the DEVS (Discrete Event System Specification) formalism. A brief description of the simulated networ components is as follows: Lins: Simulation of lins is carried out on crucial connections in the networ. A lin is looed upon as a processor and its overloading is simulated as the increase in processing time of the processor Switch: A switch forms a connection between different subnets to facilitate forwarding of pacets among them. Router: A router follows certain routing algorithms for forwarding of pacets among hosts. We use the Distance Vector routing strategy, by which the pacets are forwarded to the best nown distance to each destination (the distance is measured in terms of processing time of hosts). Hosts: Hosts are entities that process jobs or payload. They can be networ clients, servers, printers, plotters etc. Monitoring agents: The monitoring agents record performance metrics lie networ throughput, latency and the pacet drop rate. It reports this data to the management layer where the reactive agents infer them as rules and the anticipatory agent updates its predictive model. Management agents: The management agents are the reactive and the anticipatory agents. They receive data from the monitoring agents and induce the control agent to tae respective action. 4.2 Reactive Agents Fuzzy reactive agents are used in the determination of the proneness of failure. The antecedent variables (one or more variables that represent the conditions to be met before any conclusion can be made) are the Throughput and Latency. The consequents which are set of output (proneness of failure or state) for each of the networ components. A sample set of fuzzy rules that are comprised in the reactive agent for a networ component (for instance, a host) can be outlined as follows: If Throughput = High and Latency = Low, Fault_proneness = Low If Throughput = Moderate and Latency = Low, Fault_proneness = Low If Throughput = Low and Latency = Low, Fault_proneness = moderate If Throughput = High and Latency = Moderate, Fault_proneness = Low If Throughput = Moderate and Latency = Moderate, Fault_proneness = Moderate If Throughput = Low and Latency = Moderate, Fault_proneness = Moderate 4.3 Anticipatory Agents The architectural framewor of the Anticipatory agent, shown in Figure 1, consists of a predictive model and an anticipator.

4 Table 1. Sample set of evidence to be processed by the Naïve Bayesian Classifier Obs. Networ Subnet1 Subnet2 Router1 Host1 Host2 Host3 Router2 Host4 Host5 Host6 No 1 High High Normal No Yes No Yes No No No No 2 High High Normal Yes Yes No No No No No No 3 Normal Normal High No No No No Yes No No No 4 Normal Normal Normal No Yes No Yes No No No No 5 High High High Yes No Yes No Yes No No Yes 6 Normal Normal Normal No No No No No No No No 7 High Normal High No No No No No Yes No No 8 Normal High Normal No No No Yes No No No No 9 Normal High Normal No Yes No No No No No No 10. Normal Normal High No No No No No No Yes No 11. High High High No Yes No Yes No Yes No No 12. High High Normal Yes Yes No No No No No No 13. Normal High Normal No No No No No No No No 14. High Normal High No No No No Yes No No Yes We mae use of a Naïve Bayesian Classifier for constructing the predictive model of the anticipatory agent. The strength of the Naïve Bayesian Classifier is that it provides a theoretical framewor for combining statistical data with the prior nowledge about the problem domain for maing future projections. The following example shows how a fault is detected by the anticipatory agent by maing use of the Naïve Bayesian classifier. Consider the sample of evidence specified in Table 1. The Networ taes value High if there is abnormality above a certain threshold in a single or both the subnets and is Normal otherwise. The subnet 1 and subnet 2 tae value High if any of the component in the respective subnets have failed and is Normal otherwise. The probability that there can be a fault in host 1 provided we have evidence that subnet 1 is high is given by p(host1 = yes Subnet1 = High) = (# of times Host1= yes & Subnet1= High) / (# of times Sunbet1 = High) = 5 / 8 Similarly the probability that there can be a fault in host 1 provided we have evidence that subnet 1 is high and networ is high is given by p(host1 = yes Sunbet1= High, Networ = high) = (# of times Host1 = yes & Subnet1 = high & Networ = high) / (# of times Subnet1 = High & Networ = High) = 4/5 But the number of conditional probabilities in a data set can be very high. The Naïve Bayesian classifier model states that Result = arg max C [ p( C ) Πp( A C )], where p(a i C ) = (# of A C ) / (# of C ) It can be illustrated by the following example. Suppose we are given that (subnet1 = High, and Networ = High) and we need to now if there is a fault on host 1? From the above Naïve Bayesian Classifier equation: Result (host1 =yes) = p (Host1 = Yes) * p (Subnet = High Host1 = Yes) * p (Networ = High Host1 = Yes) = (6/14)*(1)*(3/6) = Result (host1 =no) = p (Host1 = No) * p (Subnet = High Host1 = No) * p (Networ = High Host1 = No) = (8/14)*(3/8)*(3/8) = Hence we see that Result (host1 =yes) > Result (host1 =no), and hence the predictive model predicts the potential of fault in host 1. The Anticipator thereby notifies the control layer to tae respective corrective action for host 1. Note that, the set of evidence to the Bayesian classifier is continuously updated according to the events taing place in the networ. After a fixed interval of time (say 5 time units), the classifier computes the result (Result = arg max C[ p( C ) Π p( Ai C )]) based on the state of the components at that time instant. 5. SIMULATION DESIGN The DEVS-based networ model comprises two subnets. Each subnet includes a router and 3 hosts. An experimental frame i i

5 generates the pacets to be processed by the networ components on the basis of a specific inter-arrival time. A fault injection mechanism is also embedded in the experimental frame which generates fault pacets at a random rate. A fault pacet when encountered by a networ component, induces a certain level of degradation in the throughput and latency of the component. The intervals obtained for the reactive vs. alarm correlation technique for all the three parameters comprises of zero. Hence the difference between their means is not statistically significant. Monitoring agents are deployed throughout the networ over each of the networ components to record the performance metrics (throughput, latency and the drop rate) throughout the simulation. The throughput is defined as the average rate of job departures from the architecture, estimated by the number of jobs processed during the observation interval, divided by the length of the interval. A job s turnaround time is the length of time between its arrival to the processor and its departure as a completed job. The drop rate of pacets is defined as the percentage of pacets dropped due to networ faults. A sample screen shot of the DEVS environment is shown in figure 3. The model is comprised of 2 subnets with each of the subnet comprising of networ components (routers and hosts). 6. SIMULATION RESULTS Each of the fault management techniques (reactive and anticipatory) are simulated by varying the levels of the lin delay and the complexity of the networ. The number of replications for each fault management technique is 270. This results from the sum of the replications under each combination of configuration levels (i.e., lin delay, networ complexity). The t test is performed with respect to the mean values obtained for throughput, turnaround time and the drop rate of pacets for each of the fault management technique and the confidence intervals are recorded. From the confidence intervals obtained at 95 percent level we observe that the intervals obtained for the reactive vs. anticipatory and anticipatory vs. alarm correlation for all the three parameters does not contain zero and hence the difference in their mean values is statistically significant. Figure 3. Simulated model in DEVS environment Figure 4 shows the responses obtained for each of the dependent variables. Table 2. Confidence Intervals for performance metrics Correlation Anticipat ory Reactive (-0.025,- Reactive (-0.001,0.019) 0.006) (-0.035,- Correlation (-0.019,0.001) ) Anticipatory (0.006,0.025) (0.014,0.035) : Performance of networ throughput Anticipat Reactive Correlation ory (25.11, 70.19) Reactive (-38.69,15.55) (33.62, Correlation (-15.55, 38.69) ) Anticipatory (-70.19, ) (-84.81, ) : Performance of networ turnaround time Reactive Correlation Anticipat ory (5.67, 9.59) Reactive (-8.54, 1.96) (5.9, Correlation (-1.96,8.54) ) Anticipatory (-9.59, -5.67) (-15.93, -5.9) : Performance with respect to drop rate of pacets

6 Figure 4. Response Surfaces We observe that the throughput obtained in each of the techniques is significantly better at a lower value of lin delay while throughput is less dependent on the complexity of the networ. There is a considerable improvement in the turnaround time at higher levels of complexity. For the drop rate of pacets, the percentage is significantly less at lower values of lin delay; also, there is a significant reduction of drop rate of pacets at higher values of complexity. As shown in Figure 4, performance parameters for the alarm correlation technique shows a linear dependency with respect to variation of the lin delay. Also, reactive and anticipatory techniques are less prone to lin delay until a certain threshold. The linearity exhibited by the alarm correlation technique can be explained by the fact that the fault patterns are recorded before hand and hence the variation of the performance metrics is linear, whereas for the other two techniques this is not the case. 7. CONCLUSIONS AND FUTURE WORK In this paper, we discussed how agent-based behavioral anticipation can be applied to fault management in computer networs. For future wor we intend to improve on the learning criteria of the Bayesian classifier Another improvement involves the extension of the notion of reactive agent to an improved alarm correlation technique by which the sequence of degradation in various networ components can be studied and the data can be used to effectively induce corrective action prior to failure. This technique, if combined with the anticipatory model would result in a high degree of improvement of networ fault management. 8. REFERENCES [1] Agre, J. A message-based fault diagnosis procedure. In Proceedings of the ACM SIGCOMM Conference on Communications architectures & protocols, Vol 6 Issue 3, Aug [2] Bouloutas, A. Hart, G., and Schwartz, M. On the design of observers for failure detection of discrete event systems. In Networ Management and Control. New Yor: Plenum, [3] Feather, F. and Maxion, R. Fault detection in an ethernet networ using anomaly signature matching. In Proc. ACM SIGCOMM, vol. 23, San Francisco, CA, Sept. 1993, pp [4] Katzela, I. and Schwarz, M. Schemes for fault identification in communication networs. IEEE/ACM Trans. Networing, vol. 3, pp , Dec [5] Langley, P. and Simon A. H. Herbert. Applications of Machine Learning. Communications of the ACM. Vol.38. No [6] Lazar, A., Wang, W., and Deng, R. Models and algorithms for networ fault detection and identification: A review. In Proc. IEEE Int. Contr. Conf., [7] Ndousse, D. T.and Ouda, T. Computational intelligence for distributed fault management in networs using fuzzy cognitive maps. In Proc. IEEE ICC, Dallas, TX, Jun. 1996, pp [8] Oates, T. Fault identification in Computer Networs: A Review and a New Approach. CS-TR [9] Rosen, R. Anticipatory Systems Philosophical, Mathematical and Methodological Foundations. Pergamon Press, New Yor. [10] Rouvellou I. and Hart, G. Automatic alarm correlation for fault identification. In Proc. IEEE INFOCOM, Boston, MA, Apr. 1995, pp [11] Thottan, M. Fault detection in ip networs. Ph.D. dissertation, Rensselaer Polytech. Inst., Troy, NY, Under patent with RPI. [12] Thottan, M. and Ji C. Anomaly detection in IP Networs. IEEE Transactions on signal processing, vol.51, No.8, August 2003.