Automated Network Performance Management and Monitoring via One-class Support Vector Machine

Size: px
Start display at page:

Download "Automated Network Performance Management and Monitoring via One-class Support Vector Machine"


1 Automated Network Performance Management and Montorng va One-class Support Vector Machne R. Zhang, J. Jang, and S. Zhang Dgtal Meda & Systems Research Insttute, Unversty of Bradford, UK Abstract: In ths paper, we report a support vector machne (SVM) based network performance montorng algorthm and system, whch s developed under MDS (Msuse Detecton System), a European FP6 funded project, towards ntellgent network performance analyss and management. Whle most exstng network performance management systems adopted by the telecommuncaton ndustry are lmted to rule-based technques, our proposed algorthm features n machne learnng and ntellgent computng approaches. Gven the network traffc nput, the proposed algorthm extracts data patterns to enable a one-class SVM to learn the normal behavor of the network and adaptvely detect anomales. The strength of our work les n the fact that the proposed system s not only able to detect anomales adaptvely, but also detect the contexts they occur, and thus provdng a powerful tool for automated network performance montorng and management. Extensve experments on practcal telecommuncaton network traffc data are carred out and the results support that the proposed algorthm effectvely detect anomales from network traffc and hence applcable to establshment of an automated and onlne network performance montorng system. Keywords: Anomaly Detecton, Performance Management, Supportng Vector Machne, Telecommuncaton Network 1. Introducton As modern telecommuncaton networks grow rapdly wth varous communcaton systems and ncreasng amount of network elements, how to montor and manage the network elements has becomng the man topc of network performance management. Automated network performance management has the goal of ncreasng relablty and performance of the network whle reducng management cost usng varous automated technques. Beng faced wth never endng streams of network performance data recorded by the systems, an automated performance management system has to deal wth varous knds of data va learnng process, and react and dentfy the anomaly actvtes as fast as possble f network falures/anomales occur. Anomaly detecton usually conssts of two phases, a normal profle of the montored data s frst establshed and the normal profle s then used to dentfy the anomales that devate from the normal profles [1]. Telecommuncaton network performance data, whch are also known as Key Performance Indcators (KPIs), are used to characterze the network behavor and therefore used for network anomaly detecton. For a certan element n the network, the performance data has ts own typcal trend and dfferent elements have ther typcal KPI values. Any KPI value that s suddenly devate from the normal trend s consdered as abnormal and that would ndcate an anomaly on the KPI 1

2 values. In general, the anomaly/alarm s generated when there s a sudden drop of the KPI value and n some stuatons alarm s also generated on a sudden rse of the KPI value. Up to now, most of the exstng performance management systems n practce are bult based on defned rules [2] and ther performances manly depend on the rule sets. In rule-based systems, the anomaly detector uses pre-defned rules to classfy data as normal or abnormal. To montor the network performance, a pre-defned threshold s set for a certan KPI and f any drop or ncrease of the KPI value crosses the threshold, an alarm s generated. Although the nformaton of rules s valuable and applcable n practce, t s often a tedous and tme consumng task due to the enormous amount of network traffc data, and most mportantly the defned rules cannot cover all the complcated and unexpected behavors emerged from the networks. Fgure 1 llustrates some examples of the performance data, where the varyng nature of the performance data makes t extremely dffcult to determne approprate thresholds to cover all the possbltes and accommodate all the performances on dfferent nodes nsde the network. As a result of such statc settng of thresholds or rules for dfferent ndcators, the operator screen s often flooded wth alarms and abnormal behavor propagates along the connected nodes of the network. If effcent analyss tools were avalable, t could become possble to detect abnormal behavors, provde advance warnng of possble anomales, and take actons to suppress the alarms approprately before they propagate across the network. Therefore, Artfcal Intellgent (AI) based detectors are expected to learn the normal behavor of the ndcators and to drastcally reduce the volume of alarms presented to the admnstrator. Fg. 1. Quanttatve performance data for the same day n three weeks Exstng work reported by researchers on anomaly detecton [3],[4] can be categorzed nto three approaches, supervsed learnng, unsupervsed learnng and sem-supervsed learnng dependng on the background knowledge of the data avalable [5]. They can be also categorzed nto statstcal methods, machne learnng based method and data mnng based methods. In statstcal technques[6], [7, 8] the underlyng data dstrbutons are known a pror. The parameters of the dstrbuton are frst estmated, and the anomales are flagged as those data wth low lkelhood gven that dstrbuton. Whle statstcal approaches have the capablty of detectng unknown anomaly, they are senstve to the normalty assumpton for the performance data. If the data measured are not normally dstrbuted, as a result, these approaches wll produce a hgh false alarm rate. Some of the statstcal methods are predomnantly un-varate, n whch each measurement varable s modeled ndependently usng a separate dstrbuton. In practce, however, ntrusons always affect multple measurement varables. For those multvarate statstcal approaches, whch use a fxed jont dstrbuton for all measurement varables, a complex 2

3 learnng procedure s requred n order to estmate a sgnfcant number of parameters. Machne learnng technques for anomaly detecton nvolves learnng the behavor of the data and recognzng sgnfcant devatons from the normal. Several researchers have ntroduced Bayesan networks based system for anomaly detecton [9],[10], whch also has a range of lmtatons n terms of actual mplementaton, although Bayesan networks can be effectve n some cases. As the accuracy of Bayesan network based approach s hghly dependent on an accurate model, the selecton of an accurate model proves to be an extremely dffcult task n realty as practcal networks are very complex. Hdden Markov model s also employed extensvely for anomaly detecton [11], [12]. Results show that whle hdden Markov models outperform the other methods, the hgher performance comes at a greater computatonal cost. The one major of machne learnng algorthm s that they are resource expensve and not scalable for real tme operaton due to the large amount of data and the complexty of the networks. Researchers are ncreasngly lookng at data mnng based approaches for anomaly detecton. These approaches have the flexblty to dynamcally estmate normal behavor from the observed data and dentfy anomales, and they are found to be more sutable for onlne applcatons. A varety of classfcaton-based technques have been proposed n the lterature, such as fuzzy logc [13], genetc algorthms [14], [15], neural network [16], [17], [18], [19],[20], and support vector machne [21], [22], K-nearest neghbor (KNN) [23], [24], however labeled data are requred for these algorthms. Clusterng algorthms [15], [25] do not need labels of tranng samples, but they always need parameters to specfy a proper number of segmentaton or clusters and the detecton procedure has to shft from one state to another state. Negatve selecton algorthms [26],[27] are desgned for one-class classfcaton; however, these algorthms can potentally fal wth the ncreasng dversty of normal sets, and ther executon tme of negatve selecton could be too long to provde any realstc solutons. To ths end, we propose an automated network performance montorng algorthm wth one-class support vector machne (OCSVM), and llustrates ts advantages that t can handle huge amount of varous performance data va adaptve learnng, and detect anomales effcently and effectvely for practcal network performance management. Ths work descrbed n the paper s based on the research fndngs n a EU FP6 funded project, MDS (msuse detecton system), and the data used s the real telecom network performance data provded by a commercal network servce provdng partner wthn the MDS consortum. The rest of ths paper s organzed as follows: Secton 2 dscusses the research problem ncludng the descrpton of the network performance data and the requrements for an automated performance management system. In Secton 3, the preprocessng methods for feature extracton of the data and the OCSVM algorthm are ntroduced. In Secton 4, we present the network performance management system. Experments are carred out on dfferent data sets and the expermental results are gven n Secton 5. Conclusons and future works are dscussed n Secton Research Problem 2.1. Telecommuncaton Performance Data Under the EU FP6 funded MDS project, the performance management data contans qualtatve and quanttatve data of network elements from a range of dfferent telecommuncaton networks. Qualtatve data as shown n Fg. 2 measure the servce qualty of a network element. These KPI values are measured n percentage between zero and hundred. Examples of qualtatve KPIs are the system nterchange success rate and pagng success rate. Instead of recordng the percentage number, quanttatve type data trace the 3

4 traffc at each servce pont n the network. Fg. 3 shows the performance quantty traces of a servce for three consecutve days. The values of the qualtatve and quanttatve data are logged at 15 mnutes ntervals throughout the day, and thus 96 raw values per day per recordng. In Fg. 2 and Fg. 3, each has 288 KPI values recorded for three consecutve days Fg. 2. Example of qualtatve data for three consecutve days. Fg. 3. Example of quanttatve data for three consecutve days. The whole telecom network performance management data nvestgated n ths research contan over 180,000 network elements from three telecommuncaton subsystems and each element has a certan number of KPIs. All the elements from one subsystem have the same types of KPIs. Table I lsts all the KPIs and ther characterstcs from the three subsystems. Table I: Lst of KPIs and ts characterstcs n three telecom subsystems No. KPI name Type mn max KPI characterstcs 1 ATTEMPTS # 0 daly curve 2 SEIZURES% % the hgher the better 3 TRAFFIC # 0 daly curve 4 DROPPED # 0 the lower the better 5 DROPPED% % the lower the better 6 BLOCKS # 0 the lower the better 7 BLOCKS% % the lower the better 8 AVAILCH% % the hgher the better 9 UTIL% % not too low and not too hgh 10 NORMSEIZS # 0 daly curve 11 HOATTEMPTS # 0 daly curve 12 HOOK% % the hgher the better 13 CSSR% % the hgher the better 14 CSTR% # the hgher the better 15 CATTEMPTS # 0 daly curve 16 CSEIZURES% % the hgher the better 17 CTRAFFIC # 0 daly curve 18 CDROPPED # 0 the lower the better 19 CDROPPED% % the lower the better 20 CBLOCKS # 0 the lower the better 4

5 21 CBLOCKS% % the lower the better 22 CAVAILCH% % the hgher the better 23 CUTIL% % not too low and not too hgh 24 LLCDATA # 0 daly curve 25 PDCHATT # 0 daly curve 26 PDCHOK%% % the hgher the better 27 TBFREQ # 0 daly curve 28 TBFOK% % the hgher the better 29 RLCBLK # 0 daly curve 30 ATTPDPACT2G # 0 daly curve 31 ATTPDPACT3G # 0 daly curve 32 SUCPDPACT2% % the hgher the better 33 SUCPDPACT3% % the hgher the better 34 ATTACHOK2G% % the hgher the better 35 ATTACHREQ2G # 0 daly curve 36 INTERRAU2G% % the hgher the better 37 INTRARAU2G% % the hgher the better 38 INTERRAU2G # 0 daly curve 39 INTRARAU2G # 0 daly curve 40 ATTACHOK3G% % the hgher the better 41 ATTACHREQ3G # 0 daly curve 42 INTERRAU3G% % the hgher the better 43 INTRARAU3G% % the hgher the better 44 INTERRAU3G # 0 daly curve 45 INTRARAU3G # 0 daly curve 46 CSSR_CS% % the hgher the better 47 CSSR_PS% % the hgher the better 48 RRC_CS% % the hgher the better 49 RAB_CS% % the hgher the better 50 RRCCSATT # 0 daly curve 51 RABATTCS # 0 daly curve 52 RRC_PS% % the hgher the better 53 RAB_PS% % the hgher the better 54 RRCPSATT # 0 daly curve 55 RABATTPS # 0 daly curve 56 CSTR_CS% % the hgher the better 57 CSTR_PS% % the hgher the better 58 DROP_CS% % the lower the better 59 DROP_PS% % the lower the better As seen from Table I, there are altogether 59 types of KPIs and each KPI belongs to ether # or % type, where # ndcates a quanttatve KPI and % ndcates a qualtatve KPI. For the % type KPI, 5

6 ts value ranges from 0 to 100 and for the # type KPI, the value ranges from 0 to. These KPIs have ther own characterstcs and all the KPIs can be dvded nto four categores based on ther roles n montorng certan aspect of the network performances: 1. The KPIs, SEIZURES%, f the KPI value s hgher, t ndcates a better condton of the network element, whlst a lower value could ndcate a problem and an anomaly may need to be detected; 2. The KPIs, DROPPED%, where lower values are normally expected and hgher values could ndcate anomales; 3. The KPIs, ATTEMPTS, they follow the trend of a daly curve and f any values dervate too much from the daly curve at certan tme, an anomaly could be detected; 4. The KPIs, UTIL%, the value should be not too hgh and not too low. Too low or too hgh values could ndcate anomales. Due to the dfferent trends and normal behavors of each network element and ts KPIs, all the KPI-element pars need to be analyzed ndvdually. Suppose there exst 1,000 network elements and each of them contan 20 KPIs, there wll be 20,000 KPI-element pars. In addton to the complexty and the massve amount of the network performance data, the practcal data recorded by the telecommuncaton system also nclude abnormal behavor descrpton data, whch are structured nto three categores, ncludng mssng values, bad data and constant data. Mssng values are those KPI values that are not recorded due to the falure of recordng. As we know that for % type data, the data range from 0 to 100, however there are some KPI values out of ths range, e.g., negatve values (<0) and very large values (>100), and those data are regarded as bad data under the project testng. For # KPI values, some constant data exst n the data set,.e., f a same KPI value s recorded constantly over a predefned number of tmes, the same values occurred subsequently wll be labeled as constant data and reported as alarms. All these three categores of abnormal data need to be handled n the tranng process n order to make sure that they won t affect the tranng of the anomaly detector. These abnormal data also need to be flagged as alarms durng tranng and detecton process but under a lower constrant level snce the cause of such alarms s the recordng problem rather than network falure Tranng and Detecton Data Format As explaned above, there are large amount of network elements wth a large number of KPIs, and thus the tranng data fle should be effcent enough for offlne tranng. The tranng data fle used n our system allows the user to contan any number of network elements from the same network. Such format wll greatly reduce the number of tranng fles, save the storage space, shorten the tme for preparng tranng data fles, and thus speed up the tranng process. Table II gves the format of tranng data fle used n our experment. In ths format each row contans all the KPI values of a gven network element at a gven tme. The a1#, a2%,, KPIz on the frst row represent the dfferent KPIs of the element and each column n the data s the recorded values of one KPI. The nformaton of network element name and the recordng tme are also gven n Column 1 and Column 2 respectvely, and ths nformaton wll be used whle reportng the alarms to the admnstrator. In the tranng data fle, every 960 rows are the network performance data of 10 consecutve days recorded from the same network element. For each element, 960 values from tme T1 to T960 of a certan KPI wll be used to generate an anomaly detector for ths KPI-element par and therefore, the number of anomaly detectors wll be (number of element) (number of KPIs) for each tranng fle. 6

7 Table III shows the data format for onlne detecton, where the data are recorded n real tme and mmedately passed on to the system for analyss. Durng onlne detecton, the elements of dfferent networks can be mxed together, e.g., Row 1 and Row 2 can be the KPI values of dfferent network elements from the same or dfferent networks. TABLE II - Format for tranng seres Element name tme a1# a2% a3# a4% KPIa... KPIz 1 T T T T T1... T960. n T1. T TABLE III - Format for detecton data stream Element name tme A1# a2% a3# a4% KPIa 1 Tx 2 Tx n Tx 1 Ty 2 Ty n Ty 2.3. Requrements for the Network Performance Management System Correspondng to the network performance montorng requrement, our proposed management system for anomaly detecton s composed of two phases: detector learnng phase and onlne detecton phase. Durng the learnng phase, the normal behavors of network elements s learned n order to generate the anomaly detectors, and n the second phase, the detectors are employed on onlne performance data to detect and report the abnormal behavors to the network admnstrator. Some fundamental requrements of such system are dscussed as follows, whch need to be satsfed for the dscovery of normal behavors and the recognton of anomales. A. Requrements for the Learnng Procedure Unsupervsed Learnng: The nformaton about whether a certan KPI value s normal or abnormal s unknown, and therefore an unsupervsed learnng technque has to be taken. 7

8 Output: As dfferent KPIs and elements have ther own characterstcs, an anomaly detector for each KPI-element par should be generated after learnng. In order to valdate these detectors, the tranng fle consstng of 10 days data s used and the anomales detected n the tranng data are presented to the admnstrator. Based on the anomales results, the admnstrator wll determne whether the detector should be kept for detecton procedure or dscarded at ths stage. Adaptablty: As each KPI data has ts own character, the system should allow the operator to set dfferent parameters n the learnng algorthm to produce a satsfed detector for each type of data. Uncertanty: Due to the performance of recordng system, some abnormal data exst n the data set as ntroduced above. The system should be capable of dealng wth these uncertanty cases. B. Requrements for the Detecton Procedure General: Because of the huge amount of the network performance data streams, the system should be effcent enough for onlne detecton. Output: The output of the system should be easly understood by the operator. The anomales need to have dfferent severty, whch can help the operator to determne the prorty of handlng these problems. Uncertanty: The detecton approach should also be able to cope wth recordng problems, such as mssng values, bad records, and constant data, and generate a low severty for these anomales. Experts Knowledge: When the network falures happen, the anomales should be detected among several KPI values of the same network element, among whch the experts knowledge of the relatonshps between dfferent KPIs should be exploted to flter out the false alarms. 3. The Proposed Algorthm Desgn 3.1. Data Pre-processng As the quanttatve data presents a nonlnear nature of the performance curve, and t dffers n the value ranges through dfferent weeks, t wll be dffcult to use the data drectly for tranng and testng. In order to produce feature set for the data and construct nput vectors for the SVM learnng process, pre-processng of the raw KPI data s requred. Addtonally, as the detecton results wll be heavly based to the data ponts wth extremely large values n OCSVM, the data pre-processng also enable most of the values to be close to the orgn. Accordng to the characterstcs of the KPIs, four pre-processng methods are adopted to extract the feature set. A feature set F = y, y, L, y } of a data set T = x, x, L, x } s defned as follows: { 1 2 l { 1 2 l 1. For quanttatve data wth daly curve, as t s known that network falures cause the snkng or rsng of the KPI values, the frst order gradents of the data set are proposed as follows to characterze the feature of the quanttatve data n assocaton wth the daly curves. 8

9 y 1 = 1 ( x x ) (1) 1 y = = {2, L, l} AVG where AVG s the average of the 96 KPI values on the same day, whch functons as a normalzaton parameter. 2. Wth the quanttatve data where KPI values are essental to provde ndcaton of the network performances, we smply propose the followng feature to characterze the nput streams wthn certan level of tme nterval: x y = = { 1, L, l} (2) AVG As seen, ths feature measures the proporton of each data sample wth respect to an average value over a fxed wndow to ndcate the network performance. 3. For the qualtatve data, where the deal value s set as a fxed value by the network servce provder, the followng feature s extracted n our proposed algorthm, where γ represents the fxed deal value: ( x γ ) y =, = {1, L, l} (3) For qualtatve data, where the KPI value drectly ndcates the level of network performances, we propose to extract the feature as follows: x y = = {1, L, l} (4) One-class Supportng Vector Machne The support vector machne (SVM) [28] s a famly of learnng algorthms for classfcaton of data nto two classes. The dea of SVM s to map the tranng data of two classes nonlnearly nto a hgher-dmensonal feature space, and construct an optmal separatng hyperplane, whch s defned as the one wth the maxmum margn or separaton between the two classes. Ths optmal hyperplane can be solved easly usng a dual formulaton. The soluton s sparse and only support vectors are used to specfy the separatng hyperplane. The number of support vectors can be very small compared to the large sze of the tranng set and only support vectors are mportant for predcton of future ponts. By the use of kernel functon, t s possble to compute the separatng hyperplane wthout explctly carryng out the mappng operatons nto the feature space, and all necessary computatons are performed drectly n the nput space. The SVM has shown superor performance n the classfcaton problem and has been used successfully n many real-world problems. However, the weakness of SVM s that t needs the pror labeled data and s very senstve to nose. A relatvely small number of mslabeled examples can dramatcally decrease ts performance. 9

10 Scholkopf et al. suggested a method of adaptng the SVM methodology to the one-class classfcaton problem [29]. Ths OCSVM s a natural extenson of the support vector algorthm to the case of unlabeled data, especally for detecton of outlers [30], [31], [32], [33], [34]. The OCSVM separates outlers from the majorty and ts strategy s to map the data nto the feature space correspondng to the kernel and to separate them from the orgn wth maxmum margn. The OCSVM can be consdered as a regular two-class SVM where all the tranng data les n the frst class and the orgn s the only member of the second class as shown n Fg. 4 [35] Normal data Orgnal Anomales Fg. 4. Quanttatve data for the same day n three weeks n Specfcally, gven a tranng data set wthout any class nformaton, x R, = 1,2,..., l, where s the number of data ponts n the tranng set, R n s the nput space and n s the dmenson of the nput space. Φ (x) s a mappng functon that transforms x from the nput space to the feature space F. A hyperplane or lnear decson functon f(x) n the feature space F s constructed as T f ( x) = w Φ( x) ρ to separate as many as possble the mapped vectors { Φ( x ), = 1,2,..., l} from the orgn, where w s the norm perpendcular to the hyper-plane and ρ s the bas of the hyperplane. In order to solve w and ρ, t needs to solve the followng optmzaton problem, mn w, ξ, ρ : 1 2 T 1 w w + vl l = 1 ξ ρ T Subject to w Φ ( x) ρ ξ, ξ 0, = 1,2,..., l where ξ are slack varables that are penalzed n the objectve functon and ν (0,1), whch s the parameter that controls a trade-off between maxmzng the dstance of the hyperplane from the orgn and the number of data ponts contaned by the hyperplane. In other words, when v s small, fewer data fall on the same sde of the hyperplane as the orgn n the feature space F. In order to solve (6), Lagrange multpler α s ntroduced to each x and the optmzaton problem of (6) can be transferred to solve the followng optmzaton (5) (6) 10

11 mn α : 1 2 l l = 1 j = 1 α α K ( x, x ) j j (7) 1 Subject to: 0 α, α = 1 vl = 1 where K( x, x j ) = Φ( x ) Φ( x j )[36], whch s a kernel functon n the nput space. Accordngly, the decson functon f(x) becomes a nonlnear functon, whch can be descrbed as: N = 1 l f ( x) α K ( x, x) ρ (8) = sv After tranng, only a small number of samples wth 1 0 < vl for onlne detecton and these retaned samples are called support vectors. < α are retaned n the decson functon N sv s the number of the support vectors. For any gven vector x, the value of f(x) can be calculated and one can decde whether t s an outler or not,.e., for any vector x, t s an anomaly f f(x) return the negatve value. It s proved that ν 100 s the upper bound percentage of data ponts that are expected to be outlers n the tranng data, and a vector x s detected to be outler n the tranng set f and only f 1 α =. vl Whle a number of kernel functons are generally used n relevant felds and applcatons, we adopt the Radal Basc Functon (RBF) as the kernel functon, whch, accordng to the report by Keerth and Ln [37], s the most wdely used kernel n SVM, and ts defnton s gven below. K ( x, x) = e ( x x / 2σ ) Two parameters ν and σ need to be set n the OCSVM before carryng out the tranng. As descrbed prevously, the parameter ν controls a trade-off between the fracton of data ponts n the regon and the parameter σ controls the non-lnear charasterstcs of the decson functon. Therefore, both the parameters ν and σ nfluence the generalzaton performance of the OCSVM. The choce of such parameters depends on the requrements of the research problem. In our experments, the default value for the two parameters of the proposed algorthm are σ = 0.01 and ν = In summary, the OCSVM possesses several advantages for processng network performance data and automate the network performance montorng, whch can be hghlghted as: () No sgnatures of tranng data are requred; () algorthm confguraton can be controlled by the user to regulate the percentage of anomales expected; () each anomaly detector can be traned to produce a small number of data samples to make decsons, whch makes ts mplementaton effcent and effectve; and (v) the detectors can operate fast enough for ts onlne operatons. (9) 4. Performance Management System Desgn The flow chat n Fg. 5 shows the structure of the proposed network performance montorng system, whch, as seen, s composed of blocks descrbng offlne tranng and onlne detecton. Frstly, the tranng data n the pre-defned format are loaded to the system, whch contans 10 days of network performance 11

12 management data for each network element. Accordng to the dfferent characterstcs of all KPIs, dfferent pre-processng method wll be adopted to form correspondng feature data set. After settng the value of trade-off parameter ν or usng the default value 0.01, the learnng can be started. For each KPI of an element, an anomaly detector for ths KPI-element par wll be generated after tranng. The teraton wll go on tll all the KPI-element pars are traned. It should be mentoned that the tranng process not only returns the tranng models, but also returns the anomales among the tranng data. The user can accept or reject the anomaly detector based on the results of the detected anomales. These results are user readable, f the user s unsatsfed wth the results they can reset a new value to the trade-off parameter ν to control the percentage of anomales n the data set, and start learnng agan untl a satsfactory detector are obtaned. When all the KPIs are traned and satsfactory detectors are generated, the anomaly detectors are ready for onlne testng and detecton. The onlne data comes n the format of data stream as n Table III, whch contans all the KPI values for an element at a gven tme and followed by the KPI values of another element. The feature vectors of every KPI value n the data stream are extracted va the pre-processng procedures and the correspondng anomaly detector wll be automatcally found n the repostory accordng to ts KPI type and the element name. For any negatve value returned from the decson functon of the OCSVM, an anomaly s detected. As floods of anomales are always dsplayed at the same tme n the telecommuncaton networks, levels of anomaly severty can help the users to prortze ther work. As the returned value from the decson functon reflects the degree of devaton of an abnormal event, wth ths characterstc these values are used for clusterng the outputs, and explan what knd of alarms should be generated. The alarms are clustered nto dfferent severtes wth the followng defntons. bad f(x f(x f(x data, ) ) ) mssng {0, 1.0} value, { 1.0, 2.0} 2.0 crtcal mnor constant major data warnng It should be notced that even though machne learnng algorthms can detect anomales correctly accordng to the dstrbuton of a certan KPI, however, some anomales are not real alarms. Ths s because that there are some specal constrants among the KPIs for each object, and these constrants can only be controlled by experts knowledge nstead of artfcal ntellgence. For example, such constrant can exst n a telecommuncaton network that f the value of a KPI a1# s lower than a threshold, there wll be no real alarms n some KPIs a2%, a3# and a4% and therefore these KPIs don t need to be checked. Even f there s one anomaly detected among these KPIs, t wll be a false alarm. Wth these experts knowledge embedded n the system, these false alarms could be fltered out and to mprove the performance of the system. 12

13 Onlne detecton Testng data Offlne tranng Tranng data Pre-processng Bad recordng data Detecton vector Anomaly detector Pre-processng Vector of tranng data Warnng Alarm Returned value from decson functon <0 >0 Accepted OCSVM Confguraton parameters Mnor Alarm Anomaly Normal by user Anomaly detector Major Alarm Crtcal Alarm Rejected by user Hgh Level Alarm Fg. 5. The performance management system Those alarms generated based on the analyss of sngle KPI are regarded as low level alarms (LLA). As we know that once the falure occurs to a network element at a gven tme, there wll be several alarms generated among the KPIs for the same element. Consequently, there should be measurement to dentfy the overall performance of the element based on these generated low level alarms. Hgh level alarms (HLA) are then generated usng the mnmum negatve returned value and the number of the low level alarms that are generated at a gven tme for a certan element. To ths end, we propose the followng functon to calculate the severty of the HLA nsde a network element: βn HLA = α ( f ( x )) alarm mn (10) nput _ sets N KPI Where element, and N alarm stands for the number of alarms, N KPI for the number of KPIs nsde each network α, β are two weghtng coeffcents to provde a balance between the mnmum returned value of f ( x) and the rato of N alarm over KPI α + β =1. N. Ther default values are α = 0.25, β = and 13

14 As an example, f more LLAs are generated among the KPIs for a network element and the LLAs have hgh severty levels, a larger negatve value of HLA wll be obtaned, whch wll ndcate a HLA wth hgh severty. 5. Expermental Results 5.1. Experment on a Small Set of Quanttatve Data To evaluate the proposed algorthm and system for practcal usefulness n network performance montorng, the consortum has carred out extensve experments, where one scenaro wth the three days data, as shown n Fg.1, s presented here to llustrate the effectveness and effcency of our proposed algorthm and system. The data recorded on 29 November are used for learnng the anomaly detector, and the data on 13 December and 20 December are used for detectng the anomales. Fg. 6 shows the detecton results of the data on 13 December. The upper lne n the plot s the returned value from the decson functon, whch corresponds to the KPI value of each data pont n the lower lne. Table IV llustrates the offlne montorng of the returned values from the decson functon of the OCSVM algorthm. From Fg. 6, t can be seen that three anomales at data ponts 7, 9 and 91 are detected. Table IV lsts some of the returned values from the decson functon of the 96 KPI values. In Table IV, most of the values are postve and the correspondng KPI values are detected as normal data. Whlst the returned values of the data ponts 7, 9 and 91 are negatve, whch ndcates these ponts are the anomales n the data accordng to the learnng of normal behavour. The results also verfy that the farther a value devates from the normal behavor of the data, the lower the returned value s. The data pont 91 has the lowest negatve value at ths data pont, t has a bg ncrease from the prevous data pont. These returned values shown n Table IV can be used to determne the severty of each alarm based on our pre-defned clusterng rules. When a major or crtcal anomaly s reported to the user, an mmedate attenton s requred, whlst the mnor anomales n the systems can be gnored or can wat untl normal mantenance s performed. Fg. 6. Testng results for data 13 th December 14

15 TABLE IV - Part of returned values from decson functon Ponts 1-5 Ponts 6-10 Ponts Experment on Large Data Set Our proposed automated network performance montorng system s also tested on a large telecommuncaton performance data set wth over 1000 network elements from three subsystems, and each element has 29, 14 or 16 KPIst. 960 data samples of 10 consecutve days for each element are selected for learnng and 2,976 data samples of 31 days are used for detecton. Followng ts learnng, about 20,000 detectors for all KPI-element pars are generated and saved n the gven repostory. As n the OCSVM algorthm, only support vectors are kept n the model to predct the new data ponts. The sze of each detector s qute small wth only around 350 bytes, whch provdes the advantage of space savng. Fg. 7 shows some examples of the detecton results for the qualtatve data, whch contans four subplots for the detecton of four network elements. Fg. 7. Testng results for qualtatve data 15

16 In Fg.7, t can be seen that dfferent numbers of anomales are detected n each data set. The returned values for these anomales are varyng, and the larger negatve values wll ndcate an alarm wth low severty, whle the smaller negatve values wll produce an alarm wth hgh severty. It can be notced that for some values detected as the anomales n one data set, they are actually normal cases n another. For example, comparng the values whch are marked n the yellow crcle n the two bottom plots, these ponts have the smlar values and they are detected as anomales n the left plot, yet they are detected as normal data n the rght plot. It can be concluded that a fxed threshold, whch s used n the rule-based system, cannot be smply set to detect whether a value s abnormal or normal. Ths can be also proved by nvestgatng the detecton results of our experments as such that threshold can range from 60 to 90 across dfferent data sets. In our system, the OCSVM algorthm s able to learn an anomaly detector based on the dstrbuton of each data set and the anomaly detector for the KPI-element par wll be selected to detect the correspondng data. Fg. 8 shows two examples of the detected results for quanttatve data n one month. The frst 10 days data are also used for tranng purpose, and the whole month data are used for testng and detecton. As the frst order gradent s chosen as the feature set of the quanttatve data, the thresholds across dfferent data sets are also found to be dfferent. Therefore, adaptve learnng s absolutely essental to detectng those varyng anomales. From our experments wth the real network performance management data, the proposed network performance montorng shows ts good performance on handlng dfferent data sets and detectng the anomales correctly. Fg. 8. Testng results for quanttatve data 16

17 5.3. Experments on System Effcency In general, any automated network performance montorng and management system needs to be fast enough to cope wth the endless data streams to provde an on-lne montorng servces over the network performances. In practce, telecommuncaton networks collect data every 15 mnutes, and send them to the system, whch requres the system to fnsh checkng all the data and generate alarms wthn ths tme scale. Frstly, the executon tme for learnng procedure s recorded. The computer s characterzed as: Pentum(R) D wth CPU 2.80GHZ, and 1.99GB of RAM. The result s: for each object wth 29 KPIs, the average offlne learnng tme s 2468ms. It can be nferred that that to learn the whole system wth 5,664 elements and generate anomaly detectors, t needs around 4 hours usng a sngle PC. The tme requred for detectng the data of all network elements recorded every 15 mnutes s also calculated. The executon tme, ncluded the tme of generatng alarms s 524,403ms, around 8.5 mnutes, whch s less than 15 mnutes. As a result, t s made clear that our system tself s fast enough to fnsh processng all the collected data n less than 15 mnutes, whch can meet the requrement for onlne detecton. In addton, the use of OCSVM algorthm n the system allows mult-threads onlne operaton, whch ensures that even larger network can be montored n a gven tme. 6. Concluson As the telecommuncaton networks become ncreasngly complex, performance management of all ts network elements s playng a crucal part n future network technologes. Anomaly detecton refers to automatc dentfcaton of abnormal events/network falures ndcated by the telecommuncaton performance data and t has been acqurng ncreasng attenton because of ts huge potental for securty and relablty purposes. In ths paper, we descrbed our proposed network performance montorng system for automated anomaly detecton, whch meets the requrement of applcaton n real telecommuncaton networks. The proposed network performance montorng features n OCSVM algorthm, whch s used to learn the anomaly detector wth the unsupervsed data. Each anomaly detector s generated based on a certan KPI-element par and such detector wll be used for the detecton of the same KPI-element par data. Due to a massve amount of the network elements and the KPIs assocate wth each element, there wll be a large number of anomaly detectors generated for each KPI-element par. However, as the OCSVM has the advantage that only support vectors are used n each detector for the detecton of new data, each detector has a very small sze and can be easly stored. The proposed system s capable of not only detectng the anomales but also determnng the severty level of the anomales based on the returned value of the decson functon. Experts knowledge s also exploted and embedded n the desgn to flter out the false alarms and mprove the overall performance of the proposed system. The anomales detected for sngle KPI of each network element are regarded as low level alarms and these low level alarms of the same network element can be used to generate a hgh level alarm. Such hgh level alarms have great meanng n real applcatons as t can be used to prortze the work of the telecom operators. Due to the advantage of ts adaptve learnng, the proposed system s not only able to detect anomales adaptvely, but also detect the contexts they occur, and thus provdng a powerful tool for automated network performance montorng and management. 17

18 The experment results presented n ths paper are based on the real telecommuncaton network performance data, and thus the proposed algorthm and system s ready for practcal applcaton and explotaton as desgned. The expermental results also show that the proposed algorthm effectvely detect anomales from network traffc and hence applcable to establshment of an automated and onlne network performance montorng system. Ths system s more effectve than the current rule based systems used by the telecommuncaton operator. In a rule-based system, a certan threshold s set for one network element and all the values below the threshold are detected as anomales. However, the proposed algorthm doesn t need to have such threshold because the anomaly detector can learn the normal behavor of the KPIs wth the tranng data, and n partcular, the anomaly detector can detect new events, whch have never been encountered durng the tranng process. In addton, the proposed algorthm and system provdes admnstrators wth facltes to determne the performance of the detector,.e., determne whether the anomaly does n fact descrbe a real problem stuaton or not. Upon gettng the confrmaton of a real problem or not, the admnstrator can confrm the detector whether to be accepted or rejected for future testng and hence new parameters of the system can be easly set to get a better detector. As the ablty of the OCSVM n detectng anomales reles on the choce of the kernel, further work can be done on choosng a novel, well-defned kernel whch accounts for hghly dscrmnatve nformaton and the detecton results. Addtonally, our system for generatng low level and hgh level alarms s based on the analyss of sngle KPI, or KPIs from the same network element. Methods to correlate KPIs of dfferent network elements based on the topology nformaton to confrm the anomales can be consdered n the future. As we know that the anomales, once occurred, are not generated n a random order but sequence of connected network elements. Groupng of KPIs and dfferent network elements based on topology nformaton wll lead to better correlaton and ths could further prove the anomales n the network and reduce the number of false alarms. Acknowledgement: the authors wsh to acknowledge the fnancal support from European Framework-6 under the MDS project (Contract No ). Reference: [1] H. Debar, M. Dacer and A. Wesp, Towards a taxonomy of ntruson detecton systems, Computer Networks,Vol. 31, No. 8, pp , Aprl, [2] W. Lee, S. Stolfo, and P. K. Chan, Learnng patterns from Unx process executon traces for ntruson detecton, Proceedngs of AAAI Workshop A Methods Fraud and Rsk Management, Provdence, RI, pp.50-56, [3] J. M. Estevez-Tapador, P. Garca-Teodoro, J. E. Daz-Verdejo, Anomaly detecton methods n wred networks, a survey and taxonomy, Computer Communcatons, Vol. 27, pp , [4] A. Patcha, J-M. Park, An overvew of anomaly detecton technques: Exstng solutons and latest technologcal trends, Computer Networks, Vol. 51, pp , [5] S. Rajasegarar, C. Lecke, M. Palanswam, Anomaly detecton n wreless sensor networks, IEEE Wreless Communcatons, August, [6] C. Mankopoulos, S. Papavasslou, Network ntruson and fault detecton: a statstcal anomaly approach, IEEE Communcatons Magazne, October, [7] W. Wang, X. Guan, X. Zhang, Processng of massve audt data streams for real-tme anomaly ntruson detecton, Computer Communcaton, Vol. 31, pp , [8] S. S. Km, A. L. Narammha Reddy, Statstcal technques for detectng traffc anomales through packet header data, IEEE/ACM Transactons on Networkng, Vol. 16,No. 3, pp , June,

19 [9] C. Kruegel, D. Mutz, W. Robertson, F. Valeur, Bayesan event classfcaton for ntruson detecton, Proceedngs of the 19 th Annual Computer Securty Applcatons Conference, Las Vegas, NV, [10] A. Valdes, K. Sknner, Adaptve model-based montorng for cyber attack detecton, Recent Advances n Intruson Detecton Toulouse, France, pp , [11] C. Warrender, S. Forrest, and B. Pearlmutter, Detectng ntrusons usng system calls: Alternatve data models, n Proc. IEEE Sysmp. Securty and prvacy, Oakland, CA, pp , May, [12] C. Yang, F.Q. Deng, H.D. Yang, An unsupervsed anomaly detecton approach usng subtractve clusterng and Hdden Markov Model, IEEE Second Internatonal Conference n Communcatons and Networkng, pp , Shangha, Chna, August, [13] J.E. Dckerson, J.A. Dckerson, Fuzzy network proflng for ntruson detecton, Proceedngs of the 19 th Internatonal Conference of the North Amercan Fuzzy Infomraton Processng Socety, Atlanta, GA, pp , [14] M.M. Plla, J.H.P. Eloff, H.S. Venter, An approach to mplement a network ntruson detecton system usng genetc algorthms, Proceedngs of the 2004 Annual Research Conference of the South Afrcan Insttute of Computer Scentsts and Informaton Technologsts on IT research n Developng Countres, Stellenbosch, South Afrca, pp , [15] A. Marmuthu, A. Shanmugam, Intellgent progresson for anomaly ntruson detecton, Proceedngs of 6th Internatonal Symposum on Appled Machne Intellgence and Informatcs, Herlany, Slovaka, pp , Jan, [16] Y. Lu, D. Tan, D. We, A wreless ntruson detecton method based on neural network, In Proceedngs of the 2nd IASTED nternatonal conference on Advances n computer scence and technology, Puerto Vallarta, Mexco, pp , [17] V. Dao and V. Vemur, A performance comparson of dfferent back propagaton neural networks methods n computer network ntruson detecton, Dfferental of Equatons and dynamcal Systems, pp , [18] S.-J. Han, S.-B. Cho, Evolutonary Neural Networks for Anomaly Detecton Based on the Behavor of a Program, IEEE Transactons on Systems, Man, and Cybernetcs, Part B: Cybernetcs, Vol. 36, No. 3, [19] S. Muthuraman, J. Jang, Anomaly detecton n telecommuncaton network performance data, Proceedngs of the 2007 Internatonal Conference on Artfcal Intellgence, Monte Carlo Resort, Las Vegas, Nevada, USA, June, [20] R.H. Ma, Y. Lu, X. Ln, Z. Wang, Network anomaly detecton usng RBF neural network wth hybrd QPSO, Proceedngs of 2008 IEEE Internatonal Conference on Networkng, Sensng and Control, Sanya, Chna, Aprl, [21] W. Hu, Y. Lao, V.R. Vemur, Robust support vector machnes for anomaly detecton n computer securty, Proceedngs of Internatonal conference on Machne learnng and Applcatons, Los Angeles, CA, pp , [22] T. Shon, J. Moon, A hybrd machne learnng approach to network anomaly detecton, Informaton Scences, Vol. 177, pp , [23] Y. Lao, V.R. Vemur, Use of K-nearest neghbour classfer for ntruson detecton, Comput. Secur., Vol. 21, No. 5, pp , [24] S. Rajasegarar, C. Lecke, M. Palanswam, J.C. Bezdek, Dstrbuted anomaly detecton n wreless sensor networks, Proceedngs of the 10 th IEEE Internatonal Conference on Communcaton Systems, pp.1-5, Sngapore, [25] S. Salvador, P. Chan, J. Brode, Learnng states and rules for detecton anomales n tme seres, Appled Intellgence, Vol. 23, No. 3, pp , [26] Z. J, D. Dusgupta, Applcablty ssues of the real-valued negatve selecton algorthms, In Genetc And Evolutonary Computaton Conference, Proceedngs of the 8th annual conference on Genetc and evolutonary computaton, pp , [27] T. Stbor, P. Mohr, J. Tmms, C. Eckert, Is negatve selecton approprate for anomaly detecton, In Genetc and Evolutonary Computaton Conference (GECCO), ACM Press, Washngton DC, USA, pp , June, [28] C. Burges, A tutoral on support vector machnes for pattern recognton, Data Mnng and Knowledge Dscovery, Vol. 2, pp , [29] B. Scholkopf, J.C. Platt, J. Shawe-Taylor, A.J. Smola, R.C. Wllamson, Estmatng the support of a hgh-dmensonal 19

20 dstrbuton, Techncal report, Mcrosoft Research, MSR-TR-99-87, [30] M. Lauer, A mxture approach to novelty detecton usng tranng data wth outlers, Lecture Notes n Computer Scence, pp , [31] B. Schölkopf, J. Platt, J. Shawe-Taylor, A.J. Smola, and R. Wllamson, Estmatng the support of a hgh-dmensonal dstrbuton, Neural computaton, Vol. 13, No. 7, pp , [32] J. Ma, S. Perkns, Tme-seres novelty detecton usng one-class support vector machnes, Proceedngs of the Internatonal Jont Conference on Neural Networks, pp , July, [33] K-L. L, H-K. Huang, S-F. Tan, W. Xu, Improvng one-class SVM for anomaly detecton, Proceedngs of the Second Internatonal Conference on Machne Learnng and Cybernetcs, X an, Chna, Vol. 5, pp , [34] K.A. Heller, K.M. Svore, A.D. Keromyts, S.J. Stolfo. One Class Support Vector Machnes for Detectng Anomalous Wndow Regstry Accesses, Proceedngs of the 3rd IEEE Conference Data Mnng Workshop on Data Mnng for Computer Securty, Florda, [35] L.M. Manevtz, M. Yousef, One-Class SVMs for document classfcaton, Journal of Machne Learnng Research, Vol. 2, pp , [36] V.N. Vapnk, An overvew of statstcal learnng theory, IEEE Trans. On Neural Networks, Vol. 10, Issue 5, pp , [37] S.S. Keerth and C.J. Ln, Asymptotc behavors of support vector machnes wth Gaussan Kernel, Neural Computaton, vol. 15, no. 7, pp ,

Dropout: A Simple Way to Prevent Neural Networks from Overfitting

Dropout: A Simple Way to Prevent Neural Networks from Overfitting Journal of Machne Learnng Research 15 (2014) 1929-1958 Submtted 11/13; Publshed 6/14 Dropout: A Smple Way to Prevent Neural Networks from Overfttng Ntsh Srvastava Geoffrey Hnton Alex Krzhevsky Ilya Sutskever

More information

A Study of the Cosine Distance-Based Mean Shift for Telephone Speech Diarization

A Study of the Cosine Distance-Based Mean Shift for Telephone Speech Diarization T-ASL-0460-13 1 A Study of the Cosne Dstance-Based Mean Shft for Telephone Speech Darzaton Mohammed Senoussaou, Patrck Kenny, Themos Stafylaks and Perre Dumouchel Abstract Speaker clusterng s a crucal

More information

Invoicing and Financial Forecasting of Time and Amount of Corresponding Cash Inflow

Invoicing and Financial Forecasting of Time and Amount of Corresponding Cash Inflow Dragan Smć Svetlana Smć Vasa Svrčevć Invocng and Fnancal Forecastng of Tme and Amount of Correspondng Cash Inflow Artcle Info:, Vol. 6 (2011), No. 3, pp. 014-021 Receved 13 Janyary 2011 Accepted 20 Aprl

More information

Max-Margin Early Event Detectors

Max-Margin Early Event Detectors Max-Margn Early Event Detectors Mnh Hoa Fernando De la Torre Robotcs Insttute, Carnege Mellon Unversty Abstract The need for early detecton of temporal events from sequental data arses n a wde spectrum

More information

A cooperative perception system for multiple UAVs: Application to automatic. detection of forest fires

A cooperative perception system for multiple UAVs: Application to automatic. detection of forest fires A cooperatve percepton system for multple UAVs: Applcaton to automatc detecton of forest fres Lus Merno 1, Fernando Caballero 2, J. R. Martínez-de Dos 2, Joaquín Ferruz 2 and Aníbal Ollero 2 Robotcs, Vson

More information

Self-Adaptive SLA-Driven Capacity Management for Internet Services

Self-Adaptive SLA-Driven Capacity Management for Internet Services Self-Adaptve SLA-Drven Capacty Management for Internet Servces Bruno Abrahao, Vrglo Almeda and Jussara Almeda Computer Scence Department Federal Unversty of Mnas Geras, Brazl Alex Zhang, Drk Beyer and

More information

A Scalable Data Science Workflow Approach for Big Data Bayesian Network Learning

A Scalable Data Science Workflow Approach for Big Data Bayesian Network Learning A Scalable Data Scence Workflow Approach for Bg Data Bayesan Network Learnng Janwu Wang 1, Yan Tang 2, Ma Nguyen 1, Ilkay Altntas 1 1 San Dego Supercomputer Center Unversty of Calforna, San Dego La Jolla,

More information

Human Tracking by Fast Mean Shift Mode Seeking

Human Tracking by Fast Mean Shift Mode Seeking JOURAL OF MULTIMEDIA, VOL. 1, O. 1, APRIL 2006 1 Human Trackng by Fast Mean Shft Mode Seekng [10 font sze blank 1] [10 font sze blank 2] C. Belezna Advanced Computer Vson GmbH - ACV, Venna, Austra Emal:

More information

Algebraic Point Set Surfaces

Algebraic Point Set Surfaces Algebrac Pont Set Surfaces Gae l Guennebaud Markus Gross ETH Zurch Fgure : Illustraton of the central features of our algebrac MLS framework From left to rght: effcent handlng of very complex pont sets,

More information

Support vector domain description

Support vector domain description Pattern Recognton Letters 20 (1999) 1191±1199 Support vector doman descrpton Davd M.J. Tax *,1, Robert P.W. Dun Pattern Recognton Group, Faculty of Appled Scence, Delft Unversty

More information

Overhaul Overdraft Fees: Creating Pricing and Product Design Strategies with Big Data

Overhaul Overdraft Fees: Creating Pricing and Product Design Strategies with Big Data Overhaul Overdraft Fees: Creatng Prcng and Product Desgn Strateges wth Bg Data Xao Lu, Alan Montgomery, Kannan Srnvasan September 30, 2014 Abstract In 2012, consumers pad an enormous $32 bllon overdraft

More information

On Mean Squared Error of Hierarchical Estimator

On Mean Squared Error of Hierarchical Estimator S C H E D A E I N F O R M A T I C A E VOLUME 0 0 On Mean Squared Error of Herarchcal Estmator Stans law Brodowsk Faculty of Physcs, Astronomy, and Appled Computer Scence, Jagellonan Unversty, Reymonta

More information

Distributed Optimization and Statistical Learning via the Alternating Direction Method of Multipliers

Distributed Optimization and Statistical Learning via the Alternating Direction Method of Multipliers Foundatons and Trends R n Machne Learnng Vol. 3, No. 1 (2010) 1 122 c 2011 S. Boyd, N. Parkh, E. Chu, B. Peleato and J. Ecksten DOI: 10.1561/2200000016 Dstrbuted Optmzaton and Statstcal Learnng va the

More information

Person Re-identification by Probabilistic Relative Distance Comparison

Person Re-identification by Probabilistic Relative Distance Comparison Person Re-dentfcaton by Probablstc Relatve Dstance Comparson We-Sh Zheng 1,2, Shaogang Gong 2, and Tao Xang 2 1 School of Informaton Scence and Technology, Sun Yat-sen Unversty, Chna 2 School of Electronc

More information

Physical Security and Vulnerability Modeling for Infrastructure Facilities

Physical Security and Vulnerability Modeling for Infrastructure Facilities Proceedngs of the 39th Hawa Internatonal Conference on System Scences - 2006 Physcal Securty and Vulnerablty Modelng for Infrastructure Facltes Dean A. Jones Chad E. Davs Sanda Natonal Laboratores Albuquerque,

More information

Sequential DOE via dynamic programming

Sequential DOE via dynamic programming IIE Transactons (00) 34, 1087 1100 Sequental DOE va dynamc programmng IRAD BEN-GAL 1 and MICHAEL CARAMANIS 1 Department of Industral Engneerng, Tel Avv Unversty, Ramat Avv, Tel Avv 69978, Israel E-mal:

More information

New Approaches to Support Vector Ordinal Regression

New Approaches to Support Vector Ordinal Regression New Approaches to Support Vector Ordnal Regresson We Chu Gatsby Computatonal Neuroscence Unt, Unversty College London, London, WCN 3AR, UK S. Sathya Keerth

More information

DP5: A Private Presence Service

DP5: A Private Presence Service DP5: A Prvate Presence Servce Nkta Borsov Unversty of Illnos at Urbana-Champagn, Unted States George Danezs Unversty College London, Unted Kngdom Ian Goldberg Unversty

More information

P2P/ Grid-based Overlay Architecture to Support VoIP Services in Large Scale IP Networks

P2P/ Grid-based Overlay Architecture to Support VoIP Services in Large Scale IP Networks PP/ Grd-based Overlay Archtecture to Support VoIP Servces n Large Scale IP Networks We Yu *, Srram Chellappan # and Dong Xuan # * Dept. of Computer Scence, Texas A&M Unversty, U.S.A. {weyu}

More information

Energy Conserving Routing in Wireless Ad-hoc Networks

Energy Conserving Routing in Wireless Ad-hoc Networks Energy Conservng Routng n Wreless Ad-hoc Networks Jae-Hwan Chang and Leandros Tassulas Department of Electrcal and Computer Engneerng & Insttute for Systems Research Unversty of Maryland at College ark

More information

Documentation for the TIMES Model PART I

Documentation for the TIMES Model PART I Energy Technology Systems Analyss Programme Documentaton for the TIMES Model PART I Aprl 2005 Authors: Rchard Loulou Uwe Remne Amt Kanuda Antt Lehtla Gary Goldsten 1 General

More information

The Stochastic Guaranteed Service Model with Recourse for Multi-Echelon Warehouse Management

The Stochastic Guaranteed Service Model with Recourse for Multi-Echelon Warehouse Management The Stochastc Guaranteed Servce Model wth Recourse for Mult-Echelon Warehouse Management Jörg Rambau, Konrad Schade 1 Lehrstuhl für Wrtschaftsmathematk Unverstät Bayreuth Bayreuth, Germany Abstract The

More information

Distributed Column Subset Selection on MapReduce

Distributed Column Subset Selection on MapReduce Dstrbuted Column Subset Selecton on MapReduce Ahmed K. arahat Ahmed Elgohary Al Ghods Mohamed S. Kamel Unversty of Waterloo Waterloo, Ontaro, Canada N2L 3G1 Emal: {afarahat, aelgohary, aghodsb, mkamel}

More information

Boosting as a Regularized Path to a Maximum Margin Classifier

Boosting as a Regularized Path to a Maximum Margin Classifier Journal of Machne Learnng Research 5 (2004) 941 973 Submtted 5/03; Revsed 10/03; Publshed 8/04 Boostng as a Regularzed Path to a Maxmum Margn Classfer Saharon Rosset Data Analytcs Research Group IBM T.J.

More information

An agent architecture for network support of distributed simulation systems

An agent architecture for network support of distributed simulation systems An agent archtecture for network support of dstrbuted smulaton systems Robert Smon, Mark Pullen and Woan Sun Chang Department of Computer Scence George Mason Unversty Farfax, VA, 22032 U.S.A. smon, mpullen,

More information

Ensembling Neural Networks: Many Could Be Better Than All

Ensembling Neural Networks: Many Could Be Better Than All Artfcal Intellgence, 22, vol.37, no.-2, pp.239-263. @Elsever Ensemblng eural etworks: Many Could Be Better Than All Zh-Hua Zhou*, Janxn Wu, We Tang atonal Laboratory for ovel Software Technology, anng

More information



More information



More information

Verification by Equipment or End-Use Metering Protocol

Verification by Equipment or End-Use Metering Protocol Verfcaton by Equpment or End-Use Meterng Protocol May 2012 Verfcaton by Equpment or End-Use Meterng Protocol Verson 1.0 May 2012 Prepared for Bonnevlle Power Admnstraton Prepared by Research Into Acton,

More information

On network efficiency comparisons: Electricity distribution

On network efficiency comparisons: Electricity distribution On network effcency comparsons: Abstract Electrcty dstrbuton Ralph Turvey Short-run effcency comparsons for electrcty dstrbuton networks, a matter of ther operatng costs, reure a clear concept of the scale

More information