A method and system to dynamically detect traffic anomalies in a network

Abstract

Methods implemented in a network are disclosed for dynamically distributing tasks of traffic anomaly monitoring and detecting traffic anomalies. The method starts collecting traffic statistics of large blocks of traffic flows as traffic aggregates. Based on the traffic statistics of traffic aggregates, a traffic anomaly is detected. Then for a traffic aggregate with a traffic anomaly, increased traffic sampling rate is applied to a smaller set of traffic flows within the traffic aggregate. If the smaller set of traffic flows does not contain a percentage of the traffic within the traffic aggregate, the sampling rate is further increase to an even smaller set of traffic flows until a small set of traffic flows are identified as the ones cause the traffic anomaly.

Description

technical field [0001] Embodiments of the invention relate to the field of networking. More specifically, the embodiments of the present invention relate to a method and system for dynamically detecting service anomalies in a network. Background technique [0002] In data or computing networks, business anomaly detection is a major concern. Traffic anomalies include unusual and noticeable changes in traffic levels of a network, which can often span multiple links and nodes. Diagnosing traffic anomalies is critical for both network operators and end users. This is a difficult problem because anomalous patterns must be extracted and explained from large amounts of high-dimensional noisy data (since business variations are large in nature). [0003] Regardless of whether traffic anomalies are intentional or not, understanding the nature of traffic anomalies in a network is important for at least two reasons: [0004] (a) Traffic anomalies can create congestion in the networ...

AI Technical Summary

Problems solved by technology

However, these automated response systems can be difficult to deploy, in part due to lack of support from commercial router / switch vendors

They are also usually very heavy, which means that they need to capture a lot of traffic in the network and thus introduce a large overhead both on the network management system and on the network itself

Images