| Network anomalies are one of the most common problems in the Internet today.In the business world,network anomalies can cause huge losses,as Facebook Inc.had a backbone network anomaly triggered by staff misconfiguration in 2017 that prevented users from accessing Facebook and eventually evaporated the company’s market value by $60billion.These losses can be reduced to a greater extent if the anomalies can be located and analyzed within seconds or minutes.The anomalies of interest in this thesis are network service transmission anomalies,usually reflected as latency,packet loss,connection timeout,etc.In a programmable network,network administrators have the flexibility to obtain network performance metrics such as latency and packet loss rate to quickly detect,locate,and analyze anomalies.The programmable network data plane enables the widespread application of in-band network telemetry(INT)technology,which can fine-tune network performance management.To reduce network telemetry overhead,this article utilizes the INT technology and flexible control capabilities of the programmable network to design a fast anomaly detection and localization system in Chapter 3.Based on this,a deep reinforcement learning(DRL)algorithm for anomaly link detection and localization is proposed in this article.The algorithm intelligently infers anomalous links based only on end-to-end performance metrics and single-hop performance metrics on detected links,and can adaptively adjust the inference strategy of the algorithm based on the impact of the inference results.Experimental results show that the method proposed in this article can locate anomalous links with a very high probability(98%)in a single anomalous link scenario and can locate all anomalous links with a high probability(93%)within six detection cycles in multianomalous link scenarios.Furthermore,detecting and locating all anomalous links can be completed in seconds to tens of seconds,with low network telemetry overhead.Some network anomalies do not affect all flows on the entire anomaly node,such as gray faults.Switches in the network process packets through configured matching rules,and thus the most straightforward way to monitor gray faults is to perform packet loss measurements on each matching rule at each node,but this approach consumes a lot of memory space in the switch.To avoid the large measurement overhead incurred by this approach,a hierarchical approach to gray fault detection,localization and analysis is proposed in Chapter 4 of this thesis.The method first identifies the flows affected by gray faults by the packet loss rate of end-to-end flows,then obtains the common nodes,i.e.,potential gray fault nodes,on the paths of the flows affected by gray faults through a path commonality algorithm,and further verifies them to locate the switch ports where gray faults occur.Finally,the set of flows(the set of flows matched with a certain matching rule)affected by the fault is inferred by measuring the packet loss rate of each matched flow on the switch,and the anomaly is further analyzed based on this result.The experimental results show that this method analyzes the set of streams affected by the failure with high accuracy in a real deployed network and reduces the storage overhead of the switch. |
