The MNEMONIC project focus on a specific task of the monitoring system of an Internet Service Provider (ISP): the computation of the Ingress Egress Traffic Matrix (TM). The knowledge of the TM is a key information for an ISP since it allows to implement effective Traffic Engineering algorithm so that to increase the Quality of Service provided to customers.
The main aim of MNEMONIC is to define a TM computation strategy for an ISP network characterized by the availability of computing nodes at network edges. The main features of the solution will be i) to exploit a customized data mining algorithm, ii) to run in a distributed fashion, and iii) to use as input data the raw traffic traces captured at network edge nodes. The proposed solution will have many advantages with respect to known solutions for traffic monitoring. Firstly, it will be completely transparent to network devices, since the packet capturing will be performed by computing nodes at network edges. Moreover, the MNEMONIC solution will be able to automatically extract Ingress Egress relationship for each captured packet, avoiding the interaction with the Routing management system required by legacy monitoring solutions. Finally, the MNEMONIC will define a very fast algorithm able to compute the TM on a second timescale, while minutes/hours are required by complex monitoring systems.
MNEMONIC will also provide as outcome an experimental testbed to be used as proof-of-concept for the algorithm proposed. The performance evaluation will focus on the execution times as a function of different network parameters (i.e. raw trace size, line rate, traffic distribution, hardware constraints). Moreover, the availability of an experimental testbed will allow to characterize the reliability of the solution, evaluating the reaction to unexpected events, such as sudden traffic variations and devices malfunctioning. Finally, the comparison with standard monitoring solutions will be provided.
The MNEMONIC project has three main innovative aspects:
- the proposal of a new monitoring architecture based on a data mining algorithm and exploiting the availability of distributed computing resources;
- the definition of a distributed TM computation algorithm with low execution times and reduced traffic overhead;
- the realization of an experimental testbed for a detailed performance evaluation.
The use of data mining techniques for the management of an ISP network is a hot research topic. The innovative aspect of the MNEMONIC solution with respect to similar proposals is to define an ad-hoc framework for the TM computation based on a data mining algorithm, and not to integrate a data mining algorithm into a legacy management solution. The main advantages of this new approach are: i) to provide a solution not requiring the compatibility with existing standards, and so completely open, and ii) to rethink the TM computation procedure, so that to exploit the scalability of data mining solutions. The TM computation algorithm to be defined will be completely distributed among Computing Nodes co-located with Edge Nodes, so greatly reducing the execution times (even for large networks) with respect to a legacy solution where data are collected and computed by the centralized monitoring system. The distributed feature of the solution will also allow to obtain Ingress Egress traffic relationship directly from raw traffic traces, avoiding a complex interaction among the monitoring system and the routing one.
From a pure research perspective, the definition of a data mining algorithm customized for network management issues is the target of the project. A reference data mining algorithm (such as MapReduce), to be used as starting point for the TM computation algorithm to be defined, has been defined in a totally different scenario (a Data Center with hundreds of Virtual Machines running on specialized hardware) with different requirements (QoS constraints and reliability). The aim of MNEMONIC will be to modify the reference data-mining algorithm, "removing" features not needed for the TM computation case, and to adapt it to the ISP scenario where low execution times and reduced traffic exchange among nodes are the main requirements to be satisfied.
Finally, the realization of an experimental testbed will provide a proof-of-concept for the proposed solution. The performance evaluation in a real environment will make possible to characterize the algorithm during critical network situations (i.e. traffic peaks and network anomalies). The results of this evaluation will represent a good starting point to convince Service Provider about the advantages of the proposed solution.