On the Use of TCP Passive Measurements for Anomaly Detection: A Case Study from an Operational 3G Network
On the Use of TCP Passive Measurements for Anomaly Detection: A Case Study from an Operational 3G Network
复制标题
关于使用 TCP 被动测量进行异常检测：来自运营 3G 网络的案例研究
DOI：
10.1007/978-3-642-12365-8_14
复制
发表时间：
2010
影响因子：
2.3
通讯作者：
T. Witek
中科院分区：
文献类型：
--
作者：
Peter Romirer;A. Coluccia;T. Witek
在这项工作中，我们将讨论使用被动测量的TCP性能指标，支持网络操作和故障排除，提出了一个案例研究，从一个真实的3G蜂窝网络。从核心网络中测量的TCP握手数据包的分析中，我们分别推断UMTS/HSPA和GPRS/EDGE部分的客户端和服务器端的往返时间（RTT）。我们还跟踪例如由于丢失和/或重传事件而没有导致有效RTT样本的分组对的相对份额，并使用该度量作为附加性能信号。在以前的工作中，我们确定了测量偏差的风险，由于早期重传的TCP SYNACK数据包的一些流行的服务器。为了缓解这个问题，我们在这里介绍了一种新的算法，用于动态分类和过滤早期转发器。我们提出了几个说明性的情况下，观察到的真实的网络中的异常变化，在此基础上，我们得出了一些经验教训，使用这些数据检测异常的真实的网络。多亏了这样的测量，我们才能够发现所研究的网络中隐藏的拥塞瓶颈。
In this work we discuss the use of passive measurements of TCP performance indicators in support of network operation and troubleshooting, presenting a case-study from a real 3G cellular network. From the analysis of TCP handshaking packets measured in the core network we infer Round-Trip-Times (RTT) on both the client and server sides separately for UMTS/HSPA and GPRS/EDGE sections. We also keep track of the relative share of packet pairs which did not lead to a valid RTT sample, e.g. due to loss and/or retransmission events, and use this metric as an additional performance signal. In a previous work we identified the risk of measurement bias due to early retransmission of TCP SYNACK packets by some popular servers. In order to mitigate this problem we introduce here a novel algorithm for dynamic classification and filtering of early retransmitters. We present a few illustrative cases of abrupt-change observed in the real network, based on which we derive some lessons learned about using such data for detecting anomalies in a real network. Thanks to such measurements we were able to discover a hidden congestion bottleneck in the network under study.