Monitoring and diagnostics of large software systems is crucial to ensure uninterrupted functioning of modern businesses. Reliability engineers have to rely on automatic event processing to identify and mitigate any potential disruptions of the system health from underlying computer networks. As obtaining impact labels for individual events is expensive, systems operators usually maintain only a small rep-resentative dataset, making it hard for machine learning practitioners to train models on large-scale data streams. By formulating the problem within the multiple instance learning framework, we propose an approach to event classification that can be effectively trained using this limited information. Our evaluation results show potential 65% reduction in minutes spent by the network reliability engineers on disruption investigations when the proposed model is used. By automatically quantifying the network impact, the proposed approach streamlines the investigation process and reduces the risk of unnecessary wake-up calls among on-call reliability engineers and resolver personnel.

Streaming high-quality video over dynamic radio networks is challenging. Dynamic adaptive streaming over HTTP (DASH) is a standard for delivering video in segments, and adapting its quality to adjust to a changing and limited network bandwidth. We present a machine learning-based predictive pre-fetching and caching approach for DASH video streaming, implemented at the multi-access edge computing server. We use ensemble methods for machine learning (ML) based segment request prediction and an integer linear programming (ILP) technique for pre-fetching decisions. Our approach reduces video segment access delay with a cache-hit ratio of 60% and alleviates transport network load by reducing the backhaul link utilization by 69%. We validate the ML model and the pre-fetching algorithm, and present the trade-offs involved in pre-fetching and caching for resource-constrained scenarios.

Deployment of 100Gigabit Ethernet (GbE) links challenges the packet processing limits of commodity hardware used for Network Functions Virtualization (NFV). Moreover, realizing chained network functions (i.e., service chains) necessitates the use of multiple CPU cores, or even multiple servers, to process packets from such high speed links. Our system Metron jointly exploits the underlying network and commodity servers’ resources: ( i ) to offload part of the packet processing logic to the network, ( ii ) by using smart tagging to setup and exploit the affinity of traffic classes, and ( iii ) by using tag-based hardware dispatching to carry out the remaining packet processing at the speed of the servers’ cores, with zero inter-core communication. Moreover, Metron transparently integrates, manages, and load balances proprietary “blackboxes” together with Metron service chains. Metron realizes stateful network functions at the speed of 100GbE network cards on a single server, while elastically and rapidly adapting to changing workload volumes. Our experiments demonstrate that Metron service chains can coexist with heterogeneous blackboxes, while still leveraging Metron’s accurate dispatching and load balancing. In summary, Metron has ( i ) 2.75–8× better efficiency, up to ( ii ) 4.7× lower latency, and ( iii ) 7.8× higher throughput than OpenBox, a state-of-the-art NFV system.

We propose a novel distributed leader election algorithm to deal with the controller and control service availability issues in programmable networks, such as Software Defined Networks (SDN) or programmable Radio Access Network (RAN). Our approach can deal with a wide range of network failures, especially intermittent network partitions, where splitting and merging of a network repeatedly occur. In contrast to traditional leader election algorithms that mainly focus on the (eventual) consensus on one leader, the proposed algorithm aims at optimizing control service availability, stability and reducing the controller state synchronization effort during intermittent network partitioning situations. To this end, we design a new framework that enables dynamic leader election based on real-time estimates acquired from statistical monitoring. With this framework, the proposed leader election algorithm has the capability of being flexibly configured to achieve different optimization objectives, while adapting to various failure patterns. Compared with two existing algorithms, our approach can significantly reduce the synchronization overhead (up to 12x) due to controller state updates, and maintain up to twice more nodes under a controller.

For large-scale programmable networks, flexible deployment of distributed control planes is essential for service availability and performance. However, existing approaches only focus on placing controllers whereas the consequent control traffic is often ignored. In this paper, we propose a black-box optimization framework offering the additional steps for quanti-fying the effect of the consequent control traffic when deploying a distributed control plane. Evaluating different implementations of the framework over real-world topologies shows that close to optimal solutions can be achieved. Moreover, experiments indicate that running a method for controller placement without considering the control traffic, cause excessive bandwidth usage (worst cases varying between 20.1%-50.1% more) and congestion, compared to our approach.

Development towards 5G has introduced difficult challenges in effectively managing and operating heterogeneous infrastructures under highly varying network conditions. Enabling, for example, unified coordination and management of radio resources across coexisting, multiple radio access technologies (multi-RAT), require efficient representation using high-level abstractions of the radio network performance and state. Without such abstractions, users and networks cannot harvest the full potential of increased resource density and connectivity options resulting in failure to meet the ambitions of 5G. We present a generic probabilistic approach for unified estimation of performance variability based on attainable throughput of UDP traffic in multi-RATs, and evaluate the applicability in an interface selection control case (involving WiFi and LTE) based on obtaining probabilistic user performance guarantees. From simulations we observe that both users and operators can significantly benefit from this improved service availability at low network cost. Initial results indicate 1) 116% fewer performance violations and 2) 20% fewer performance violations with a reduction by 35 times in the number of handovers, compared to naive and state-of-the-art baselines, respectively.

Network service providers are facing challenges for deploying new services mainly due to the growing complexity of software architecture and development process. Moreover, the recent architectural innovation of network systems such as Network Function Virtualization (NFV), Software-defined Networking (SDN), and Cloud computing increases the development and operation complexity yet again. One of the emerging solutions to this problem is a novel software development concept, namely DevOps, that is widely employed by major Internet software companies. Although the goals of DevOps in data centers are well-suited for the demands of agile service creation, additional requirements specific to the virtualized and software-defined network environment are important to be addressed from the perspective of modern network carriers. In this paper, we thoroughly debate DevOps requirements for developing a modern service creation platform by taking EU FP7 project UNIFY as a reference architecture and suggest the corresponding extensions of UNIFY interfaces that meet the discovered requirements.

We propose a highly scalable statistical method for modelling the monitored traffic rate in a network node and suggest a simple method for detecting increased risk of congestion at different monitoring time scales. The approach is based on parameter estimation of a lognormal distribution using the method of moments. The proposed method is computationally efficient and requires only two counters for updating the parameter estimates between consecutive inspections. Evaluation using a naive congestion detector with a success rate of over 98% indicates that our model can be used to detect episodes of high congestion risk at 0.3 s using estimates captured at 5 m intervals.

Software Defined Networking (SDN) and Network Functions Virtualization facilitate, with their advanced programmability features, the design of automated dynamic service creation platforms. Applying DevOps principles to service design can further reduce service creation times and support continuous operation. Monitoring, troubleshooting, and other DevOps tools can have different roles within virtualised networks, depending on virtualization level, type of instantiation, and user intent. We have implemented and integrated four key DevOps tools that are useful in their own right, but showcase also an integrated scenario, where they form the basis for a more complete and realistic DevOps toolkit. The current set of tools include a message bus, a rudimentary configuration tool, a probabilistic congestion detector, and a watchpoint mechanism. The demo also presents potential roles and use-cases for the tools.

Scalable and automated monitoring processes for testing, debugging, and operation of VNFs and service-chains are crucial components towards achieving the aims of network softwarization - i.e., cheaper, faster, and shorter service deployment and network management processes. In this paper we present a decentralized monitoring approach aimed at supporting automated deployment and operation of VNFs and service-chains. The approach is inspired by network tomography and is designed to address observability limitations and scalability issues that arise from performing measurements from an SDN controller. From successive end-to-end measurements link metrics are derived via in-network parameter estimation with no need of forwarding raw measurements to the controller, which significantly reduces the measurement overhead compared to when monitoring individual links explicitly from an SDN controller.

In this paper we build on methods from probabilistic management for overcoming two issues in the translation of QoS into configurations of network nodes in dynamic, decentralized, and hierarchical networks. First, the inherent uncertainty about node performance in such networks (due to network dynamics) may impede adequate specification of QoS. We suggest how a probabilistic variant of QoS via optimization can be translated into objectives that can be handled with probabilistic management methods. Second, the dynamics of the network may make the interpretation of QoS dependent on the availability of network resources. We use methods from probabilistic management to suggest how the expression of QoS may be restricted in order to be able to ensure the existence of a translation of given QoS. The suggestions are applied to our own network architecture. The aim is to further develop our approach to a viable management solution for cloud computing and virtualized networks.

We present a distributed spatio-temporal event correlation protocol for multi-layer networks. The problems that we address relate to scalability in stacked overlay networks and network equipment with asynchronous clocks, which complicates the problem of event correlation. We describe a cross-layer protocol designed to address these problems, operating in a fully distributed manner and taking into account asynchronous timestamps. It is assumed that events in one layer may arise from a series of events in lower layers. Detected events that are spatially related in one layer are aggregated using a gossip-like protocol, and constitute a root cause. The set of aggregated events is disseminated to lower layers and used for temporal correlation. We have tested the scalability and the performance of the distributed event protocol, using both synthetically generated and real-world topologies. The results indicate that the average overhead produced for collecting events down the stack of overlays increases with the number of layers. For a fixed number of layers, the protocol scales similarly with the graph-theoretic properties for a network of increasing size.

We present a statistical approach to distributed detection of local latency shifts in networked systems. For this purpose, response delay measurements are performed between neighbouring nodes via probing. The expected probe response delay on each connection is statistically modelled via parameter estimation. Adaptation to drifting delays is accounted for by the use of overlapping models, such that previous models are partially used as input to future models. Based on the symmetric Kullback-Leibler divergence metric, latency shifts can be detected by comparing the estimated parameters of the current and previous models. In order to reduce the number of detection alarms, thresholds for divergence and convergence are used. The method that we propose can be applied to many types of statistical distributions, and requires only constant memory compared to e.g., sliding window techniques and decay functions. Therefore, the method is applicable in various kinds of network equipment with limited capacity, such as sensor networks, mobile ad hoc networks etc. We have investigated the behaviour of the method for different model parameters. Further, we have tested the detection performance in network simulations, for both gradual and abrupt shifts in the probe response delay. The results indicate that over 90% of the shifts can be detected. Undetected shifts are mainly the effects of long convergence processes triggered by previous shifts. The overall performance depends on the characteristics of the shifts and the configuration of the model parameters.