We describe the design and implementation of automated methodologies and tools that facilitate the implementation of an enhanced maintenance process in order to provide improved quality of service offered to the customers for the transaction access services (TAS) network. The emphasis of our work is placed on the identification, filtering and correlation of event occurrences that indicate problems that do not necessarily generate alarmed conditions on the conventional network management systems, and on the proactive service/fault management and detection based on dynamically defined violations of the base-lined performance profiles. Such an approach enhances considerably the network management and maintenance process, by identifying possible situations/incidents that may affect the network performance, and by correlating those incidents to the potentially affected elements, services and customer applications.

The motivation of the work presented in this paper comes from a real network management center in charge of supervising a very large hybrid telecommunications/data transaction-oriented network. We present a set of tools that we have developed and implemented in the AT&T Transaction Access Services (TAS) network, in order to automate and facilitate the process of diagnosing network faults and identifying the potentially affected elements, resources and customers. Specifically in this paper we describe the development implementation and use of the following systems: (a) the TAS Information and Tracking System (TIMATS) that provides a common framework for the storage and retrieval of provisioning, capacity management and maintenance data; (b) the Transactions Event Viewer (TEVIEW) system that generates, filters, and presents diagnostic events that indicate system occurrences or conditions that may cause a degradation of the service; and (c) the Transaction Instantaneous Anomaly Notification (TRISTAN) system which implements an adaptive network anomaly detection software that detects network and service anomalies of TAS as dynamically defined violations of the base-lined performance characteristics and profiles.

Algorithms and software for proactive and adaptive detection of network/service anomalies (i.e., performance degradations) have been developed, implemented, deployed, and field-tested for transaction-oriented wide area networks (WANs). A real-time anomaly detection system called TRISTAN (transaction instantaneous anomaly notification) has been implemented, and is deployed in the commercially important AT&T transaction access services (TAS) network. TAS is a high volume, multiple service classes, hybrid telecom and data WAN that services transaction traffic in the U.S. and neighboring countries. TRISTAN adaptively and preactively detects network/service performance anomalies in multiple-service-class-based and transaction-oriented networks, where performances of service classes are mutually dependent and correlated, where environmental factors (e.g., nonmanaged or nonmonitored equipment within customer premises) can strongly impact network and service performances. Specifically, TRISTAN implements algorithms that: 1) sample and convert raw transaction records to service-class based performance data in which potential network anomalies are highlighted; 2) automatically construct adaptive and service-class-based performance thresholds from historical transaction records for detecting network and service anomalies; and 3) perform real-time network/service anomaly detection. TRISTAN is demonstrated to be capable of proactively detecting network/service anomalies, which easily elude detection by the traditional alarm-based network monitoring systems.

Algorithms and online software for automated and adaptive detection of network/service anomalies have been developed and field-tested for transaction-oriented wide area networks (WAN). These transaction networks are integral parts of electronic commerce infrastructures. Our adaptive network/service anomaly detection algorithms are demonstrated in a commercially important production WAN, currently monitored by our recently implemented real-time software system, TRISTAN (transaction instantaneous anomaly notification). TRISTAN adaptively and proactively detects network/service performance degradations and failures in multiple service-class transaction-oriented networks, where performances of service classes are mutually dependent and correlated, and where external or environmental factors can strongly impact network and service performances. In this paper, we present the architecture, summarize the implemented algorithms, and describe the operation of TRISTAN as deployed in the AT&T transaction access services (TAS) network. TAS is a commercially important, high volume, multiple service classes, hybrid telecommunication and data WAN that services transaction traffic in the USA and neighboring countries. It is demonstrated that TRISTAN detects network/service anomalies in TAS effectively. TRISTAN can automatically and dynamically detect network/service faults, which can easily elude detection by the traditional alarm-based network monitoring systems.

This paper focuses on the effective management of networks that support online services that require high availability and reliability, and quick reconfiguration response and fast reconstitution time, in the event of failures. In a service independent network, the network provider provides the network assets to the service provider. In such a paradigm, the service provider, for example an Internet service provider (ISP) would like to monitor the health of the network in a proactive manner. From the service provider's view the domain of interest usually includes link failures, node failures, local dial numbers impacted, capacity and resulting congestion. We describe algorithms and methodologies for translating faults to the various impacted objects and analyze the capacity impact due to the corresponding failures. We also describe the network management architecture typically used to deliver and distribute the results of those algorithms. Finally, we present some preliminary qualitative results on the application of methods that we are currently developing in order to build dynamic performance profiles ("signatures") of application-based traffic intensities, and therefore provide enhanced and intelligent on-line network analysis and control, for value-added on-line type of services (i.e. transaction access services).