Monitoring Reaction

This document focuses on monitoring reaction. The monitoring reaction phase follows the anomaly detection phase. It is triggered upon detecting an anomaly. Previously, in the deliverable D2.6, we have investigated the problem of monitor location and anomaly detection in mono-domain and multi-domain networks. Monitoring reaction consists in pinpointing the source of an anomaly observed during the detection phase, and then per- forming the appropriate action (e.g. traffic re-routing, re-negotiating the SLA, xing the physical failure of a network device) to re-establish the normal func- tioning of the network. The action of pinpointing the source of an anomaly is called anomaly localization. Anomaly localization must be accurate, fast and cost e cient. In this document, we study the e ectiveness of decoupling the localization phase from the detection phase. Our main contributions in this work are link-level anomaly localization solutions for mono-domain and multi-domain networks that satisfy these criteria. The rst chapter of this document introduces the problem and describes existing localization solu- tions. The second chapter formulates and evaluates our anomaly localization solution for mono-domain networks. The third chapter focuses on anomaly localization in multi-domain networks.

D2.7