Search

Our previous work proposed a simple algorithm for the distribution and coordination of network management policies across a number of autonomous management nodes by partitioning an Abstract Syntax Tree into different branches and specifying coordination points based on data and control flow dependencies. We now extend this work to support more complex policies containing control flow logic and looping, which are part of the PRONTO policy language. Early simulation results demonstrate the potential performance and scalability characteristics of this framework. [ABSTRACT FROM AUTHOR]

Dynamic provisioning systems change application capacity in order to use enough resources to accommodate current load. Rejuvenation systems detect/forecast software failures and temporarily remove one or more components of the application in order to bring them to a clean state. Up to now, these systems have been developed unaware of one another. However, many applications need to be controlled by both. In this paper we investigate whether these systems can actuate over the same application when they are not aware of each other, i.e., without coordination. We present and apply a model to study the performance of dynamic provisioning and rejuvenation systems when they actuate over the same application without coordination. Our results show that when both systems coexist application quality of service degrades in comparison with the quality of service provided when each system is acting alone. This suggests that some level of coordination must be added to maximize the benefits gained from the simultaneous use of both systems. Keywords: Interacting systems, dynamic provisioning, rejuvenation. [ABSTRACT FROM AUTHOR]

We propose a management architecture for the P2P model which respects its distributed nature while building a hierarchical structure. This architecture enables the distribution of management functions, avoids an excessive centralization of the manager role and fits the dynamic of the P2P model well. The architecture is evaluated through an implementation in the Pastry framework. [ABSTRACT FROM AUTHOR]

The growth in the scale of systems and networks has created many challenges for their management, especially for event processing. Our premise is that scaling event processing requires parallelism. To this end, we observe that event processing can be divided into intra-event processing such as filtering and inter-event processing such as root cause analysis. Since intra-event processing is easily parallelized, we propose an architecture in which intra-event processing elements (IAPs) are replicated to scale to larger event input rates. We address two challenges in this architecture. First, the IAPs are subject to overloads that require effective flow control, a capability that was not present in the components we used to build IAPs. Second, we need to balance the loads on IAPs to avoid creating resource bottlenecks. These challenges are further complicated by the presence of disturbances such as CPU intensive administrative tasks that reduce event processing rates. We address these challenges using designs based on control theory, a technique for analyzing stability, accuracy, and settling times. We demonstrate the effectiveness of our approaches with testbed experiments that include a disturbance in the form of a CPU intensive application. [ABSTRACT FROM AUTHOR]

Threshold crossing alerts (TCAs) indicate to a management system that a management variable, associated with the state, performance or health of the network, has crossed a certain threshold. The timely detection of TCAs is essential to proactive management. This paper focuses on detecting TCAs for network-level variables, which are computed from device-level variables using aggregation functions, such as SUM, MAX, or AVERAGE. It introduces TCA-GAP, a novel protocol for producing network-wide TCAs in a scalable and robust manner. The protocol maintains a spanning tree and uses local thresholds, which adapt to changes in network state and topology, by allowing nodes to trade unused "threshold space". Scalability is achieved through computing the thresholds locally and through distributing the aggregation process across all nodes. Fault-tolerance is achieved by a mechanism that reconstructs the spanning tree after node addition, removal or failure. Simulation results on an ISP topology show that the protocol successfully concentrates traffic overhead to periods where the aggregate is close to the given threshold. [ABSTRACT FROM AUTHOR]

Wireless sensor networks (WSNs) are employed in different domains and applications. The resource constraint on such networks, many times composed of hundreds to thousands of devices, and the requirement of autonomous operation become their management a challenging task. This work applies policies, a well-known approach in network management, in the core task of routing in autonomous WSNs. Policies are used to establish rules to take dynamic actions on the network according to its state. Our scheme offers a high-level and flexible way to realize management tasks related to routing in WSNs, which can be defined in a progressive way as knowledge from the environment is acquired or application requirements change. Case studies employing a policy-based adaptive hybrid solution allows the autonomous selection of the best routing strategy in view of network conditions and application requirements. Simulation results show the benefits and resource savings offered by the use of policies for adaptive routing in WSNs. Keywords: Wireless Sensor Networks, Routing, Policy-based design. [ABSTRACT FROM AUTHOR]

BGP/MPLS VPN is a mechanism defined in IETF RFC 2547 that allows service providers to use their IP backbone to provide VPN services. This mechanism is based on using BGP to distribute VPN routing information to the routers in the backbone network and using MPLS to forward VPN traffic. MPLS tunnels are created dynamically when needed, which relieves service providers of pre-provisioning tens of thousands of tunnels. BGP/MPLS VPNs allow service providers to define any arbitrary topology with any number of nodes in a VPN. The service provider can create multiple VPNs using the same core network. Currently most of the service providers track 2547 VPNs either manually or by using a provisioning database. Algorithms described in this paper aims at automating this VPN discovery procedure. Using our algorithms service providers can automatically discover VPNs that have already been configured using the current network configuration information. Keywords: BGP, MPLS, VPN, Discovery, 2547, Route Target, VRF, Topology. [ABSTRACT FROM AUTHOR]

Verifying whether the routing information originating from an AS is being correctly distributed throughout the Internet is important for stable inter-AS routing operation. However, the global behavior of routing information is difficult to understand because it changes spatially and temporally. Thus, rapid detection of inter-AS routing failures and diagnosis of their causes are also difficult. We have developed a multi-agent-based diagnostic system, ENCORE, to cope with these problems, and improved its functions (ENCORE-2) through our experience in applying the system to commercial ISPs. Cooperative actions among ENCORE-2 agents provide efficient methods for collecting, integrating, and analyzing routing information observed in multiple ASes to detect and diagnose anomalies that human operators have difficulty in handling. ENCORE-2 is also applied to the hijacked route problem, which is one of recent major inter-AS issues. [ABSTRACT FROM AUTHOR]

We present a design for policy-based performance management of SMS Systems. The design takes as input the operator's performance goals, which are expressed as policies that can be adjusted at run-time. In our specific design, an SMS administrator can specify the maximum delay for a message and the maximum percentage of messages that can be postponed during periods of congestion. The system attempts to maximize the overall throughput while adhering to the performance policies. It does so by periodically solving a linear optimization problem that takes as input the policies and traffic statistics and computes a new configuration. We show that the computational cost for solving this problem is low, even for large system configurations. We have evaluated the design through extensive simulations in various scenarios.It has proved effective in achieving the administrator's performance goals and fast in adapting to changing network conditions. A prototype has been developed on a commercial SMS platform, which proves the validity of our design. [ABSTRACT FROM AUTHOR]

Nowadays, dynamic service management frameworks are proposed to ensure end-to-end QoS. To achieve this goal, it is necessary to manage Service Level Agreements (SLAs), which specify quality parameters of the services operation such as availability and performance. This work is focused on the evaluation of Video-on-Demand (VoD) services in end-to-end QoS scenarios. Based on a straightforward Markov Chain, Markov-Reward Chain (MRC) models are developed in order to obtain various QoS measures of an adaptive VoD service. The MRC model has a clear understanding with the design and operation of the VoD system. In this way, new design options can be proposed and be easily evaluated. To compute performability measures of the MRC model, the randomization method is employed. Predicted model results fit well to the ones taken from a real video-streaming testbed. [ABSTRACT FROM AUTHOR]

This paper presents a decentralized traffic management solution suitable for Ambient Networks environments, where heterogeneous networks will have to cooperate with a high degree of dynamicity, both in traffic patterns and network topologies. Considering IP as the base inter-network technology in these environments, the proposed mechanism autonomously interacts with existing intra-domain routing protocols to improve traffic performance. The proposal has been evaluated by simulation and has been shown how it significantly improves the traffic performance with respect to the solutions currently deployed in networks. For the two simulated scenarios, the proposed solution is able to manage 38% and 15% more traffic than current solutions when the network starts to be congested. Anyway, the behavior of the proposed solution is currently being analyzed in more dynamic scenarios in order to check its goodness for different Ambient Networks environments. [ABSTRACT FROM AUTHOR]

This paper deals with a shared server environment where the server is divided into a number of resource partitions and used to host multiple applications at the same time. In a case study where the HP-UX Process Resource Manager is taken as the server partitioning technology, we investigate the technical challenges in performing automated sizing of a resource partition using a feedback control approach, where the CPU entitlement for the partition is dynamically tuned to regulate output metrics such as the CPU utilization or SLO-based application performance metric. We identify the nonlinear and bimodal properties of the models across different operating regions, and discuss their implications for the design of the control loops. To deal with these challenges, we then propose two adaptive controllers for tracking the target utilization and target response time respectively. We evaluate the performance of the closed-loop systems while varying certain operating conditions. We demonstrate that better performance and robustness can be achieved with these controllers compared with other controllers or our prior solution. [ABSTRACT FROM AUTHOR]

Research has been performed in areas of auditing, a.o. security auditing, compliance auditing, financial auditing. In order to increase the efficiency of and to allow for continuous auditing, auditing tasks must be automated, which is only possible if audit data are available digitally and suitable algorithms exist. Different areas of auditing follow different objectives, thus require different detailed tasks to be performed, yet they share a common auditing model. This is based on the consideration that in general auditing deals with the evaluation or examination of facts against a set of compliance specifications. The objective of this paper is to develop a generic model and architecture for automated auditing, thus providing the basis for the development of auditing work for specific applications. To show its general applicability, the proposed model is applied to different areas including Service Level Agreement (SLA) compliance verification and Intrusion Detection Systems. A full-fledged example is discussed showing in detail how the generic architecture is applied to the SLA compliance verification. [ABSTRACT FROM AUTHOR]

End-to-end automated application design and deployment poses a significant technical challenge. With increasing scale and complexity of IT systems and the manual handling of existing scripts and configuration files for application deployment that makes them increasingly error-prone and brittle, this problem has become more acute. Even though design tools have been used to automate system design, it is usually difficult to translate these designs to deployed systems in an automated manner due to both syntactic obstacles and the synchronization of multiple activities involved in such a deployment. We describe a generic process of automated deployment from design documents and evaluate this process for 1, 2, and 3-tier distributed applications. [ABSTRACT FROM AUTHOR]

Presently, there is no satisfactory model for dealing with political autonomy of agents in policy based management. A theory of atomic policy units called ‘promises' is therefore discussed. Using promises, a global authority is not required to build conventional management abstractions, but work is needed to bind peers into a traditional authoritative structure. The construction of promises is precise, if tedious, but can be simplified graphically to reason about the distributed effect of autonomous policy. Immediate applications include resolving the problem of policy conflicts in autonomous networks. [ABSTRACT FROM AUTHOR]

The promise of policy-based management is lessened by the risk of conflicts between policies. Even with careful conception of the policies it is difficult if not impossible to avoid conflicts completely. However, it is in principle possible to detect and resolve conflicts either statically or at runtime. Taking advantage of existing managed systems models it is even possible to detect and resolve policy conflicts not addressed until now. In this paper we present a generic approach to automated policy conflict detection based on existing knowledge about a managed system. We describe a methodology to derive conflict definitions from invariants of managed systems models, and show how these can be used to detect and resolve policy conflicts automatically. [ABSTRACT FROM AUTHOR]

A method is proposed whereby values for Service Level Objectives (SLOs) of an SLA can be chosen to reduce the sum IT infrastructure cost plus business financial loss. Business considerations are brought into the model by including the business losses sustained when IT components fail or performance is degraded. To this end, an impact model is fully developed in the paper. A numerical example consisting of an e-commerce business process using an IT service dependent on three infrastructure tiers (web tier, application tier, database tier) is used to show that the resulting choice of SLOs can be vastly superior to ad hoc design. A further conclusion is that infrastructure design and the resulting SLOs can be quite dependent on the "importance" of the business processes (BPs) being serviced: higher-revenue BPs deserve better infrastructure and the method presented shows exactly how much better the infrastructure should be. [ABSTRACT FROM AUTHOR]

Proposed EU regulations on data retention could require every provider to keep accounting logs of its customers' Internet usage. Although the technical consequences of these requirements have been investigated by consultancy companies, this paper investigates what this accounting data could be, how it can be obtained and how much data storage is needed. This research shows that every gigabyte of network traffic results in approximately 400 kilobyte of accounting data when using our refinements to existing methods for storing accounting data - less by a factor twenty than previously assumed. [ABSTRACT FROM AUTHOR]

The management of service oriented architectures demands an efficient control of service users and their authorizations. Similar to structured cabling in LANs, Identity & Access Management systems have proven to be important components of organizations' IT infrastructures. Yet, due to new management challenges such as virtual organizations, on-demand computing and the integration of third party services through composition, identity information has to be passed to external service providers; this decentralization inherently leads to interoperability and privacy issues, which existing management standards are not dealing with appropriately yet. We present an architecture, based on SAML, XACML and XSLT, which provides a tight integration of cross-organizational identity data transfer into the local provisioning business processes along with a policy-driven inter-domain privacy management system, and its implementation. [ABSTRACT FROM AUTHOR]

The security mechanisms employed in today's networked environments are increasingly complex and their configuration management has an important role for the protection of these environments. Especially in large scale networks, security administrators are faced with the challenge of designing, deploying, maintaining, and monitoring a huge number of mechanisms, most of which have complicated and heterogeneous configuration syntaxes. This work offers an approach for improving the configuration management of network security systems in large-scale environments. We present a configuration process supported by a modelling technique that uniformly handles different mechanisms and by a graphical editor for the system design. The editor incorporates focus and context concepts for improving model visualisation and navigation. [ABSTRACT FROM AUTHOR]

Studying the performance of a distributed system without taking care on the impact of its management system will falsify the understanding of its overall performance, especially its productivity. We propose a metric called MIM (Management Impact Metric) to evaluate this impact by varying one or several impact factors related to the management system within a management strategy of the managed system. We show the accuracy and interest of our metric on a managed J2EE application server that uses a management architecture based on the JMX standard. Keywords: Managed systems performance, productivity, manageability. [ABSTRACT FROM AUTHOR]

Current network management architectures are using different models to define management information objects. These definitions actually also include, in a non-formal way, the definition of some behaviour information that a manager should accomplish related to the managed objects. So, a manager is not able to make an automatic processing of this behaviour information. Prior research work proposed the use of formal ontology languages, such as OWL, as a way to make a semantic integration of different management information definitions. This paper goes further proposing a formal definition of the different management behaviour specifications integrated with the management information definitions. Thus, usual behaviour definitions included implicitly in the management information definitions and explicitly in policy definitions can be expressed formally, and included with the information definitions. This paper focuses on the definition of behaviour rules in management information with SWRL, a rule language defined to complement OWL functionality. [ABSTRACT FROM AUTHOR]

Integrated network management frameworks include a common definition of the managed resources, known as an information model, which is a key factor to describe the domain to be managed. In this scope, it is important to understand the semantics each information model provides to allow interoperation among different integrated management architectures. For this, ontology languages have recently been proposed, because thanks to their formalization they can deal with the semantics of information. Nevertheless, they need to be adapted to meet the management requirements. An alternative to the use of ontology languages can be the formalization of the management information languages to cope with the semantics of the information models. This paper provides a way to formalize one of these management languages: the Common Information Model metaschema. The formalization is based on the use of the Object Constraint Language to define in a formal way the set of natural language rules that describe this metaschema, improving its semantics, comparing also this solution to those based on ontologies. [ABSTRACT FROM AUTHOR]