The Management Information Base

1
The Management Information Base

• and how it can be used for Proactive Network
  Management

By Victor Antonov
2
Internet network management framework

• MIB management information base
• SMI data definition language
• SNMP protocol for network management
• security and administration

3
The MIB

• Located on each network device
• Contains statistics about each managed object
• Actual pieces of hardware
• Configuration parameters
• Performance statistics
• Information is gathered through SNMP protocol

4
The MIB Modules

• More than 200 standard MIB modules
• Large number of vendor-specific (private) modules
• Identification and classification system
• Part of the ASN.1 (Abstract Syntax Notation One)
  object definition language
• Naming is achieved in hierarchical (tree) manner
  where each branch point is given both a name and
  a number
• Using these two parameters, each object, being a
  point in the tree, is identifiable through the
  path from the root to its place in the tree.
• MIB modules are found under the MIB-2 branches.
• There are modules for TCP, IP, UDP, etc, as well
  as for system, interface and address translation.

5
How is the MIB used?

• Analysis of the data is needed in order to form a
  policy or to take actions against exceptional
  conditions.
• People are often needed
• able to think creatively, as well as analytically
• foresee problems and act in advance.
• Automated management
• takes care of the network basically all the time
  this network is operational.
• cannot take preemptive actions unless
• more complicated algorithms are needed to achieve
  successful automation.

6
Proactive Network Management

• Typically a human task
• Monitor the system variables to identify
  untypical and erroneous trends
• Use real-time data mining as opposed to
  analytical models which are to be used later
• an intelligent, self-learning algorithm will
  utilize data mining as training input and once
  deployed, it will ideally detect hazardous
  situations before they become a problem.

7
Currently Proposed Automated Congestion Avoidance
Solutions

• Centrally managed/coordinated neural networks and
  learning algorithms
• Problem scalability (as the network grows,
  handling can go out of hand)
• Decentralized approach
• Active Queue Management.
• Congestion indicators arrival and departure
  rates of traffic at each node.
• Fault prediction system based on Bayesian Belief
  Networks
• Or based on statistical techniques.

8
Lets Use Data Mining

• Identify specific MIB variables along with queue
  parameters to feed an intelligent data mining
  algorithm
• Train and validate a model that will supply each
  node in the network with an early warning system
• SNMP standard will be employed to capture the MIB
  data.
• A simulation of the proposed model has been build
  using OPNET as the network simulation model and
  Clementine (an SPSS tool) as the data analysis
  tool
• OPNET represents network events through an event
  driven simulation engine and communication
  protocol logic through finite state automata

9
(No Transcript)
10
Steps to Success

• The experiment consisted of several stages
• Data Collection
• Feature Extraction
• Feature Selection
• Model Building
• Model Validation
• Model Deployment

11
Data Collection

• Information regarding
• the arrival and departure rate of traffic at that
  node (MIB variables such as ipInReceives,
  ipForwDatagrams and ipOutDiscards)
• the status of the queue at the bottleneck -
  pseudoMIB variables (queue statistics which are
  logged)
• level of congestion at that node.
• A variable for the congestion, the Congestion
  Indicator (CI) is logged, indicating the state of
  the network at a given time

12
Feature Extraction and Selection

• Feature Extraction
• relationships are found between the various
  parameters and the CI
• several parameters are considered to be related
  to congestion rate of change of input, rate of
  change of discard, available buffer space and the
  rate of traffic entering and leaving the node
• Feature Selection
• a statistical test is used to determine the
  behavior of the different variables during
  congestion periods. This particular t-test is for
  two samples and unequal variances.
• two ways the test parameters can be analyzed
• univariate analysis where parameters are analyzed
  in isolation
• multi-variate analysis analyzing the
  significance of each parameter in relation to the
  others
• Results from the test indicate that the ratio of
  available buffer space to the difference between
  input and output traffic rate is the most
  indicative of congestion

13
Model Building and Validation

• The results are used to successfully build a
  training model
• three input variables the CI, the ratio and the
  change in input rate (which was also found
  significant in regards to congestion)
• Decision tree approach
• Classification and Regression Trees (CaRT)
• Reasoning the data set can be clearly
  partitioned into well defined classes levels of
  severity of congestion at the network node
• Model Validation phase showed that in all cases
  the accuracy achieved was greater than 98.

14
(No Transcript)
15
Some Thoughts For the Future

• Q What happened to Model Deployement
• A Not ready yet!
• So far the proposed network management system has
  proved to be accurate in predicting congestion
• However we need also
• ability to identify symptoms of early congestion
  using statistical techniques such as time series
  analysis.
• control approaches to be identified
• full automation and learning online in real time.

16
References

• Kurose, James F., and Keith W. Ross. Computer
  Neworking A Top-Down Approach. Boston
  Pearson/Addison Wesley, c2008
• Kulkarni, P. G., et al. Deploying MIB Data
  Mining for Proactive Network Management. 3rd
  International IEEE Conference Intelligent
  Systems, September 2006. pp. 506-511