Project Description

The modular strategy for internetwork monitoring is a hierarchical structure of Data Aggregation and Filtering Modules (DAFMs) based on a combination of spatio-temporal models and event-driven models, as shown in Fig. 1. Each level in the hierarchy corresponds to different aggregations of nodes. At the first level, the DAFMs monitor traffic flows using spatio-temporal models. They issue alerts and alarms based on the result of their online traffic analysis using network tomography techniques. At the levels above, event-driven models are used to perform modular diagnosis and distributed detection. Each intermediate level is a cluster of nodes at the level below. We assume two-way communication between any DAFM and its upper and lower hierarchical levels. Two DAFMs at the same level communicate via their upper level DES in the hierarchy. Network nodes that report to the lowest level of DAFMs can be either a single host, a single router, or a cluster of hosts or routers. The DAFMs at any level generate three different types of alerts: (i) a message to the upper level DAFM to report an alert at its level, e.g., the DAFM informs that its LAN is under attack with a set of specifications; (ii) a message to its lower (respectively, upper) level to forward a report coming from the upper (respectively, lower) level, e.g., an upper level DAFM receives an alert from one of its lower level DAFMs and reports the information to neighboring DAFMs; and (iii) a message to a particular DAFM below to request a deeper analysis at that node. These requests include priority levels, which are based on their threat levels and determined using decision making tools.

In order to support the requirements of the above architecture, a modular strategy for fault detection and isolation using event-driven models is being developed. The approach is based on the theory of fault diagnosis for discrete event systems. Two key contributions are: (i) novel notion of modular diagnosability and (ii) a computationally efficient algorithm for verifying modular diagnosability. Figure 2 shows the decision logic of the verification process. Our preliminary results so far will be presented at WODES'04 [1].