
of traffic situations. For proactive control, we first
describe the details of a traffic anomaly detection
approach that isn’t based on thresholding. Next, we
introduce a control switching method that makes
effective use of traffic anomaly detection. To handle
Problem 2, we propose multipath control which
enables the path control to be based on traffic
classes. As the multipath algorithm, we apply a
linear optimization algorithm to guarantee
optimality.
From the QoS viewpoint, it is said that
distributed control system is not suitable because it
fails to offer traffic quality guarantees. Accordingly,
we chose the centralized control model. We use a
QoS manager that can control the entire network
(Figure 1). Proactive control decides whether control
is necessary or not. When control is necessary,
proactive control sends a message to multipath
control which calculates the optimal path setting to
realize QoS control.
Proactive Control
QoS Manager
Network Devices
Multipath Control
Measure for Traffic Change New Parameter Setting
Figure 1: Architecture
The remainder of the paper is organized as
follows. Section 2 describes proactive control. First
we define the meaning of proactive, and then explain
traffic anomaly detection, which is based on the use
of attractors. In Section3 we propose a QoS aware
multipath algorithm that uses linear optimization.
Computer simulations and result are discussed in
Section4. Section 5 concludes our paper.
2 PROACTIVE CONTROL
2.1 Definition of Proactive Control
In conventional cellular network operation, a certain
control procedure is triggered after the threshold is
exceeded. This operation can be described as
reactive control. The problem of reactivity is the
delay in triggering system responses such as
congestion control. Using a threshold means that the
control procedure is not begun until the traffic
exceeds the threshold. If traffic increases rapidly, the
control procedure may not be completed in time. To
solve this problem, it is natural to lower the
threshold to detect traffic anomalies earlier, but this
causes control overhead because low thresholds are
exceeded far more often.
This problem is caused by the lack of an
approach to cope with traffic anomalies. Thus, our
solution is to define proactive control as a
combination of both local and global traffic anomaly
detection. First we describe traffic anomaly
detection.
2.2 Traffic Anomaly Detection
There are several approaches to detect traffic
anomalies. The methods described are rule-based
approaches, finite state machine models, pattern
matching, and statistical analysis (Thottan, 2003).
The rule-based approach uses an exhaustive
database containing the rules of system behavior to
determine if an anomaly has occurred (Ndousse,
1996). Rule approaches are too slow for real-time
detection and are dependent on prior knowledge
about the anomalous conditions on the network
(Lewis, 1993). Moreover, rule approaches rely
heavily on the expertise of the network manager, and
do not adapt well to an evolving network
environment (Franceshi, 1996).
Anomaly detection using finite state machines
model alarm sequences that occur during and prior
to fault events. A review of such state machine
techniques can be found in (Lazar, 1992) and
(Jakobson, 1992). The difficulty encountered in
using the finite state machine method is that not all
faults can be captured by a finite sequence of alarms
of reasonable length. This may cause the number of
states required to explode as a function of the
number and complexity of faults modeled (Thottan
2003).
Statistical analysis uses the standard sequential
change point detection approach. The source of such
analysis is SNMP MIB data. (Thottan, 1998)
proposed duration filter heuristics to obtain real-time
alarms using MIB variables.
In pattern matching approach, online learning is
used to build a feature map for a given network.
These maps are categorized by time of day, day of
week, and special days, such as weekends and
holidays. The simplest way of making the feature
map is to reproduce the traffic pattern. This map,
however, has a time-axis which means that the
memory capacity increases when the monitoring
interval shortens. As for the change in IP traffic
volume, changes over periods of 1 second or less are
important. In this time scale, it is impractical to
make the map mirror the real traffic.
All four approaches are complementary. So we
can combine these approaches to realize a better
detection system. In this paper, we propose a pattern
matching method which utilizes an attractor (Takens,
1981). An Attractor map is constructed from the
ICETE 2004 - SECURITY AND RELIABILITY IN INFORMATION SYSTEMS AND NETWORKS
200