Managed Entity Configuration Trees for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing advanced networks, such as those found in data centers, is challenging due to configurators unintentionally overwriting each other, leading to undesired configuration states on managed entities, which can disrupt network functionality and user experience.
Innovation Solution
Anomaly detection is achieved by generating configuration trees for each managed entity, annotating them with information on the configurator that modified each parameter, and calculating weighted edit distances between subtrees to identify anomalous configurations using a distance matrix, allowing for the identification of the configurator and managed entity affected by the anomaly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple configurators are allowed to configure a managed entity, then configurator versatility and network management flexibility are improved, but configuration stability and reliability deteriorate due to unintended overwrites
Solution Approach 1:
The system implements feedback by continuously monitoring configuration changes across multiple configurators and comparing them against a learned normal behavior model. When a configurator deviates from expected patterns, the system generates alerts to prevent unintended overwrites, thus maintaining configuration stability while allowing multiple configurators to operate
Solution Approach 2:
The system performs preliminary action by establishing a baseline model of normal configurator behavior before anomalies can occur. This model is built by analyzing historical configuration data and typical configurator patterns, enabling the system to proactively detect and prevent deviations before they cause configuration instability
2Adaptability or versatility
If multiple configurators modify managed entity settings, then network management adaptability is improved, but configuration accuracy deteriorates due to conflicting modifications
Solution Approach 1:
The system uses feedback mechanisms to monitor configuration changes in real-time, comparing actual configurator actions against the learned model of accurate configuration patterns. This enables the system to identify and alert on inaccurate modifications while preserving the ability of multiple configurators to make valid changes
3Difficulty of detecting and measuring
If configuration changes are monitored across multiple configurators, then anomaly detection capability is improved, but system complexity increases
Solution Approach 1:
The system applies self-service by automatically learning and building the model of normal configurator behavior from historical data without requiring manual configuration or intervention. The system autonomously analyzes patterns, establishes baselines, and performs anomaly detection, reducing the operational complexity despite the enhanced monitoring capability
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Detecting an anomalous configurator of a plurality of managed entities. A plurality of configuration trees, each representing configuration parameters at a corresponding managed entity, include annotations that identify a configurator that configured each parameter. For a particular configurator, a plurality of subtrees is generated from the plurality of configuration trees. A set of weighted edit distances are calculated from the plurality of subtrees, each representing a degree of difference between a different pair of subtrees. A distance matrix is populated with the set of weighted edit distances, and the distance matrix is used to identify anomalous subtree(s) within the plurality of subtrees for the particular configurator. In embodiments, a configuration corresponding to an anomalous subtree considered to have been anomalously applied by the particular configurator. Data that identifies at least one managed entity associated with the anomalous subtree, and the particular configurator is stored.