Network Anomaly Detection via Subnet Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large communication networks, such as data center networks, often experience errors in switch forwarding tables that can lead to packet loops or black-holes, making it difficult to detect and address network anomalies effectively.
Innovation Solution
A method and system for analyzing network abnormalities by receiving routing information from multiple switches, processing forwarding rules to identify matching subnets, forming groups of forwarding rules, generating forwarding graphs, and identifying graph properties indicative of network anomalies, utilizing modules like a route dumper, forwarding rules splitter, match modules, grouping module, and graphing modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If routing information from all switches is processed together, then network anomaly detection accuracy is improved, but processing time and system complexity increase significantly
Solution Approach 1:
The patent divides the network routing information processing into multiple independent segments corresponding to different subnets. Each subnet's forwarding rules are processed separately to generate individual forwarding graphs, which are then analyzed for anomalies. This segmentation allows parallel processing of different subnets, reducing overall processing time while maintaining comprehensive anomaly detection coverage across the entire network.
2Measurement precision
If routing information from all switches is processed together, then comprehensive anomaly detection is improved, but computational complexity increases
Solution Approach 1:
The system segments the complex network analysis task into manageable components: routing information collection from switches, forwarding rule extraction, subnet-based grouping, forwarding graph generation, and anomaly detection. Each component operates independently on specific data subsets, reducing memory requirements and computational complexity while maintaining comprehensive detection capability through the aggregation of results from all segments.
3Adaptability or versatility
If the network analysis system scales to handle larger networks, then network coverage is improved, but processing resources required increase
Solution Approach 1:
The patent implements a scalable architecture where the network is divided into multiple subnets, each processed independently. When the network grows, new subnets are simply added to the existing structure without requiring reprocessing of entire network data. The system dynamically allocates processing resources to handle the number of subnets present, allowing linear scaling of resource requirements with network size rather than exponential growth.
Solution Approach 2:
The system processes only the portion of routing information relevant to each specific subnet rather than analyzing all forwarding rules across the entire network for every anomaly check. This partial processing approach reduces the quantity of data handled at each processing stage while still providing comprehensive network-wide anomaly detection by aggregating results from all subnet analyses.
Data Source
AI summary
This disclosure provides systems, methods and apparatus for providing a network verification system (NVS) to analyze and detect anomalies and errors within a network. The NVS requests forwarding tables from each of the switches within the network being analyzed, and generates directed forwarding graphs for each subnet within the network. Certain graph properties of the directed forwarding graphs are analyzed to detect anomalies or errors in the subnets represented by the directed forwarding graphs. In some implementations, the NVS can execute the generation of the directed forwarding graphs in parallel. In some implementations, the NVS can be implemented on a MapReduce system.