Network Controller Evaluating Boolean Asserts for Misbehavior Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network management systems, such as those using Simple Network Management Protocol (SNMP), struggle to effectively monitor and manage large-scale networks with thousands of devices, as they cannot set traps for combinations of counters across multiple devices and fail to detect misconfigurations, path unreachability, and service unreachability issues.
Innovation Solution
A method and apparatus that evaluates multiple network assertions in response to changes in network elements, using Boolean expressions to determine if actions should be taken, such as sending notifications or performing reconfigurations, to address issues like link connectivity, routing misconfigurations, and quality of service characteristics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SNMP-based NMS polls each device for counter values, then network device monitoring is achieved, but the system cannot detect complex network misbehaviors such as routing misconfigurations and path unreachability
Solution Approach 1:
The patent introduces a network controller as an intermediary component that sits between the NMS and network devices. This controller receives state information from devices, evaluates network assertions against this state, and generates alerts for complex misbehaviors. The intermediary enables sophisticated analysis without requiring the NMS to directly poll each device, thus improving detection capability while maintaining scalability.
Solution Approach 2:
The system enables network devices to self-report their state information to the network controller through mechanisms like SNMP traps or streaming telemetry. This self-service approach allows devices to push relevant state changes autonomously, reducing the polling burden on the NMS while providing the controller with up-to-date information for accurate assertion evaluation.
2Reliability
If NMS polls each device individually for counter information, then device status can be monitored, but the approach does not scale to large networks with thousands of devices
Solution Approach 1:
The patent segments the network management function into two parts: the NMS retains high-level monitoring responsibilities, while a dedicated network controller handles detailed device state evaluation and assertion logic. This segmentation allows the NMS to manage large networks efficiently by delegating complex evaluation tasks to the specialized controller, improving scalability without sacrificing monitoring reliability.
Solution Approach 2:
The network controller acts as an intermediary that consolidates device state information from multiple devices and performs batch evaluation of network assertions. This intermediary layer enables the system to handle thousands of devices efficiently by processing state information in a centralized manner rather than requiring individual NMS polling of each device.
3Loss of information
If administrator uses CLI to retrieve counter data from each device, then detailed device information can be obtained, but the process is tedious and time-consuming for large networks
Solution Approach 1:
Network devices automatically report their state information to the network controller without requiring administrator intervention. This self-service mechanism eliminates the need for administrators to manually log into each device via CLI, significantly reducing administrative time while ensuring that comprehensive device counter data is continuously collected and monitored.
Solution Approach 2:
The system establishes continuous feedback loops where devices automatically send state information to the controller, which evaluates assertions and generates alerts when misbehaviors are detected. This automated feedback mechanism replaces manual CLI checking, providing real-time information accessibility without consuming administrator time.
4Reliability
If NMS sets traps for counter values outside defined ranges, then simple threshold violations can be detected, but combinations of counters across multiple devices cannot be monitored
Solution Approach 1:
The network controller serves as an intermediary that collects state information from multiple devices and evaluates complex network assertions that involve combinations of counters across devices. This intermediary enables the system to monitor not just individual threshold violations but also complex scenarios such as routing misconfigurations and path unreachability that require analyzing relationships between multiple device states simultaneously.
Solution Approach 2:
The network assertion evaluation mechanism is designed to be universal, handling both simple threshold violations and complex combinatorial conditions across multiple devices through a single unified framework. This multi-functional approach allows the system to monitor diverse network misbehaviors using the same infrastructure, enhancing versatility while maintaining reliable threshold monitoring.
Data Source
AI summary
A method and apparatus of a device that evaluates multiple network asserts in response to changing network of network elements is described. In an exemplary embodiment, the device receives the multiple network asserts, where each of the plurality of network asserts represents a Boolean expression regarding a condition of at least one characteristic of at least one of the network elements. The device further detects a change in the network. In response to the detected change, the device, for one or more of the network asserts, evaluates this network assert to determine if this network asserts raises an action associated with this network assert. The device further performs the action associated this network assert if the network assert was raised.