Traceroute Data Collector System for Network Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Disruptions in internet services due to node failures cause deviations from normal network performance patterns, leading to connectivity issues and increased latency, which can disrupt content delivery and increase costs for service providers.
Innovation Solution
A globally distributed traceroute data collector system that detects anomalies by comparing expected and current latency values, allowing a master server to identify and characterize performance issues, and issue alerts to improve network performance by rerouting traffic and reducing congestion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the internet uses packet switching with many nodes to withstand node failures, then system reliability is improved, but network performance disruption occurs when nodes fail due to equipment failure, natural disaster, or political events
Solution Approach 1:
The system performs preliminary actions by continuously monitoring network latency and establishing baseline performance patterns before failures occur. The traceroute data collection system proactively measures latency metrics and stores baseline data that can be quickly compared against current performance to detect anomalies early, enabling rapid response to node failures and minimizing connectivity disruption.
2Measurement precision
If traceroute data is collected from multiple collectors to detect network anomalies, then measurement precision is improved, but device complexity increases due to the globally distributed collector system
Solution Approach 1:
The system segments the anomaly detection function across multiple independent traceroute collectors distributed globally. Each collector independently measures latency to specific targets and reports data to a central system. This segmentation allows the system to achieve high measurement precision through multiple observations while maintaining manageable complexity by making each collector a simple, standardized component that performs a single function.
Solution Approach 2:
The traceroute collectors serve multiple functions: they measure latency to multiple targets, collect baseline performance data, detect anomalies, and provide data for generating alerts. This multi-functionality reduces overall system complexity by having standardized collectors that can be deployed universally across the network infrastructure to perform various monitoring tasks.
3Difficulty of detecting and measuring
If the system compares expected latency with current latency to identify anomalies, then anomaly detection capability is improved, but loss of time occurs during data processing and comparison operations
Solution Approach 1:
The system performs preliminary actions by pre-calculating and storing baseline latency data representing normal network performance patterns. When detecting anomalies, the system only needs to compare current latency measurements against these pre-established baselines using simple threshold comparisons or statistical tests, rather than performing complex analysis in real-time. This dramatically reduces processing time while maintaining high anomaly detection capability.
4Measurement precision
If the master server processes data from numerous traceroute collectors to generate performance alerts, then information transmission performance monitoring is improved, but use of energy increases due to data collection and processing operations
Solution Approach 1:
The system extracts only the essential latency measurement data from traceroute packets and discards redundant information. The collectors send minimal data (latency values and timestamps) to the master server, which then performs focused comparisons against baseline data. This extraction approach maintains high performance monitoring accuracy by focusing on key metrics while significantly reducing the energy required for data transmission and processing compared to analyzing complete traceroute paths.
Data Source
AI summary
An alert system and method are provided to identify and characterize real-time information transmission anomalies in high-frequency global and local traceroute data. The system includes active network sensors and/or collector devices, which collect traceroute data associated with transmissions to different points in a computer network and provide the traceroute data to a master server. The traceroute data is obtained by the active network sensors by sending probing data packets to numerous computing target devices located locally with respect to the target device and/or globally. The master server determines one or more anomalies from the received traceroute data and characterizes the anomaly in terms of type, severity, location, affected Domain Name System (DNS) server and/or Internet Service Provider (ISP).