Multi-Strategy Learning for Recognizing Network Symptoms

Abstract

Background: Many network symptoms may happen due to different reasons in today's computer networks. The finding of a few kinds of these interesting symptoms is not direct. Therefore, an intelligent system is presented for extracting and recognizing that kind of network symptoms based on prior background knowledge. Methods: Here, the main target is to build a network-monitoring tool that can discover network symptoms and provide reasonable interpretations for various operational patterns. These interpretations are discussed with the purpose of supporting network planners/administrators. It introduces Multi-Strategy Learning (MSL) that can recognize network symptoms. Repeated symptoms or sometimes a single event of heavy traffic networks may lead us to recognize various network patterns that maybe expressed for discovering and solving network problems. Results: To achieve this goal an MSL system that can accommodate network observations. The first technique is done in an empirical manner. It focuses on selecting subsets data traffic by using certain fields from a group of records related to database samples using queries. The data abstraction is accomplished and various symptoms are extracted. A second technique is based on explanation-based learning. It produces a procedure that obtains operational rules. These rules may lead to network administrators solving some problems later. By using only one formal training example in the domain knowledge (network), we can learn and analyze in terms of this knowledge. In this work, to store and maintain network-monitoring traffic, network events, and the knowledge base for implementing the above techniques a Hadoop and a relational database are used. Discussion: Using EBL only is not suitable and it cannot take the same props like other types of available training data set as SBL can. EBL does not need only a complete domain theory but also need consistent domain theory. This reduces the suitability of EBL as knowledge acquisition. For this reason, we used EBL for discovering the pattern of network malfunction in case of a single example only in order to take a complete solution for this example. Conclusion: Hence, the proposed system can discover abnormal patterns (symptoms) of the underlying network traffic. A real network using our MSL, as such, could recognize these abnormal patterns. The network administrator can adapt the current configuration according to advice and observations that come from that intelligent system in order to avoid the problems that may currently exist or it may happen in the near future. Finally, the proposed system is capable to extract different symptoms (behaviors and operational patterns) and provide sensible advice in order to support network-planning activity.