Study group 2012.04.09 Junction SHERLOCK IS AROUND: DETECTING NETWORK FAILURES WITH LOCAL EVIDENCE FUSION Qiang Ma 1 , Kebin Liu 2 , Xin Miao 1 , Yunhao Liu 1,2 1 Department of Computer Science and Engineering, Hong Kong University of Science and Technology 2 MOE Key Lab for Information System Security, School of Software, Tsinghua National Lab for Information Science and Technology, Tsinghua University 2012/04/09 1
21
Embed
Study group 2012.04.09 Junction SHERLOCK IS AROUND: DETECTING NETWORK FAILURES WITH LOCAL EVIDENCE FUSION Qiang Ma 1, Kebin Liu 2, Xin Miao 1, Yunhao Liu.
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
1
Study group2012.04.09Junction
SHERLOCK IS AROUND: DETECTING NETWORK FAILURES WITH LOCAL EVIDENCE FUSIONQiang Ma 1 , Kebin L iu 2 , Xin Miao 1 , Yunhao L iu 1 , 2
1 Department of Computer Science and Engineer ing, Hong Kong Univers i ty of Sc ience and Technology
2 MOE Key Lab for Information System Securi ty, School of Software,
Ts inghua Nat ional Lab for Information Science and Technology, Ts inghua Univers i ty
2012/04/09
2
Motivations: Widely deployed WSNs for numerous application
Need to sustain for years, and operate reliably Error-prone and subject to component faults, performance
degradations It’s more challenging to explore the root causes for WSNs
Ad-hoc feature of WSNs: large-scale, dynamical changes of topology
Limit sources of sensor nodes: power, computation capability The existence of a large variety of specific protocols for WSNs
INTRODUCTION
2012/04/09
3
Traditional/popular way of diagnosis process Sink-based
Actively collect global evidences from sensor nodes to the sink Remaining energy, MAC layer backoff, neighbor table, routing table …
Conduct centralized analysis at the powerful back-end Disadvantages
Communication overhead
Avoid large overhead in evidence collection process Self-diagnosis
Injects fault inference model into sensor nodes Make local decisions
Disadvantages Results from single nodes: Inaccurate due to the narrow scope Inconsistent results from different inference processes
2012/04/09
RELATED WORKS
4
Main Design Diagnosis effi ciency
Local diagnosis process instead of backend Reduce communication overhead
Diagnosis accuracy Take judgments form all nodes with the local area into
consideration
2012/04/09
LOCAL DIAGNOSIS (LD2)
5
Working like this: Nodes running NBC: *state attributes = evidences
Posterior probability distribution: P(root causes|evidences) Once a node detect anomalies
Construct a fusion tree and do evidence fusion
Advantages: Balance the workload ensure a local consensus to the final diagnosis result
2012/04/09
SYSTEM ARCHITECTURENaïve Bayesian Classifier to encode the probability correlation between a set of state attributes and root causes
If its neighbor node has been removed from the neighbor list, the process would be triggered.
Dempster-Shafer TheoryTheory of evidence (DST)
6
Parameters learned from historical data R: root cause; F i, where i=1,…,n: evidences; : store s discrete values Calculate the posterior probability
The posterior probabilities of diff erent root causes Each node, based on F i observed, calculate the With certain mapping (normalization), Used later as the basic probability assignments in DST
2012/04/09
NAÏVE BAYESIAN CLASSIFIER (NBC)
Pre-learned
Scale factor: constant for different R
7
Fundamentals Allow us to combine evidence from different sources and
arrive at a degree of belief in all possible states/hypotheses (R, root causes) that takes into account all the available evidences (F, metrics).
Terms: Hypotheses: The frame of discernment: basic probability/belief assignment: m
(subjective or objective) , A: focal element constraint:
*posterior probability (objective)
2012/04/09
DEMPSTER-SHAFER THEORY (DST)
8
Diff erent from the concept of probability Belief: Plausibility: Pl(s)=1-Bel(~s) Belief <= plausibility
In this study The frame of discernment , R i: root causes
RO: no problem Only generates
2012/04/09
DEMPSTER-SHAFER THEORY (DST)
9
Combine the belief from diff erent observers (sensor nodes) To do evidence fusion
conflict factor joint mass
Problem: The combination result goes against the practical sense!! When with low or high conflict factor