Database Reference
In-Depth Information
6.2.
M
edian vs.
M
edian Graph,
A
djacent in Time
(mma)
Here
˜
˜
we
compute
two
median
graphs,
G
1
and
G
2
,
in
windows
˜
of length
L
1
and
L
2
, respectively, i.e.,
G
1
is the median of the
G
n−L
1
+1
,...,G
n
)and
˜
sequence (
G
2
is the median of the sequence
(
G
n
+1
,...,G
n
+
L
2
). We measure now the abnormal change between time
n
(
˜
˜
and
n
+1 by means of
d
G
1
,
G
2
). That is, we compute
ϕ
1
and
ϕ
2
for
each of the two windows using Eq. (6.1) and classify the change from
G
n
to
G
n
+1
as abnormal if
L
1
ϕ
1
+
L
2
ϕ
2
(
˜
˜
d
G
1
,
G
2
)
≥ α
.
L
1
+
L
2
Measure
mma
can be expected even more robust against noise and out-
liers than measure
msa
. If the considered median graphs are not unique,
similar techniques (discussed for measure
msa
) can be applied.
6.3.
M
edian vs.
S
ingle Graph,
D
istant in Time
(msd)
If graph changes are evolving rather slowly over time, it may be better
not to compare two consecutive graphs,
G
n
and
G
n
+1
, with each other,
but
G
n
and
G
n
+
l
,where
l>
1. Instead of
msa
, as proposed above, we
(
˜
use
l
is a parameter defined by the user and is dependent on the underlying
application.
d
G
n
,G
n
+1
) as a measure of change between
G
n
and
G
n
+
l
,where
6.4.
M
edian vs.
M
edian Graph,
D
istant in Time
(mmd)
This measure is a combination of the measures mma and msd. We use
˜
as defined for
mma
,andlet
˜
G
1
G
2
=median(
G
n
+
l
+1
,...,G
n
+
l
+
L
2
). Then
(
˜
˜
d
+1.
Obviously, Eqs. (6.1) and (6.2) can be adapted to
msd
and
mmd
similarly to
the way they are adapted to
mma
.
G
1
,
G
2
) can serve as a measure of change between time
n
and
n
+
l
7. Application to Computer Network Monitoring
7.1.
Problem Description
In managing large enterprise data networks, the ability to measure net-
work changes in order to detect abnormal trends is an important perfor-
mance monitoring function [36]. The early detection of abnormal network
events and trends can provide advance warning of possible fault conditions
