Database Reference
In-Depth Information
[37], or at least assist with identifying the causes and locations of known
problems.
Network performance monitoring typically uses statistical techniques to
analyse variations in trac distribution [38,39], or changes in topology [40].
Visualisation techniques are also widely used to monitor changes in network
performance [41]. To complement these approaches, specific measures of
change at the network level in both logical connectivity and trac variations
are useful in highlighting when and where abnormal events may occur in
the network [42]. Using these measures, other network management tools
may then be focused on problem regions of the network for more detailed
analysis.
In the previous sections, various graph similarity measures are intro-
duced. The aim of the study described in the present section is to identify
whether using these techniques, significant changes in logical connectivity
or trac distributions can be observed between large groups of users com-
municating over a wide area data network. This data network interconnects
some 120,000 users around Australia. For the purposes of this study, a net-
work management probe was attached to a physical link on the wide area
network backbone and collected trac statistics of all data trac operating
over the link. From this information a logical network of users communi-
cating over the physical link is constructed.
Communications between user groups (business domains) within the
logical network over any one day is represented as a directed graph. Edge
direction indicates the direction of trac transmitted between two adjacent
nodes (business domains) in the network, with edge-weight indicating the
amount of trac carried. A subsequent graph can then describe communi-
cations within the same network for the following day. This second graph
can then be compared with the original graph, using a measure of graph
distance between the two graphs, to indicate the degree of change occur-
ring in the logical network. The more dissimilar the graphs, the greater the
graph distance value. By continuing network observations over subsequent
days, the graph distance scores provide a trend of the logical network's
relative dynamic behaviour as it evolves over time.
In the study described in this section, log files were collected continu-
ously over the period 9 July 1999 to 24 December 1999. Weekends, pub-
lic holidays and days where probe data was unavailable were removed to
produce a final set of 102 log files representing the successive business
days' trac. The graph distance measures examined in this paper pro-
duce a distance score indicating the dissimilarity between two given graphs.
