A general approach to the construction of advanced monitoring systems for distributed information and telecommunications networks
Task statement: based on a review of existing technologies and existing monitoring systems for public information and telecommunications networks, as well as an analysis of the scientific and methodological apparatus for evaluating the time series of observed metrics, to develop general requirements and approaches to building promising network monitoring systems and to develop a methodology for predicting (preventive identification) of abnormal situations based on the results of monitoring the functional state of network elements. The purpose of the work: to develop a general approach to the formation of methods for predicting the state of connections on a public information and telecommunications network, as well as its network devices. Methods used: methods of multidimensional data analysis; methods of cluster analysis; topological methods of time series analysis; methods of behavioral analytics; symbolic representation of time series; network monitoring technologies Site/System Reliability Engineering, as a set of engineering practices that support reliable and trouble-free operation of applications in the present and future; Operation Support Systems, as a technology for supporting operations; methods of system analysis, structural synthesis, forecast theory, diagnostic theory, classification theory. The novelty of the work: to increase the stability and reliability of a controlled heterogeneous information and telecommunications network, the key architectural principle of designing its monitoring subsystem is the principle of distribution and decentralization. Preventive identification of abnormal states of network elements (in the form of devices, channels, paths and routes) is proposed to be carried out by identifying "forbidden" code combinations when observing time series, which are processed by symbolic dynamics methods borrowed from bioinformatics, previously used in the analysis of complex nucleotide genomic sequences, as well as by introducing a special monitoring mode, when, when identifying a pre-failure technical condition, the accuracy of the survey by the monitoring server of the network element is significantly increased in order to timely take preventive control actions on the network infrastructure and prevent the failure of the network element or the occurrence of an accident on the network. A method for classifying the state of network elements is proposed, consisting of a stage of training a classifier based on an EM algorithm, as well as a stage of directly classifying the type of technical condition. Result: the paper proposes a generalized architecture for building promising network monitoring systems, as well as a general subject-object model of it in the form of "entity-connection". The functions of the network monitoring subsystem and the monitoring server as its key element are defined. A variant of the monitoring server structure is considered. The assigned monitoring objects are defined, as well as a list of metric data collected from them from the point of view of the functional performance of the network. The method of symbolic representation of time series is chosen, on the basis of which the entropy of code words describing the time series of the observed metric of a functioning network element is estimated, and an algorithm for identifying its anomalous state on a time series of parameters is developed, consisting of four stages: the preliminary stage, the stage of encoding time series, the stage of identifying the type of technical condition of the network element and the final stage. Practical significance: A general approach to the construction of an algorithm for the functioning of promising network monitoring systems has been developed.