We present and evaluate the performance of our Network Link Outlier Factor (NLOF) for detecting transmission channel faults in communication networks. An NLOF is computed for each transmission channel in a network under management using the throughput values derived from ow data. Throughput values of flows are clustered in two stages, outlier values are determined within each of the clusters, and then ow outlier ratios determine the outlier score for each transmission channel (link). Specifically, we first cluster the throughput of flows into the set of clusters we believe will naturally exist in a network and then identify the outliers within those throughput clusters. Our technique to detect network transmission channel faults consists of: 1) ow throughput clustering, 2) ow throughput outlier detection using an outlier score, 3) tracing flows on the network topology using routing information, and 4) network link outlier score computation from ow outlier scores.
We present and evaluate the idea of auto-generating training data for network application classification using a rule-based expert system on two-dimensions of the feature space. That training data is then used to learn classification of network applications using other dimensions of the feature space. The rule-based expert system uses transport layer port number conventions (source port, destination port) from the Internet Assigned Numbers Authority (IANA) to classify applications to create the labeled training data. A classifier can then be trained on other network ow features using this auto-generated training data. We evaluate this approach to network application classification and report our findings. We explore the use of the following classifiers: K-nearest neighbors, decision trees, and random forests. Lastly, our approach uses data solely at the ow-level (in NetFlow v5 records) thereby limiting the volume of data that must be collected and/or stored.