The thesis work intends to provide an architecture for discovery and monitoring of nodes in a network with improved performance and security. The proposed work addresses limitations identified within the scope of this thesis. The limitations are identified by analyzing some of the better existing monitoring tools in the market with the use of different protocols. The proposed work use different protocols depending on the situation of the problem that exists in a network. Analyze the existing network monitoring tools, by performing metrics and overcoming the limitations. We proposed a new architecture motivated from traditional network monitoring tools with subtle changes. Proposed architecture is also conceptually evaluated for its viability. / 0045-31272355, basasrinu@yahoo.co.in,ji_nav@yahoo.co.in

Rapporten beskriver arbetet och resultaten av en jämförelse mellan Sensu och op5 Monitor, vilka är verktyg som används för att övervaka enheter i nätverk, så kallade network monitoring systems. Arbetet har utförts för att utbudet av nätverksövervakningsverktyg ständigt växer och det ansågs värdefullt att jämföra en ny aktör med ett äldre verktyg som är byggd på ett annat tankesätt. Det som ansågs intressant att testa var hur dessa verktyg hanterade de rapporter som skapades och samlades in, om det slutgiltiga resultatet från detta skulle skilja sig åt eller inte. För att testa detta sattes en virtuell testmiljö upp, där Sensu och op5 Monitor rullade parallellt med varandra och övervakade samma system och använde sig utav samma plugin för övervakningen. Experimenten utfördes på två stycken tjänster, BIND9 samt Apache2, i och med att de två pluginen som användes var uppbyggda på olika sätt konstruerades även olika experiment. Under dessa experiment samlades information in om hur de två övervakningsverktygen hanterade de rapporter de fick in, vilket sedan sammanställdes och analyserades. Slutsatsen av det hela var att Sensu och op5 Monitor hanterar sina insamlade rapporter på ett likvärdigt sätt, de rapporterade resultaten blev i samtliga fall detsamma, således fungerade de två övervakningsverktygen på ett jämgott vis. / The report describes the work and results of a comparison between Sensu and op5 Monitor, which are both tools used to monitor devices in a network, more commonly known as network monitoring systems. The subject was chosen due to the fact that there is such a wide range of network monitoring systems, and it is constantly expanding. It was considered valuable to compare a newcomer with an older tool that is built with a different mindset. It was considered interesting to test how these tools handled the reports created and collected by them, to see if the final results from this would differ or not. To test this a virtual testing environment was built, where Sensu and op5 Monitor were run in parallel to each other and monitored the same systems and used the same set of plugins. The experiments were conducted on two services, BIND9 and Apache2, since the plugins were constructed in different ways, so were the various experiments. In these experiments information was gathered about how the two monitoring tools handled the reports they received, which was then compiled and analysed. The conclusion of it all was that Sensu and op5 Monitor handles the collected information in a similar manner. The reported results were in all cases the same, thus the two monitoring tools behave in the same fashion.

This diploma thesis is focused on network monitoring. The theoretical part describes using of detection and prevention systems, properties of these systems, their components and detection techniques. Next part of the thesis is focused on EndaceProbe analyzer and analytic application EndaceVision. Also web services, programming language WSDL and protocol SOAP are described. The practical part is focused on creating three laboratory exercises for network monitoring and for using EndaceProbe. Components of the exercises are the traffic generator IXIA and Cisco switches with the application of remote switched port analyzer. There are also used web services EndaceProbe, programming language WSDL and SOAP protocol.

Accelerated advancements in technology, the Internet of Things, and cloud computing have spurred an emergence of unstructured data that is contributing to rapid growth in data volumes. No human can manage to keep up with monitoring and analyzing these unbounded data streams and thus predictive and analytic tools are needed. By leveraging machine learning this data can be converted into insights which are enabling datadriven decisions that can drastically accelerate innovation, improve user experience, and drive operational efficiency. The purpose of this thesis is to design and implement a system for real-time outlier detection using unbounded data streams and machine learning. Traditionally, this is accomplished by using alarm-thresholds on important system metrics. Yet, a static threshold cannot account for changes in trends and seasonality, changes in the system, or an increased system load. Thus, the intention is to leverage machine learning to instead look for deviations in the behavior of the data not caused by natural changes but by malfunctions. The use-case driving the thesis forward is real-time outlier detection in a Content Delivery Network (CDN). The input data includes Http-error messages received by clients, and contextual information like region, cache domains, and error codes, to provide tailormade predictions accounting for the trends in the data. The outlier detection system consists of a data collection pipeline leveraging the technique of stream processing, a MiniBatchKMeans clustering model that provides online clustering of incoming data according to their similar characteristics, and an LSTM AutoEncoder that accounts for temporal nature of the data and detects outlier data points in the clusters. An important finding is that an outlier is defined as an abnormal amount of outlier data points all originating from the same cluster, not a single outlier data point. Thus, the alerting system will be implementing an outlier percentage threshold. The experimental results show that an outlier is detected within one minute from a cache break-down. This triggers an alert to the system owners, containing graphs of the clustered data to narrow down the search area of the cause to enable preventive action towards the prominent incident. Further results show that within 2 minutes from fixing the cause the system will provide feedback that the actions taken were successful. Considering the real-time requirements of the CDN environment, it is concluded that the short delay for detection is indeed real-time. Proving that machine learning is indeed able to detect outliers in unbounded data streams in a real-time manner. Further analysis shows that the system is more accurate during peakhours when more data is in circulation than during none peak-hours, despite the temporal LSTM layers. Presumably, an effect from the model needing to train on more data to better account for seasonality and trends. Future work necessary to put the outlier detection system in production thus includes more training to improve accuracy and correctness. Furthermore, one could consider implementing necessary functionality for a production environment and possibly adding enhancing features that can automatically avert incidents detected and handle the causes of them.

In this work, an open source-based solution for measuring the quality of video streams from an ISP has been developed. The goals with the work has been to see how much cheaper the open source solution is in comparison with the company’s already implemented commercial solution, if the data collected by the new solution is as reliable as the existing solution, and to see if the microcontroller that is used is powerful enough to replace the current one. The microcontroller used was a Raspberry Pi 4 model b. To see how much load the microcontroller could handle a stress test was conducted where the number of parallel video streams was increased until the resources on the device were maxed out. Measurement points in the unit that were checked during the stress test were CPU. The measurements showed that it was able to monitor 15 parallel currents before resources ran out. The open source-based solution cost SEK 1548 per unit while the cost for the commercial solution was SEK 10898kr per unit. The data collected by the open source solution proved to be as reliable as the commercial solution / I det här arbetet har en open source-baserad lösning för att mäta kvaliteten på videoströmmar hos en internetleverantör tagits fram. Målen med arbetet har varit att se hur mycket billigare open source-lösningen är i jämförelse med företagets redan implementerade kommersiella lösning, om den nya lösningens insamlade data är lika tillförlitlig somden befintliga lösningens, samt se om mikrocontrollern som används är kraftig nog att ersätta den nuvarande. Mikrocontrollern som användes var en Raspberry Pi 4 modell b. För att mäta hur mycket belastning den klarade utfördes ett stresstest där antalet parallella videoströmmar att monitorera ökades tills resurserna på enheten var belastade till max. Mätpunkter i enheten som kontrollerades under stresstestet var CPU. Mätningarna visade att den klarade av att monitorera 15 parallella strömmar innan resurserna tog slut. Den open source-baserade lösningen kostade 1548 kronor per enhet medans den implementerade kostade 10898kr. Datan som samlades in av open source-lösningen visade sig vara lika tillförlitlig som den kommersiella lösningen.

Företaget är en tjänsteleverantör av olika tjänster, bl.a. IPTV. De använder sig idag av en kostsam lösning för att monitorera och analysera IPTV-strömmar och ser sig därför efter en mer kostnadseffektiv lösning. Målet med detta examensarbete har varit att svara på om det finns ett tillförlitligt open source-verktyg för detta, om en mikrokontroller kan ersätta deras befintliga hårdvara med avseende för IPTV-monitorering och vad skillnaden i kostnad kan vara. För att kunna besvara dessa frågor har metoder använts för att upprätta en kravställning på vad ett potentiellt verktyg ska kunna mäta, hur mycket det får kosta, samt att utföra stresstest på den utvalda hårdvaran, vilket var en Raspberry Pi 4 Modell B. Allt detta skedde i en uppsatt testmiljö som företaget bistod med. Det resulterade i en produkt som uppfyller de krav som företaget ställde och mätvärdena presenterades övergripande och tydligt i ett webbgränssnitt. Då tester av den framtagna lösningen och den befintliga lösningen inte utfördes i samma testmiljö så kan inte frågorna om open source-verktygets tillförlitlighet och om mikrokontrollerns förmåga inte besvaras på ett tillfredsställande sätt. Jämförelse mellan kostnaderna visar att den framtagna lösningen är mycket billigare då det är en engångskostnad i jämförelse med befintlig lösning som är en årskostnad. Vad som bör beaktas vid eventuell implementering av framtagen lösning är säkerhet, fortsätta studera verktyget och beräkna indirekta kostnader som utbildning, implementering och personalkostnad. / The company is a service provider of various services, including IPTV. Today they use a costly solution for monitoring and analyzing IPTV streams and is therefore looking for a cheaper solution. The goal with this thesis has been to answer if there is a reliable open source tool for monitoring and analyzing IPTV-streams, if a microcontroller can replace the existing hardware for IPTV monitoring and how much the difference in cost can be. To be able to answer these questions methods have been used to establish a set of requirements on what a potential tool should be able to measure, how much it may cost, and to perform stress test on selected hardware which was a Raspberry Pi 4 Model B. All this took place in a test environment which the company provided. This resulted in a product that is able to measure the measurements that the company had as a requirement. The measurement values are presented in a overall and clear way in a web interface. The tests of the developed solution and the existing solution was not performed in the same test environment so the questions of open source tool reliability and microcontroller ability is not answered satisfactorily. Comparison between the costs show that the solution developed is much cheaper because it is a one-time cost compared to existing solution that is an annual cost. What should be considered in any implementation of developed solution is security, continue to study the open source tool and calculate indirect costs such as training, implementation and staff costs.

This work has been done as an assignment from CGI with the ambition to find an opensource program that provides both network monitoring and performance testing. Theprogram should be able to run on a portable server or other machine, to allow for datagathering of one network one day and of another network the next day. Due to the currentstate of society all work is done *remotely*, restricting tests to only be performed onsmaller private networks. Much time is put into research to find the programs that intheory would work for the purpose. It's quickly revealed that with open source as ademand, a single program is not an option, thus the search is expanded. Tests areperformed where the programs are graded by useability and functions that facilitateredeployment of the server between network sites. The results for network monitoring arethe programs OpenNMS Horizon and NetXMS, which both lived up to the demands. Theprogram chosen for performance testing is Flent, which among others combines Iperf andNetperf in its tests and presents the results in graphs.The limited time affected ouropportunities to test all the programs we came across and the current pandemic limitedour opportunities to test our chosen programs to a greater extent.The goal of finding onesolution was not accomplished and instead resulted in two separate pieces of software.These are found to accomplish their respective goals.

L'objectif de cette thèse est de trouver des techniques de détection et de localisation des anomalies au niveau des liens qui soient à faible coût, précises et rapides. La plupart des techniques de détection et de localisation des anomalies au niveau des liens qui existent dans la littérature calculent les solutions, c-à-d l'ensemble des chemins à monitorer et les emplacements des dispositifs de monitorage, en deux étapes. La première étape sélectionne un ensemble minimal d'emplacements des dispositifs de monitorage qui permet de détecter/localiser toutes les anomalies possibles. La deuxième étape sélectionne un ensemble minimal de chemins de monitorage entre les emplacements sélectionnés de telle sorte que tous les liens du réseau soient couverts/distinguables paire par paire. Toutefois, ces techniques ignorent l'interaction entre les objectifs d'optimisation contradictoires des deux étapes, ce qui entraîne une utilisation sous-optimale des ressources du réseau et des mesures de monitorage biaisées. L'un des objectifs de cette thèse est d'évaluer et de réduire cette interaction. A cette fin, nous proposons des techniques de détection et de localisation d'anomalies au niveau des liens qui sélectionnent les emplacements des moniteurs et les chemins qui doivent être monitorés conjointement en une seule étape. Par ailleurs, nous démontrons que la condition établie pour la localisation des anomalies est suffisante mais pas nécessaire. Une condition nécessaire et suffisante qui minimise le coût de localisation considérablement est établie. Il est démontré que les deux problèmes sont NP-durs. Des algorithmes heuristiques scalables et efficaces sont alors proposés. / The aim of this thesis is to come up with cost-efficient, accurate and fast schemes for link-level network anomaly detection and localization. It has been established that for detecting all potential link-level anomalies, a set of paths that cover all links of the network must be monitored, whereas for localizing all potential link-level anomalies, a set of paths that can distinguish between all links of the network pairwise must be monitored. Either end-node of each path monitored must be equipped with a monitoring device. Most existing link-level anomaly detection and localization schemes are two-step. The first step selects a minimal set of monitor locations that can detect/localize any link-level anomaly. The second step selects a minimal set of monitoring paths between the selected monitor locations such that all links of the network are covered/distinguishable pairwise. However, such stepwise schemes do not consider the interplay between the conflicting optimization objectives of the two steps, which results in suboptimal consumption of the network resources and biased monitoring measurements. One of the objectives of this thesis is to evaluate and reduce this interplay. To this end, one-step anomaly detection and localization schemes that select monitor locations and paths that are to be monitored jointly are proposed. Furthermore, we demonstrate that the already established condition for anomaly localization is sufficient but not necessary. A necessary and sufficient condition that minimizes the localization cost drastically is established. The problems are demonstrated to be NP-Hard. Scalable and near-optimal heuristic algorithms are proposed.

Submitted by SBI Biblioteca Digital (sbi.bibliotecadigital@puc-campinas.edu.br) on 2017-08-07T13:35:29Z No. of bitstreams: 1 ?RIKA CAPELLI DE PAULA.pdf: 5259838 bytes, checksum: 1d9b6fe276253a112ebacd6f7e2f3725 (MD5) / Made available in DSpace on 2017-08-07T13:35:29Z (GMT). No. of bitstreams: 1 ?RIKA CAPELLI DE PAULA.pdf: 5259838 bytes, checksum: 1d9b6fe276253a112ebacd6f7e2f3725 (MD5) Previous issue date: 2017-06-30 / Pontif?cia Universidade Cat?lica de Campinas ? PUC Campinas / The necessity to monitor the greatness related to the comfort of internal environments of buildings, aiming to provide well-being to its occupants, made one think of a solution using Wireless Sensor Network (WSN). This research project proposes the construction of a WSN, with the elements Base, Sensor Node and Repeater, and methods, of verification and distribution of these elements, that aim at the monitoring of greatness related to the comfort of indoor environments, in an urban context. For proof of concept of what was proposed and verification of the behavior of the network, measurements of Temperature, Relative Humidity (RH) and Signal Strength Indication (RSSI) were collected, the latter being the focus of analysis at work, the Which allowed the adaptation of the WSN to allow the distance between the Base and the environment monitored by the Sensor Nodes. The tests were divided into two parts, the first one to validate the components, sectoral antenna Antenna and SHT75 sensor, and the second one to collect measurements, in the internal environment of a library. Through the tests, it was verified, through the observation of the signal intensity behavior, the operation of the WSN and the fulfillment of the proposal. / A necessidade do monitoramento de grandezas relacionadas ao conforto de ambientes internos de edifica??es, visando proporcionar bem-estar a seus ocupantes, fez com que se pensasse em uma solu??o utilizando Rede de Sensores Sem Fio (RSSF). Este projeto de pesquisa prop?e a constru??o de uma RSSF, com os elementos Base, N? sensor e Repetidor, e metodologia, de verifica??o e distribui??o desses elementos, que visam o monitoramento de grandezas relacionadas ao conforto de ambientes indoor, em um contexto urbano. Para prova de conceito do que foi proposto e verifica??o do comportamento da rede, foram coletadas medidas de temperatura, Umidade Relativa (UR) e intensidade do sinal (RSSI - Received Signal Strength Indication), sendo a ?ltima o foco de an?lise no trabalho, o que permitiu a adequa??o da RSSF para possibilitar o distanciamento entre a Base e o ambiente monitorado pelos N?s sensores. Os ensaios foram divididos em duas partes, a primeira para valida??o dos componentes, antena Path setorial e sensor SHT75, e a segunda para coleta de medidas, no ambiente interno de uma biblioteca. Atrav?s dos ensaios realizados, foi comprovado, atrav?s da observa??o do comportamento da intensidade do sinal, o funcionamento da RSSF e o atendimento da proposta.

Introduits au début des années 1990, les systèmes immunitaires artificiels visent à adapter les propriétés du système immunitaire biologique, telles que sa scalabilité et son adaptivité, à des problèmes informatiques : sécurité, mais également optimisation et classification. Cette thèse explore une nouvelle direction en se concentrant non sur les processus biologiques et les cellules elles-mêmes, mais sur les interactions entre les sous-systèmes. Ces modes d’interaction engendrent les propriétés reconnues du système immunitaire : détection d’anomalies, reconnaissance des pathogènes connus, réaction rapide après une exposition secondaire et tolérance à des organismes symbiotiques étrangers. Un ensemble de systèmes en interaction formant un écosystème, cette nouvelle approche porte le nom d’Écosystème Immunitaire Artificiel. Ce modèle est mis à l’épreuve dans un contexte particulièrement sensible à la scalabilité et à la performance : la supervision de réseaux, qui nécessite l’analyse de séries temporelles en temps réel avec un expert dans la boucle, c’est-à-dire en utilisant un apprentissage actif plutôt que supervisé. / Since the early 1990s, immune-inspired algorithms have tried to adapt the properties of the biological immune system to various computer science problems, not only in computer security but also in optimization and classification. This work explores a different direction for artificial immune systems, focussing on the interaction between subsystems rather than the biological processes involved in each one. These patterns of interaction in turn create the properties expected from immune systems, namely their ability to detect anomalies, memorize their signature to react quickly upon secondary exposure, and remain tolerant to symbiotic foreign organisms such as the intestinal fauna. We refer to a set of interacting systems as an ecosystem, thus this new approach has called the Artificial Immune Ecosystem. We demonstrate this model in the context of a real-world problem where scalability and performance are essential: network monitoring. This entails time series analysis in real time with an expert in the loop, i.e. active learning instead of supervised learning.