Early detection of network problems using existing network indicators : local agent based approach

• Main Author: Hajdarevic, Kemal
• Published: Leeds Beckett University 2008
• Subjects: 004.65
• Online Access: http://ethos.bl.uk/OrderDetails.do?uin=uk.bl.ethos.446160

Everyday business operation depends on reliable computer and network infrastructure. There are different threats that can cause serious problems to the operation of system resources, such as intrusion, denial of service attacks and performance loss situations. Every day the media reveal incidents that cause major losses of money and reputation in organizations and companies affected by these events. Detecting problems such as performance loss and attacks in their early development stages would save money for the owners of systems. If early stages of unwanted events can be identified in time, it should be possible to proactively (before they are affected) protect managed systems against incidents and failures. To be able to detect and stop attacks or performance loss, accurate mechanisms are needed to perform these actions in time and the approach described in this thesis takes timing into consideration as one of the most important elements in problem resolution. Another important element for proactive problem resolution is data, which have to be easily accessible and available so that the time spent in collection and processing is less than the time needed for the problem to escalate. In this thesis a set of data which can be found in management information base (MIB) is used for problem resolution. The MIB data set contains relevant data which can be used for resolution of different problems. Local agents can be used to speed up the process of detection and proactive prevention of problematic situations since all tasks are performed locally. This thesis presents different experimental scenarios from already seen incidents such as attacks and performance loss situations. It also proposes a system for proactive problem resolution by using already available hardware components, thus avoiding the need to invest in the additional hardware required by many other proposed solutions. Additional hardware usually adds complexity to an already complex infrastructure, and this can be avoided by using the approach described in this thesis.