Network management

About: Network management is a research topic. Over the lifetime, 17859 publications have been published within this topic receiving 234520 citations. The topic is also known as: computer network management & NM.

On the Difference between Information Models and Data Models

Abstract: There has been ongoing confusion about the differences between Information Models and Data Models for defining managed objects in network management. This document explains the differences between these terms by analyzing how existing network management model specifications (from the IETF and other bodies such as the International Telecommunication Union (ITU) or the Distributed Management Task Force (DMTF)) fit into the universe of Information Models and Data Models.

Role classification of hosts within enterprise networks based on connection patterns

Abstract: Role classification involves grouping hosts into related roles. It exposes the logical structure of a network, simplifies network management tasks such as policy checking and network segmentation, and can be used to improve the accuracy of network monitoring and analysis algorithms such as intrusion detection. This paper defines the role classification problem and introduces two practical algorithms that group hosts based on observed connection patterns while dealing with changes in these patterns over time. The algorithms have been implemented in a commercial network monitoring and analysis product for enterprise networks. Results from grouping two enterprise networks show that the number of groups identified by our algorithms can be two orders of magnitude smaller than the number of hosts and that the way our algorithms group hosts highly reflect the logical structure of the networks.

ANM: Automated network management system

Abstract: A description is given of the automated network management (ANM) system, which assists the network operator and analyst in understanding and controlling complex internets. The ANM system provides an integrated set of tools for real-time monitoring, control, and analysis of internets consisting of diverse network entities such as internet gateways, packet-switching nodes, packet radio systems and hosts. It can reduce maintenance costs by providing capabilities such as fault isolation and alarm generation, so that the network operators can efficiently and effectively monitor and control networks. ANM also provides advanced data gathering, analysis, and presentation tools that enable the network analyst to understand better the behaviour of the network, and to enhance network performance. >

Design and Implementation of an Anomaly Detection System: an Empirical Approach

Abstract: Network management platforms provide flexible facilities for setting up custom applications able to detect network anomalies on a specific environment. This is because each network is made of users, services and computers with a specific behaviour that is then reflected in the generated network traffic. Goal of this paper is to show that in every network there are some global variables that can be profitably used for detecting network anomalies, regardless of the type of network users and equipment. As most of the relations among these variables are fixed, this paper shows that it is possible to define generic network rules aimed to automatically detect selected network anomalies. Finally, it covers the design and implementation of an open-source application used to effectively validate this work on a large campus network. 1 Background and Motivation This paper focuses on network-based intrusion detection and it explores a different approach to the problem. Intrusion detection techniques can be categorised into signature detection and anomaly detection [1][2]. Signature detection systems use patterns of well-known attacks or weak spots of the system to match and identify known intrusions. They perform a pattern matching between network traffic captured and attack signature. If the matching succeds, then the system generates an alarm. The main advantage of signature detection paradigm is that it can accurately and efficiently detect instances of known attacks. The main disadvantage is that it lacks the ability to detect the newly