Anomaly Characterization Problems

National audienceThe context of this work is the online characterization of anomalies in large scale systems. In particular, we address the following question: Given two successive configurations of the system, can we distinguish massive anomalies from isolated ones, the former ones impacting a large number of nodes while the second ones affect solely a small number of them, or even a single one? The rationale of this question is twofold. First, from a theoretical point of view, we characterize anomalies with respect to their neighborhood, and we show that there are anomaly scenarios for which isolated and massive anomalies are indistinguishable from an omniscient observer point of view. We then relax this problem by introducing unresolved configurations, and exhibit necessary and sufficient conditions that allow any node to determine the type of anomaly it has been impacted by. This condition only depends on the close neighborhood of each node and thus is locally computable. From a practical point of view, distinguishing isolated anomalies from massive ones is of utmost importance for networks providers. For instance, Internet service providers (ISPs) would be interested to deploy procedures that allow gateways to self distinguish whether their dysfunction is caused by network-level anomalies or by their own hardware or software, and to notify the ISP only in the latter case. \keywords{Network monitoring, anomaly detection, diagnosis