Troubleshooting for Network Operators

Van Van Tong is a lecturer at the School of Information and Communication Technology at Hanoi University of Science and Technology, Vietnam. His research interests include blockchain, cyber security, SDN and network troubleshooting.Sami Souihi, HDR, is an Associate Professor in Computer Science in the N&T Department of Paris-Est Créteil University (UPEC), France, and is part of the LiSSiTincNET research team. His research focuses on adaptive mechanisms in large-scale dynamic systems, among others.Hai-Anh Tran is lecturer researcher and Vice-Dean in the Faculty of Computer Engineering, SoICT at HUST, Vietnam. His research interests include computer networks, distributed systems, network security, QoS, QoE and IoT, ranging from the theory of design to implementation.Abdelhamid Mellouk is a full-time Professor, the Director of the IT4H High School Engineering Department, UPEC, and Head of the TincNET research team in France. He is also the founder of Network Control Research and Curricula activities at UPEC, the current Co President of the French Deep Tech Data Science and Artificial Intelligence Systematic Hub, member of the High Scientific Research and Technology National Council and President of policies and programs commission, IEEE ComSoc CSR TC Award Chair.

• Preface ixIntroduction xiChapter 1 State of the Art on Network Troubleshooting 11.1 Network troubleshooting 11.1.1 State of the art 21.1.2 Traditional troubleshooting architecture 91.2 Background on encryption protocols 101.2.1 QUIC 111.2.2 Other protocols 161.3 Drawbacks of troubleshooting with encrypted traffic 181.3.1 Network performance monitoring 181.3.2 Intrusion detection system 201.4 Conclusion 22Chapter 2 Novel Global Troubleshooting Framework for Encrypted Traffic 252.1 Novel network troubleshooting architecture for encrypted traffic 252.2 Proof of concept of novel troubleshooting architecture in SDN 282.3 Data collection 322.3.1 Data classification 322.3.2 Monitoring tools 342.3.3 Parameter measurement 372.4 Troubleshooting dataset 402.4.1 Datasets for root cause analysis 402.4.2 Dataset for traffic classification 422.5 Conclusion 43Chapter 3 Traffic Classification: Novel QUIC Traffic Classifier Based on Convolutional Neural Network 453.1 Introduction 453.2 Background 483.2.1 Convolutional network 483.2.2 Characteristics of QUIC-based applications 493.3 Traffic classification approaches 503.3.1 Port-based approaches 503.3.2 Payload-based approaches 513.3.3 Statistic-based approaches 513.3.4 DL-based approaches 523.4 Novel traffic classification method for QUIC traffic 533.4.1 Traffic collection 553.4.2 Flow-based features 553.4.3 Preprocessing 563.4.4 Novel traffic classification method 563.5 Experimental results 593.5.1 Dataset specification 593.5.2 Performance metrics 603.5.3 Performance analysis 613.6 Conclusion 65Chapter 4 Anomaly Detection 674.1 Introduction 674.2 Anomaly detection approaches 684.2.1 Knowledge-based mechanisms 684.2.2 Rule inductions 694.2.3 Information theory 704.2.4 ML-based mechanisms 704.3 Anomaly detection approach using machine learning 714.3.1 ML-based anomaly detection method 724.3.2 Data collection and processing 744.4 Experimental results 754.4.1 Experimental setup 754.4.2 Performance analysis 764.5 Conclusion 79Chapter 5 Temporary Remediation: SDN-based Application-aware Segment Routing for Large-scale Networks 815.1 Introduction 815.2 Application-aware routing mechanisms 845.2.1 Application-aware routing 845.2.2 Application-aware MPLS 865.2.3 Application-aware SR 865.3 Adaptive segment routing mechanism for encrypted traffic 875.3.1 Overview of the SDN-based adaptive segment routing framework 875.3.2 Network monitoring 895.3.3 Anomaly detection 905.3.4 Application-aware remediation 915.4 Experimental results 955.4.1 Experiment setup 955.4.2 Benchmark 975.4.3 Performance analysis 975.5 Conclusion 104Chapter 6 Root Cause Analysis and Definitive Remediation 1076.1 Root cause analysis: machine learning based root cause analysis for SDN network 1076.1.1 Introduction 1076.1.2 Root cause analysis mechanisms 1096.1.3 ML-based RCA mechanism 1116.1.4 Experimental results 1146.1.5 Conclusion 1196.2 Definitive remediation: adaptive QUIC BBR algorithm using reinforcement learning for dynamic networks 1216.2.1 Introduction 1216.2.2 Congestion control mechanisms 1236.2.3 Adaptive BBR algorithm 1266.2.4 Experimental results 1286.2.5 Conclusion 133Conclusions and Prospects 135References 141Index 159