| Preface | p. vii |
| Introduction | |
| Intranets and Network Management | p. 3 |
| Introduction | p. 3 |
| Enterprise Intranets | p. 4 |
| Network Management | p. 7 |
| Network Management System | p. 9 |
| Network Management in TCP/IP Networks | p. 11 |
| Simple Network Management Protocol (SNMP) | p. 12 |
| Remote Network Monitoring (RMON) Protocol | p. 14 |
| Network Monitoring | p. 16 |
| Active and Passive Monitoring | p. 17 |
| Common Monitoring Solutions for Intranets | p. 18 |
| Alternative Methods for Network Monitoring | p. 19 |
| Sampling Interval and Polling Rate | p. 20 |
| Minimizing Collection Infrastructure and Reducing Data Volume | p. 21 |
| Synthesis of Improved Network Measures | p. 21 |
| Network Anomaly Detection and Network Anomalies | p. 22 |
| Anomaly Detection Methods | p. 23 |
| Network-Wide Approach to Anomaly Detection | p. 25 |
| Examples of Network Anomalies | p. 26 |
| Summary | p. 28 |
| Graph-Theoretic Concepts | p. 31 |
| Introduction | p. 31 |
| Basic Ideas | p. 32 |
| Connectivity, Walks, and Paths | p. 34 |
| Trees | p. 37 |
| Factors, or Spanning Subgraphs | p. 38 |
| Directed Graphs | p. 38 |
| Event Detection Using Graph Distance | |
| Matching Graphs with Unique Node Labels | p. 43 |
| Introduction | p. 43 |
| Basic Concepts and Notation | p. 44 |
| Graphs with Unique Node Labels | p. 45 |
| Experimental Results | p. 51 |
| Synthetic Network Data | p. 52 |
| Real Network Data | p. 53 |
| Verification of O(n[superscript 2]) Theoretical Computational Complexity for Isomorphism, Subgraph Isomorphism, MCS, and GEO | p. 53 |
| Comparison of Computational Times for Real and Synthetic Data Sets | p. 57 |
| Verification of Theoretical Computational Times for Median Graph | p. 59 |
| Conclusions | p. 59 |
| Graph Similarity Measures for Abnormal Change Detection | p. 63 |
| Introduction | p. 63 |
| Representing the Communications Network as a Graph | p. 64 |
| Graph Topology-Based Distance Measures | p. 65 |
| Using Maximum Common Subgraph | p. 65 |
| Using Graph Edit Distance | p. 67 |
| Traffic-Based Distance Measures | p. 70 |
| Differences in Edge-Weight Values | p. 70 |
| Analysis of Graph Spectra | p. 72 |
| Measures Using Graph Structure | p. 73 |
| Graphs Denoting 2-hop Distance | p. 75 |
| Identifying Regions of Change | p. 75 |
| Symmetric Difference | p. 76 |
| Vertex Neighborhoods | p. 77 |
| Conclusions | p. 78 |
| Median Graphs for Abnormal Change Detection | p. 79 |
| Introduction | p. 79 |
| Median Graph for the Generalized Graph Distance Measure d[subscript 2] | p. 80 |
| Median Graphs and Abnonnal Change Detection in Data Networks | p. 82 |
| Median vs. Single Graph, Adjacent in Time (msa) | p. 83 |
| Median vs. Median Graph, Adjacent in Time (mma) | p. 84 |
| Median vs. Single Graph, Distant in Time (msd) | p. 84 |
| Median vs. Median Graph, Distant in Time (mmd) | p. 84 |
| Experimental Results | p. 84 |
| Edit Distance and Single Graph vs. Single Graph Adjacent in Time (ssa) | p. 85 |
| Edit Distance and Median Graph vs. Single Graph Adjacent in Time (msa) | p. 86 |
| Edit Distance and Median Graph vs. Median Graph Adjacent in Time (mma) | p. 87 |
| Edit Distance and Median Graph vs. Single Graph Distant in Time (msd) | p. 89 |
| Edit Distance and Median Graph vs. Median Graph Distant in Time (mmd) | p. 89 |
| Conclusions | p. 90 |
| Graph Clustering for Abnormal Change Detection | p. 93 |
| Introduction | p. 93 |
| Clustering Algorithms | p. 94 |
| Hierarchical Clustering | p. 94 |
| Nonhierarchical Clustering | p. 97 |
| Cluster Validation | p. 100 |
| Fuzzy Clustering | p. 104 |
| Clustering in the Graph Domain | p. 105 |
| Clustering Time Series of Graphs | p. 112 |
| Conclusion | p. 114 |
| Graph Distance Measures based on Intragraph Clustering and Cluster Distance | p. 115 |
| Introduction | p. 115 |
| Basic Teiminology and Intragraph Clustering | p. 116 |
| Distance of Clusterings | p. 118 |
| Rand Index | p. 118 |
| Mutuai Information | p. 119 |
| Bipartite Graph Matching | p. 122 |
| Novel Graph Distance Measures | p. 123 |
| Applications to Computer Network Monitoring | p. 128 |
| Conclusion | p. 130 |
| Matching Sequences of Graphs | p. 131 |
| Introduction | p. 131 |
| Matching Sequences of Symbols | p. 131 |
| Preliminaries | p. 131 |
| Edit Distance of Sequences of Symbols | p. 132 |
| Graph Sequence Matching | p. 137 |
| Applications in Network Behavior Analysis | p. 139 |
| Anomalous Event Detection Using a Library of Past Time Series | p. 139 |
| Prediction of Anomalous Events | p. 141 |
| Recovery of Incomplete Network Knowledge | p. 141 |
| Conclusions | p. 142 |
| Propertaes of the Underlying Graphs | |
| Distances, Clustering, and Small Worlds | p. 147 |
| Graph Functions | p. 147 |
| Distance | p. 147 |
| Longest Distances | p. 147 |
| Average Distances | p. 148 |
| Characteristic Path Length | p. 148 |
| Clustering Coefficient | p. 149 |
| Directed Graphs | p. 149 |
| Diameters | p. 149 |
| A Pseudometric | p. 150 |
| Sensitivity Analysis | p. 151 |
| An Example Network | p. 153 |
| Time Series Using f | p. 154 |
| Time Series Using D | p. 155 |
| Characteristic Path Lengths, Clustering Coefficients, and Small Worlds | p. 156 |
| Two Classes of Graphs | p. 156 |
| Small-World Graphs | p. 158 |
| Enterprise Graphs and Small Worlds | p. 159 |
| Sampling Traffic | p. 159 |
| Results on Enterprise Graphs | p. 160 |
| Discovering Anomalous Behavior | p. 162 |
| Tournament Scoring | p. 165 |
| Introduction | p. 165 |
| Tournaments | p. 165 |
| Definitions | p. 165 |
| Tournament Matrices | p. 166 |
| Ranking Tournaments | p. 166 |
| The Ranking Problem | p. 166 |
| Kendall-Wei Ranking | p. 167 |
| The Perron-Frobenius Theorem | p. 168 |
| Application to Networks | p. 168 |
| Matrix of a Network | p. 168 |
| Modality Distance | p. 169 |
| Defining the Measure | p. 169 |
| Applying the Distance Measure | p. 170 |
| Variations in the Weight Function | p. 172 |
| Conclusion | p. 172 |
| Prediction and Advanced Distance Measures | |
| Recovery of Missing Information in Graph Sequences | p. 177 |
| Introduction | p. 177 |
| Recovery of Missing Information in Computer Networks Using Context in Time | p. 177 |
| Basic Concepts and Notation | p. 178 |
| Recovery of Missing Information Using a Voting Procedure | p. 180 |
| Recovery of Missing Information Using Reference Patterns | p. 182 |
| Recovery of Missing Information Using Linear Prediction | p. 187 |
| Recovery of Missing Information Using a Machine Learning Approach | p. 189 |
| Decision Tree Classifiers | p. 189 |
| Missing Information Recovery by Means of Decision Tree Classifiers: A Basic Scheme | p. 194 |
| Possible Extensions of the Basic Scheme | p. 196 |
| Conclusions | p. 197 |
| Matching Hierarchical Graphs | p. 199 |
| Introduction | p. 199 |
| Hierarchical Graph Abstraction | p. 200 |
| Distance Measures for Hierarchical Graph Abstraction | p. 201 |
| Application to Computer Network Monitoring | p. 206 |
| Experimental Results | p. 207 |
| Conclusions | p. 210 |
| References | p. 211 |
| Index | p. 221 |
| Table of Contents provided by Ingram. All Rights Reserved. |