Multi-criteria analysis and prediction of network incidents using monitoring system

Abstract

Today, network technologies can handle throughputs up to 100Gbps, transporting 200 million packets per second on a single link. Such high bandwidths impact network flow analysis and as a result require significantly more powerful hardware. Methods used today concentrate mainly on analyzes of data flows and patterns. It is nearly impossible to actively look for anomalies in network packets and flows for a small amount of change of monitoring patterns could result in big increases in potentially false positive incidents. This paper focuses on multi-criteria analyzes of systems generated data in order to predict incidents. We prove that systems generated monitoring data are an appropriate source to analyze and enable for much more focused and less computationally intensive monitoring operations. By using appropriate mathematical methods to analyze stored data it is possible to obtain useful information. During our work, some interesting anomalies in networks were found by utilizing simple data correlations using monitoring system Zabbix. We concluded that it is possible to declare that deeper analysis is possible due to Zabbix monitoring system and its features like Open-Source core, documented API and SQL backend for data. The result of this work is a new approach to the analysis containing algorithms which allow to identify significant items in monitoring system.