Categorization for network fault diagnosis

Abstract

A new method of LAN fault diagnosis is described based on host behavior categorization. Monitored network traffic is used to represent a host's behavior as a point in a high-dimensional parameter space. A number of these points (one for each host) is categorized by an inductive Bayesian classifier and the resulting categorization is used to predict future network host behavior. If a host's subsequent behavior is not consistent with its expected class, the host is flagged anomalous and becomes a focus of further diagnosis. The system has been tested on approximately a network-year of data and has successfully diagnosed all known faults in this data due to programmer error and has even pointed out several that had previously gone undetected. Ways to improve the system's performance with complementary diagnostic techniques are introduced.<>