Telemetry-Driven Network Operations: Architectures for Analytics and Automated Remediation
DOI:
https://doi.org/10.15680/IJCTECE.2024.0702010Keywords:
Network Telemetry, Streaming Analytics, Automated Remediation, Observability, Event Processing, Network OperationsAbstract
The network operation of telemetry is transforming conventional monitoring to diagnostic machine-aided, continuously, and automated remediation. The success of such operations, however, relies on an architecture that can handle heterogeneous telemetry at the correct time and space scales and whose operation is controlled in terms of collection, processing, storage, and operational costs. A telemetry-based network operations architecture presented in this study provides source-aware telemetry collection, event time standardization, topology-aware correlation, multilevel stream and past analysis, evidence-based diagnostic and policy-constrained remediation. The architecture is planned to organize the operational control loops by latency, confidence, and risk, such that a faster protective action can occur without the slower process of optimization and capacity planning. These implications enable an organized assessment framework to be defined using telemetry completeness, data freshness, and accuracy in anomaly detection, as well as latency in diagnosis, computational and storage overhead, elements of remediation accuracy, and policy adherence as significance measures in evaluation. The suggested method focuses on deciding the design of telemetry, where data gathering needs are based on operational purpose and not viewing telemetry as the end product. The architecture ensures accountable automation by having traceable relationships among observations, analytical results, choices, and actions, minimizing the chances of seizing the wrong remediation. As demonstrated in the paper, an integrated telemetry and analytics can be used to make the network more visible, responsive in its operations and remediation safety without sacrificing the explicit control as exercised by the human and policy authority
References
[1] H. Song et al., “Network Telemetry Framework,” RFC 9232, May 2022. [Online]. Available: https://doi.org/10.17487/RFC9232
[2] OpenConfig, “gRPC Network Management Interface Specification.” [Online]. Available: https://openconfig.net/docs/gnmi/gnmi-specification/
[3] OpenTelemetry, “Signals.” [Online]. Available: https://opentelemetry.io/docs/concepts/signals/
[4] L. Tan et al., “In-band network telemetry: A survey,” Computer Networks, vol. 186, Art. no. 107763, 2021. [Online]. Available: https://doi.org/10.1016/j.comnet.2020.107763
[5] Q. Wu et al., “A framework for automating service and network management with YANG,” RFC 8969, Jan. 2021. [Online]. Available: https://doi.org/10.17487/RFC8969
[6] S. Lee et al., “Network monitoring: Present and future,” Computer Networks, 2014.
[7] P. Foroughi et al., “Destin: Detecting state transitions in network elements.”
[8] J. Cordova-Garcia, “Sparse control and data plane telemetry features for BGP anomaly detection,” in Proc. IEEE INFOCOM, 2019.
[9] A. Lakhina et al., “Diagnosing network-wide traffic anomalies,” ACM SIGCOMM Comput. Commun. Rev., 2004.
[10] A. Lakhina et al., “Mining anomalies using traffic feature distributions,” ACM SIGCOMM Comput. Commun. Rev., 2005.
[11] Q. Ding et al., “A compressed PCA subspace method for anomaly detection in high-dimensional data,” IEEE Trans. Inf. Theory, 2013.
[12] N. Vaswani et al., “Robust subspace learning: Robust PCA, robust subspace tracking, and robust subspace recovery,” IEEE Signal Process. Mag., 2018.
[13] D. S. Yeung et al., “Covariance-matrix modeling and detecting various flooding attacks,” IEEE Trans. Syst., Man, Cybern. A, 2007.
