The Network Link Outlier Factor (Nlof)

We present and evaluate the performance of our Network Link Outlier Factor (NLOF) for detecting transmission channel faults in communication networks. An NLOF is computed for each transmission channel in a network under management using the throughput values derived from flow data. Throughput values of flows are clustered in two stages, outlier values are determined within each of the clusters, and then flow outlier ratios determine the outlier score for each transmission channel (link). Specifically, we first cluster the throughput of flows into the set of clusters we believe will naturally exist in a network and then identify the outliers within those throughput clusters. Our technique to detect network transmission channel faults consists of: 1) flow throughput clustering, 2) flow throughput outlier detection using an outlier score, 3) tracing flows on the network topology using routing information, and 4) network link outlier score computation from flow outlier scores.