Inferring functional connectivity from time-series of events in large scale network deployments

To respond rapidly and accurately to network and service outages, network operators must deal with a large number of events resulting from the interaction of various services operating on complex, heterogeneous and evolving networks. In this paper, we introduce the concept of functional connectivity as an alternative approach to monitoring those events. Commonly used in the study of brain dynamics, functional connectivity is defined in terms of the presence of statistical dependencies between nodes. Although a number of techniques exist to infer functional connectivity in brain networks, their straightforward application to commercial network deployments is severely challenged by: (a) non-stationarity of the functional connectivity, (b) sparsity of the time-series of events, and (c) absence of an explicit model describing how events propagate through the network or indeed whether they propagate. Thus, in this paper, we present a novel inference approach whereby two nodes are defined as forming a functional edge if they emit substantially more coincident or short-lagged events than would be expected if they were statistically independent. The output of the method is an undirected weighted graph, where the weight of an edge between two nodes denotes the strength of the statistical dependence between them. We develop a model of time-varying functional connectivity whose parameters are determined by maximising the model's predictive power from one time window to the next. We assess the accuracy, efficiency and scalability of our method on two real datasets of network events spanning multiple months and on synthetic data for which ground truth is available. We compare our method against both a general-purpose time-varying network inference method and network management specific causal inference technique and discuss its merits in terms of sensitivity, accuracy and, importantly, scalability

Functional connectivity inference from time-series of events and application to computer networks

Today’s commercial and Internet Service Provider’s networks are large, heterogeneous, fast-evolving and commonly emit millions of events per second. Monitoring, responding to, and predicting incidents is a key challenge for network management operators. This thesis argues that the concept of functional connectivity, widely used in neuroscience and defined in terms of the presence of statistical dependencies between nodes, can unlock informational value about event logs and assist operators in identifying (and even predicting) service outages. However, existing functional connectivity inference methods are not adapted to event data from computer networks. These methods may either require unavailable models of event propagation, be computationally too costly for large networks and/or long recordings, be not adapted to sparse and discrete activity, and/or assume a static network topology. We thus first describe in depth a major commercial network to highlight the challenges faced by network operators and the opportunities offered by thinking in terms of functional connectivities. Next, using a pair of independent Bernoulli processes as reference, we develop a new statistic aimed at measuring coupling strength by quantifying deviation from independence. However, because many statistics will be large by chance, identifying functional edges from the distribution of statistics over every pair of nodes is challenging. Hence, we then develop a method that infers, in specific contexts, the function that associates each statistic to the probability it accounts for the presence of a functional edge. Next, using the previously described statistic, we propose a novel framework to infer a time-varying functional topology from the time-series of emitted events. Applying this paradigm to two major commercial networks, we show that it can reveal a priori unknown groups of devices providing particular services. Finally, we argue that this thesis has implications beyond assisting network monitoring, such as enabling more robust inference of functional connectivity in neuroscience

Functional topology inference from network events

In this paper we present a novel approach for inferring functional connectivity within a large-scale network from time series of emitted node events. We do so under the following constraints: (a) non-stationarity of the underlying connectivity, (b) sparsity of the time-series of events, and (c) absence of an explicit model describing how events propagate through the network. We develop an inference method whose output is an undirected weighted network, where the weight of an edge between two nodes denotes the probability of these nodes being functionally connected. Two nodes are assumed to be functionally connected if they show significantly more coincident or short-lagged events than randomly picked pairs of nodes with similar levels of activity. We develop a model of time-varying connectivity whose parameters are determined by maximising the model’s predictive power from one time window to the next. We assess the accuracy, efficiency and scalability of our method on a real dataset of network events spanning multiple months

Network Events in a Large Commercial Network: What can we learn?

ISP and commercial networks are complex and thus difficult to characterise and manage. Network operators rely on a continuous flow of event log messages to identify and handle service outages. However, there is little published information about such events and how they are typically exploited. In this paper, we describe in as much detail as possible the event logs and network topology of a major commercial network. Through analysing the network topology, textual information of events and time of events, we highlight opportunities and challenges brought by such data. In particular, we suggest that the development of methods for inferring functional connectivity could unlock more of the informational value of event log messages and assist network management operators

Exploiting functional connectivity inference for efficient root cause analysis

A crucial step in remedying faults within network infrastructure is to determine their root cause. However, the large-scale, complex and dynamic nature of modern architecture makes root cause analysis challenging. Statistical approaches for causal inference are promising, however, their deployment has been historically limited due to their high time complexity. In this paper we propose a general framework for leveraging the concept of functional connectivity to reduce the computational overhead of causal inference algorithms. We demonstrate on synthetic data that our approach can achieve substantial speedups when combined with state-of-the-art causal discovery algorithms, with only a small cost in terms of loss of causal information in some cases

Accelerating causal inference based RCA using prior knowledge from functional connectivity inference

A crucial step in remedying faults within network infrastructures is to determine their root cause. However, the large-scale, complex and dynamic nature of modern networks makes causal inference-based root cause analysis challenging in terms of scalability and knowledge drift over time. In this paper, we propose a framework that utilises the neuroscientific concept of functional connectivity– a graph representation of statistical dependencies between events– as a scalable approach to acquire and maintain prior knowledge for causal inferencebased RCA approaches in dynamic networks. We demonstrate on both synthetic and real-world data that our proposed approach can provide significant speedups to existing causal inference approaches without significant loss of accuracy. We show that, in some cases, such prior knowledge can even improve the accuracy of causal inference. Finally, we discuss the impact of the choice of user-defined parameters on causal inference accuracy and conclude that the framework can safely be deployed in the real world

Studying neuroanatomy using MRI

The study of neuroanatomy using imaging enables key insights into how our brains function, are shaped by genes and environment, and change with development, aging, and disease. Developments in MRI acquisition, image processing, and data modelling have been key to these advances. However, MRI provides an indirect measurement of the biological signals we aim to investigate. Thus, artifacts and key questions of correct interpretation can confound the readouts provided by anatomical MRI. In this review we provide an overview of the methods for measuring macro- and mesoscopic structure and inferring microstructural properties; we also describe key artefacts and confounds that can lead to incorrect conclusions. Ultimately, we believe that, though methods need to improve and caution is required in its interpretation, structural MRI continues to have great promise in furthering our understanding of how the brain works

Entropy-based parametric estimation of spike train statistics

We consider the evolution of a network of neurons, focusing on the asymptotic behavior of spikes dynamics instead of membrane potential dynamics. The spike response is not sought as a deterministic response in this context, but as a conditional probability : "Reading out the code" consists of inferring such a probability. This probability is computed from empirical raster plots, by using the framework of thermodynamic formalism in ergodic theory. This gives us a parametric statistical model where the probability has the form of a Gibbs distribution. In this respect, this approach generalizes the seminal and profound work of Schneidman and collaborators. A minimal presentation of the formalism is reviewed here, while a general algorithmic estimation method is proposed yielding fast convergent implementations. It is also made explicit how several spike observables (entropy, rate, synchronizations, correlations) are given in closed-form from the parametric estimation. This paradigm does not only allow us to estimate the spike statistics, given a design choice, but also to compare different models, thus answering comparative questions about the neural code such as : "are correlations (or time synchrony or a given set of spike patterns, ..) significant with respect to rate coding only ?" A numerical validation of the method is proposed and the perspectives regarding spike-train code analysis are also discussed.Comment: 37 pages, 8 figures, submitte

Edge-based Runtime Verification for the Internet of Things

Complex distributed systems such as the ones induced by Internet of Things (IoT) deployments, are expected to operate in compliance to their requirements. This can be checked by inspecting events flowing throughout the system, typically originating from end-devices and reflecting arbitrary actions, changes in state or sensing. Such events typically reflect the behavior of the overall IoT system – they may indicate executions which satisfy or violate its requirements. This article presents a service-based software architecture and technical framework supporting runtime verification for widely deployed, volatile IoT systems. At the lowest level, systems we consider are comprised of resource-constrained devices connected over wide area networks generating events. In our approach, monitors are deployed on edge components, receiving events originating from end-devices or other edge nodes. Temporal logic properties expressing desired requirements are then evaluated on each edge monitor in a runtime fashion. The system exhibits decentralization since evaluation occurs locally on edge nodes, and verdicts possibly affecting satisfaction of properties on other edge nodes are propagated accordingly. This reduces dependence on cloud infrastructures for IoT data collection and centralized processing. We illustrate how specification and runtime verification can be achieved in practice on a characteristic case study of smart parking. Finally, we demonstrate the feasibility of our design over a testbed instantiation, whereupon we evaluate performance and capacity limits of different hardware classes under monitoring workloads of varying intensity using state-of-the-art LPWAN technology