Increasing resilience of ATM networks using traffic monitoring and automated anomaly analysis

Systematic network monitoring can be the cornerstone for the dependable operation of safety-critical distributed systems. In this paper, we present our vision for informed anomaly detection through network monitoring and resilience measurements to increase the operators' visibility of ATM communication networks. We raise the question of how to determine the optimal level of automation in this safety-critical context, and we present a novel passive network monitoring system that can reveal network utilisation trends and traffic patterns in diverse timescales. Using network measurements, we derive resilience metrics and visualisations to enhance the operators' knowledge of the network and traffic behaviour, and allow for network planning and provisioning based on informed what-if analysis

Decentralised Runtime Verification of Timed Regular Expressions

Ensuring the correctness of distributed cyber-physical systems can be done at runtime by monitoring properties over their behaviour. In a decentralised setting, such behaviour consists of multiple local traces, each offering an incomplete view of the system events to the local monitors, as opposed to the standard centralised setting with a unique global trace. We introduce the first monitoring framework for timed properties described by timed regular expressions over a distributed network of monitors. First, we define functions to rewrite expressions according to partial knowledge for both the centralised and decentralised cases. Then, we define decentralised algorithms for monitors to evaluate properties using these functions, as well as proofs of soundness and eventual completeness of said algorithms. Finally, we implement and evaluate our framework on synthetic timed regular expressions, giving insights on the cost of the centralised and decentralised settings and when to best use each of them

Patch-based Hybrid Modelling of Spatially Distributed Systems by Using Stochastic HYPE - ZebraNet as an Example

Individual-based hybrid modelling of spatially distributed systems is usually expensive. Here, we consider a hybrid system in which mobile agents spread over the space and interact with each other when in close proximity. An individual-based model for this system needs to capture the spatial attributes of every agent and monitor the interaction between each pair of them. As a result, the cost of simulating this model grows exponentially as the number of agents increases. For this reason, a patch-based model with more abstraction but better scalability is advantageous. In a patch-based model, instead of representing each agent separately, we model the agents in a patch as an aggregation. This property significantly enhances the scalability of the model. In this paper, we convert an individual-based model for a spatially distributed network system for wild-life monitoring, ZebraNet, to a patch-based stochastic HYPE model with accurate performance evaluation. We show the ease and expressiveness of stochastic HYPE for patch-based modelling of hybrid systems. Moreover, a mean-field analytical model is proposed as the fluid flow approximation of the stochastic HYPE model, which can be used to investigate the average behaviour of the modelled system over an infinite number of simulation runs of the stochastic HYPE model.Comment: In Proceedings QAPL 2014, arXiv:1406.156

Decentralised LTL Monitoring

Users wanting to monitor distributed or component-based systems often perceive them as monolithic systems which, seen from the outside, exhibit a uniform behaviour as opposed to many components displaying many local behaviours that together constitute the system's global behaviour. This level of abstraction is often reasonable, hiding implementation details from users who may want to specify the system's global behaviour in terms of an LTL formula. However, the problem that arises then is how such a specification can actually be monitored in a distributed system that has no central data collection point, where all the components' local behaviours are observable. In this case, the LTL specification needs to be decomposed into sub-formulae which, in turn, need to be distributed amongst the components' locally attached monitors, each of which sees only a distinct part of the global behaviour. The main contribution of this paper is an algorithm for distributing and monitoring LTL formulae, such that satisfac- tion or violation of specifications can be detected by local monitors alone. We present an implementation and show that our algorithm introduces only a minimum delay in detecting satisfaction/violation of a specification. Moreover, our practical results show that the communication overhead introduced by the local monitors is considerably lower than the number of messages that would need to be sent to a central data collection point

Organising LTL monitors over distributed systems with a global clock

Users wanting to monitor distributed systems often prefer to abstract away the architecture of the system, allowing them to directly specify correctness properties on the global system behaviour. To support this abstraction, a compilation of the properties would not only involve the typical choice of monitoring algorithm, but also the organisation of submonitors across the component network. Existing approaches, considered in the context of LTL properties over distributed systems with a global clock, include the so-called orchestration and migration approaches. In the orchestration approach, a central monitor receives the events from all subsystems. In the migration approach, LTL formulae transfer themselves across subsystems to gather local information. We propose a third way of organising submonitors: choreography — where monitors are orgnized as a tree across the distributed system, and each child feeds intermediate results to its parent. We formalise this approach, proving its correctness and worst case performance, and report on an empirical investigation comparing the three approaches on several concerns of decentralised monitoring.peer-reviewe

Organising LTL monitors over distributed systems with a global clock

Users wanting to monitor distributed systems often prefer to abstract away the architecture of the system, allowing them to directly specify correctness properties on the global system behaviour. To support this abstraction, a compilation of the properties would not only involve the typical choice of monitoring algorithm, but also the organisation of submonitors across the component network. Existing approaches, considered in the context of LTL properties over distributed systems with a global clock, include the so-called orchestration and migration approaches. In the orchestration approach, a central monitor receives the events from all subsystems. In the migration approach, LTL formulae transfer themselves across subsystems to gather local information. We propose a third way of organising submonitors: choreography — where monitors are orgnized as a tree across the distributed system, and each child feeds intermediate results to its parent. We formalise this approach, proving its correctness and worst case performance, and report on an empirical investigation comparing the three approaches on several concerns of decentralised monitoring.peer-reviewe

Advanced SBAS-DInSAR technique for controlling large civil infrastructures: an application to the Genzano di Lucania dam

Monitoring surface deformation on dams is commonly carried out by in situ geodetic surveying, which is time consuming and characterized by some limitations in space coverage and frequency. More recently microwave satellite-based technologies, such as advanced-DInSAR (Differential Synthetic Aperture Radar Interferometry), have allowed the integration and improvement of the observation capabilities of ground-based methods thanks to their effectiveness in collecting displacement measurements on many non-destructive control points, corresponding to radar reflecting targets. The availability of such a large number of points of measurement, which are distributed along the whole structure and are characterized by millimetric accuracy on displacement rates, can be profitably adopted for the calibration of numerical models. These models are implemented to simulate the structural behaviour of a dam under conditions of stress thus improving the ability to maintain safety standards. In this work, after having analysed how advanced DInSAR can effectively enhance the results from traditional monitoring systems that provide comparable accuracy measurements on a limited number of points, an FEM model of the Genzano di Lucania earth dam is developed and calibrated. This work is concentrated on the advanced DInSAR technique referred to as Small BAseline Subset (SBAS) approach, benefiting from its capability to generate deformation time series at full spatial resolution and from multi-sensor SAR data, to measure the vertical consolidation displacement of the Genzano di Lucania earth dam

Cloud Metering and Monitoring

For Service Oriented Infrastructures (SOI) and Cloud services, monitoring and metering are crucial tasks. For the proper execution of cloud applications & the monitoring of SLA compliance, the data gathered through monitoring is required. The motivations for and challenges in monitoring and metering cloud systems are discussed. The methods for monitoring the network and execution environment on virtualized infrastructures will be discussed together with the monitoring tools that are now available on various commercial and research platforms. Every distributed computing system has a basic feature that includes monitoring chores. Every service should be watched over in order to evaluate its effectiveness and enable remedial measures in the event of failure. A functional snapshot of the system's behaviour along the time axis is what monitoring data reflects. Such information is essential for pinpointing the source of issues or for fine-tuning various system components. For example, failure detection and recovery procedures require a monitoring component to determine whether to restart a specific server or subsystem based on the data gathered by the monitoring system.Published By: Blue Eyes Intelligence Engineering and Sciences Publication (BEIESP) © Copyright: All rights reserved

Distributed on-line safety monitor based on safety assessment model and multi-agent system

On-line safety monitoring, i.e. the tasks of fault detection and diagnosis, alarm annunciation, and fault controlling, is essential in the operational phase of critical systems. Over the last 30 years, considerable work in this area has resulted in approaches that exploit models of the normal operational behaviour and failure of a system. Typically, these models incorporate on-line knowledge of the monitored system and enable qualitative and quantitative reasoning about the symptoms, causes and possible effects of faults. Recently, monitors that exploit knowledge derived from the application of off-line safety assessment techniques have been proposed. The motivation for that work has been the observation that, in current practice, vast amounts of knowledge derived from off-line safety assessments cease to be useful following the certification and deployment of a system. The concept is potentially very useful. However, the monitors that have been proposed so far are limited in their potential because they are monolithic and centralised, and therefore, have limited applicability in systems that have a distributed nature and incorporate large numbers of components that interact collaboratively in dynamic cooperative structures. On the other hand, recent work on multi-agent systems shows that the distributed reasoning paradigm could cope with the nature of such systems. This thesis proposes a distributed on-line safety monitor which combines the benefits of using knowledge derived from off-line safety assessments with the benefits of the distributed reasoning of the multi-agent system. The monitor consists of a multi-agent system incorporating a number of Belief-Desire-Intention (BDI) agents which operate on a distributed monitoring model that contains reference knowledge derived from off-line safety assessments. Guided by the monitoring model, agents are hierarchically deployed to observe the operational conditions across various levels of the hierarchy of the monitored system and work collaboratively to integrate and deliver safety monitoring tasks. These tasks include detection of parameter deviations, diagnosis of underlying causes, alarm annunciation and application of fault corrective measures. In order to avoid alarm avalanches and latent misleading alarms, the monitor optimises alarm annunciation by suppressing unimportant and false alarms, filtering spurious sensory measurements and incorporating helpful alarm information that is announced at the correct time. The thesis discusses the relevant literature, describes the structure and algorithms of the proposed monitor, and through experiments, it shows the benefits of the monitor which range from increasing the composability, extensibility and flexibility of on-line safety monitoring to ultimately developing an effective and cost-effective monitor. The approach is evaluated in two case studies and in the light of the results the thesis discusses and concludes both limitations and relative merits compared to earlier safety monitoring concepts

Remote supervision and fault detection on OPC monitored PV systems

This paper presents a new approach for automatic supervision and remote fault detection of grid connected photovoltaic (PV) systems by means of OPC technology-based monitoring. The use of standard OPC for monitoring enables data acquisition from a set of devices that use different communication protocols as inverters or other electronic devices present in PV systems enabling universal connectivity and interoperability. Using the OPC standard allows promoting interoperation of software objects in distributed-heterogeneous environments and also allows incorporating in the system remote supervision and diagnosis for the evaluation of grid connected PV facilities. The supervision system analyses the monitored data and evaluates the expected behaviour of main parameters of the PV array: Output voltage, current and power. The monitored data and evaluated parameters are used by the fault detection procedure in order to identify possible faults present in the PV system. The methodology presented has been experimentally validated in the supervision of a grid connected PV system located in Spain. Results obtained show that the combination of OPC monitoring along with the supervision and fault detection procedure is a robust tool that can be very useful in the field of remote supervision and diagnosis of grid connected PV systems. The RMSE between real monitored data and results obtained from the modelling of the PV array were below 3.6% for all parameters even in cloudy days.Peer ReviewedPostprint (published version