An Application of Neural Network and Rule-Based System for Network Management: Application Level Problems

The more complex a network becomes, the more reliable and intelligent a network management system must be to consistently monitor the network and detect abnormal situations in a timely manner as they occur. Expert system techniques have been widely accepted to create network management systems. Despite the fact that there are a number of network management systems, most of them deal only with problems at the lower layers of the network hierarchy (the data link, or the network layer). The nature of problems at the application level significantly differs from of those that occur at the lower levels. Lower layer problems are well-understood while problems at the application level are complex, application dependent, and distinct from one another. Consequently, a network management system, in particular a fault management system, used at this level should be able to cope with these difficulties and dependencies. We propose a hybrid system which consists of neural network module and a rule-based system for monitoring and diagnosing problems occur at the application level. The domain name system (DNS) was selected as a testbed application for the prototype system. 1. Expert systems and network management The more complex a network becomes, the more reliable and intelligent a network management system must be to consistently monitor the network and detect abnormal situations in a timely manner as they occur. Expert system techniques have been widely accepted, and applied to create intelligent network management systems. Currently, there are many network management systems available, most of which were implemented by using two Artificial Intelligent (AI) techniques: expert systems and neural networks. Expert system techniques, mostly, knowledge-based and rule-based, are probably the very first AI techniques that were used to create an automatic, intelligent network management system. They hav e been widely accepted and used to implement network management system for almost a decade [22; 3; 19; 4; 10; 5]. These systems are similar in that they consist of a knowledge base, a rule base, and a control procedure. A typical knowledge base for a network application contains a representation of the network characteristics, including topological and state information. The knowledge base is mostly built using the knowledge extracted from human experts and the relevant network information obtained from the network itself. The rule base represents the operations to be performed when the network is in an undesirable state. The network problems might be obtained from user complaints or from monitoring systems that can detect abnormal network status. If the network enters an undesirable state, the control procedure selects those rules that are applicable to the current situation. A rule can test the network, query a database, or invoke another expert system, etc. Several variations of techniques of rule-based reasoning were used in the implementations. Although these approaches are widely used, they fit well only in a domain where problems have a welldefined model or structure. In the network management area, especially at the application level, it is hard to model a significant part of the set of problems that may occur. Some problems may have nev er occurred before. In addition, in some cases, not all of the problems are yet solved. This may be because of the difficulty of modelling the reasoning relating to a collection of knowledge, or because of the structure of the problems to be solved. It is difficult to apply only expert system techniques to these complex domains. This leads to an alternative technique in which neural networks are applied. 1060-3425/97 $10.00 (c) 1997 IEEE Proceedings of The Thirtieth Annual Hawwaii International Conference on System Sciences ISBN 0-8186-7862-3/97 $17.00 © 1997 IEEE Neural network techniques have recently attracted attention based on their ability to learn complex, nonlinear functions. They hav e recently been, used in some network management systems. However, most of these works are focussed on similar problems, e.g. routing and traffic management [20; 7; 8], or error correction at the digital communication level [18]. 2. Remaining network management problems Despite the fact that there are a number of network management systems, most of them deal only with problems at the lower layers of the network hierarchy (the data link, or the network layer). Thus problems occurring at these layers can be easily solved while those at the upper layer, in particular the application layer, are relatively difficult to solve. The nature of problems at the application level significantly differs from of those that occur at the lower levels. Lower layer problems are wellunderstood while problems at the application layer are complex, application dependent, and distinct from one another. In addition, the behaviour of applications is sometimes unpredictable and might depend on other events, hidden, or unknown at the time. Some applications can be considered as fundamental applications which are used by other applications. Thus problems that occur in these applications might be able to induce other problems in the applications using them. These types of dependencies have to be taken into account when considering the problem solving mechanisms. To solve most of the upper layer problems, the original problems have to be traced. This means, each application which causes a problem or has a tendency to cause a problem has to be investigated so that a problem solving method can be determined. We are interested in the development of problem solving techniques that will allow us to accurately diagnose network application problems. To accomplish this goal, at least one application is required as a testbed application for the research. Initially, the domain name system (DNS) has been selected as it is, currently, probably the only tool that is generally required by almost all network applications; for example, the electronic mail system, file transfer (FTP), and information services like the Wide Area Information Service (WAIS), archie, gopher, etc. These applications, nowadays, rely on DNS services to translate host names into IP addresses and vice versa so that they can establish a network connection in order to carry out their tasks. 3. Domain name system and its problems The DNS is a distributed database. It provides a mechanism for naming resources in such a way that the names are usable in different hosts, networks, and protocol families. The DNS consists of three major components [15]: a domain name space and resource records; name servers; and resolvers. The domain name space and resource records By design, the DNS internal name space is a variabledepth, inverted tree structure. The domain name space is the specification for this tree. Node names (labels) are variable-length strings of 0 to 63 octets [16]. A zero length label is reserved for the root which is written as a dot ‘‘.’’ character in text. Each node of the tree has an associated label and represents part of the domain name system, called a domain. A domain is called a subdomain if it is contained within another domain. This is similar to the directory and subdirectory of a UNIX file system tree. Resource records are data associated with the names in the domain name space. For each domain, there is a set of resource records which contains information for that domain. This information is distributed over the network and is used by name servers to provide services to their clients. A client is a general network application or a user program which requires names and IP addresses resolved. Name servers Name servers are the repositories of information that make up the domain database. Each name server has complete information about some part of the domain name space for which it is responsible. This part of the information is called a zone and the name server has authority for that zone. The delicate difference between a domain and a zone is that a zone contains the domain names and data that a domain contains, except for domain names and data that are delegated elsewhere (see figure 1). Each zone, is controlled by a specific organisation which is responsible for distributing current copies of the zones to multiple name servers. This makes the zones available to clients throughout the Internet. Zone transfers are typically initiated by changes to the data in the zone. Resolvers A resolver is a program, typically a system routine, that interfaces between name servers and user programs, or its clients. It extracts information from name servers in response to a client request. To evoke a response from a name server process, a resolver sends a request 1060-3425/97 $10.00 (c) 1997 IEEE Proceedings of The Thirtieth Annual Hawwaii International Conference on System Sciences ISBN 0-8186-7862-3/97 $17.00 © 1997 IEEE