Predicting Critical Intradomain Routing Events

Network equipments generate an overwhelming number of reports and alarms every day, but only a small fraction of these alarms require the intervention of network operators. Our goal is to build a system to automatically select the set of critical alarms, so that network operators can focus their time and effort on these critical events. As a first step, we focus on alarms from intradomain routing. Our key observation is that operators already use trouble ticketing systems to record all events that require their intervention. Hence, we can use the history of trouble tickets combined with intradomain routing messages to train a classifier. Then, we can apply this classifier online to process intradomain routing messages and single out the critical events. This paper shows the feasibility of this approach by using the k-nearest neighbor algorithm to build classifiers from IS-IS and trouble ticket data from two networks. Our results show that we can accurately pinpoint approximately 70% of critical events for both networks.