Review of graph-analytical approaches to monitoring of information and telecommunication networks and their application to identify abnormal states
Task statement: Problem statement: modern approaches to monitoring telecommunications networks are focused on measuring the state of individual devices and services, leaving behind the scenes the state of the network "as a whole" as a single monitoring object. As a consequence, for sufficiently large telecommunication networks, especially in the case when the network element is present in the measurement for an insignificant time compared to the period of existence of the entire network, it becomes impossible to analyze the monitoring results. Despite the increasing prevalence of multidimensional data analysis methods in monitoring systems, the task of visual representation of the "health of the network" is more than relevant. Moreover, unlike multidimensional data cubes, the interpretation and analysis of which is akin to art, methods based on the editorial distance of graphs make it possible to visually visualize the dynamics of not only the entire network, but also its individual fragment, which requires less qualification of personnel operating telecommunication systems. The lack of methods for identifying the state depending on the degree of topology change has long hindered the practical application of methods based on the distance of graph editing. However, the development of the theoretical basis, in particular, the proof of results in the field of average sequence graphs and clustering methods, makes it possible to remove the requirement of preliminary normalization of the measure of topology change, replacing it with the concept of a "cluster of state". The purpose of the work is to develop, on the basis of a scientific and methodological apparatus for evaluating graph sequences, a technique for detecting abnormal states of a telecommunications network by analyzing the degree of change in the topology of a monitoring object. Methods used: methods of computational graph theory; methods of data analysis (cluster analysis); linear algebra and spectral graph theory; methods of behavioral analytics; network monitoring technologies as a set of engineering practices that support reliable and trouble-free operation of applications in the present and future; Operation Support Systems, as a technology to support operations; methods of system analysis, structural synthesis, prediction theory, diagnostic theory, classification theory. The novelty of the work: the novelty of the research is determined by the completeness of the analysis of existing graph-analytical approaches and the use of theoretical results on the averaging of graph sequences within the k-means algorithm to form an adaptive classification methodology for assessing the state of a telecommunications network. Result: based on a preliminary analysis of the results in the field of graph monitoring of telecommunication networks, as well as graph clustering methods, an approach to identifying abnormal states of a telecommunications network is proposed. The proposed approach has been tested on real data of a botnet attack on a telecommunications network and shows a fairly clear identification of the periods when the network is in various states, such as: attack, normal and transient modes.