Constellation: automated discovery of service and host dependencies in networked systems
Paul Barham, Richard T. Black, Moisés Goldszmidt, Rebecca Isaacs, John MacCormick, Richard Mortier, Aleksandr Simma · 2008
In a modern enterprise network of any scale, dependencies between hosts, protocols and network services are surpris-ingly complex, typically undocumented, and rarely static. Even though network management and troubleshooting rely on this information, automated discovery and monitoring of these dependencies remains an unsolved problem. The ap-proach we describe in this paper attempts to close this gap by proactively inferring a network-wide map of these complex relationships using innovative machine learning techniques. Constellation takes a black-box approach to learn explicit models of time dependencies using little more than the tim-ings of packet transmission and reception. The parameters of these models are automatically fitted, enabling Constella-tion to be robust to a variety of real-world traffic behaviours. Statistical hypothesis testing on the models provides a guar-anteed confidence level for the accuracy of the result. We present promising results from a prototype implementation using substantial packet traces from Microsoft’s corporate network. We also discuss our experience in applying simpler statistical tests and machine learning approaches, including why they failed to perform. 1.