USE OF THE STATISTICAL ANALYSIS METHODS TO DETECT VOIP NETWORK TRAFFIC ANOMALIES
DOI:
https://doi.org/10.20998/2079-0023.2020.01.01Keywords:
VoIP services, statistical traffic processing, CDR, service quality metrics, ASR, ACD, traffic anomalies, exponential smoothing, HoltWinters algorithmAbstract
The purpose of the study is to automate detection of signs of technical malfunction and deterioration in the quality of services in the VoIP network. Deterioration of quality leads to a decrease in the volume of services provided, and consequently a profit, a decrea se in customer loyalty and loss of market share. There are three levels of quality degradation in VoIP networks: lack of access at the data network layer, inability to establish a voice connection and lack of access at the level of application services, and degradation of service quality. The analysis of absolute and relative statistical quality indicators of IP-telephony in accordance with the requirements of the international ITU-T standards has been performed, and main indicators and formulas for their calculation are listed. The values of statistical quality indicators are periodically calculated for external channels, subscriber groups and tariff directions. The primary data is CDR (call data records). To detect anomalous changes in the values of the quality indicators it is proposed to use the exponential smoothing method – the Holt-Winters additive model. The deviation of the current value of the quality indicators from the forecasted one is calculated. The confidence range is calculated using the Brutlag method. If the deviation goes beyond the confidence range, the change in the value of the indicator is considered anomalous and the value of the anomaly coefficient of the indicator is set. The period is characterized by a vector of anomaly coefficients of all quality indicators. To classify the period as anomalous, the value of the module of the anomaly coefficients vector of the given period is used. The features of the method application are also considered, in particular the choice of the seasonal period and the calculation of anomaly coefficients during periods of minimum load. The proposed method allows to diagnose an abnormal change in the values of VoIP service quality indicators in automated mode. The prototype of an automated system for the quality of VoIP service monitoring was developed on the base of the method described.References
RFC 3261. SIP: Session Initiation Protocol. IETF, 2002. Available at: https://tools.ietf.org/html/rfc3261 (accessed 20.09.2019).
Zaplotyns'kyy B. A. Polipshennya yakosti posluh u sferi telekomunikatsiy na osnovi vprovadzhennya pidkhodiv z upravlinnya yakistyu [Improving the telecommunications services quality through the quality management approaches implementation.]. Ekonomika. Menedzhment. Biznes. [Economy. Management. Business]. 2015, no. 1, pp. 30–38.
Sakharov A. V. Statisticheskie modeli trafika IP-telefonii: avtoreferat dis. kandidata tekhnicheskikh nauk [Statistical models of IPtelephony traffic: abstract of Candidate of Technical Sciences thesis]. Nizhniy Novgorod, Nizhny Novgorod State technical U. Publ., 2007. 16 p.
Ghiata N., Marcu M. Measurement methods for QoS in VoIP review. 3rd International Congress on Ultra Modern Telecommunications and Control Systems and Workshops, ICUMT 2011. Budapest, Hungary, 2011, pp 1–6.
ETSI TS 102 024-2. Definition of Speech Quality of Service (QoS) Classes. ETSI, 2003. Available at: http://www.etsi.org/deliver/ etsi_ts/102000_102099/10202402/04.01.01_60/ts_10202402v04010 1p.pdf (accessed 20.09.2019).
E.437: Comparative metrics for network performance management. ITU, 1999. Available at: https://www.itu.int/rec/ dologin_pub.asp?lang=e&id=T-REC-E.437-199905-I!!PDF-E &type=items (accessed 20.09.2019).
E.411: International network management – Operational guidance. ITU, 2000. Available at: https://www.itu.int/rec/ dologin_pub.asp?lang=e&id=T-REC-E.411-200003-I!!PDF-E &type=items (accessed 20.09.2019).
Iskhakov S. Yu. Shelupanov A. A., Timchenko S. V. Prognozirovanie v sisteme monitoringa lokal'nykh setey [Forecasting in a LAN monitoring system]. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki [Reports of Tomsk State University of Control Systems and Radioelectronics]. 2012, no. 1 (25), part 2, pp. 100–103.
Szmit M., Adamus S., Szmit A., Bugała S. Implementation of Brutlag's algorithm in Anomaly Detection 3.0. Proceedings of the Federated Conference on Computer Science and Information Systems. 2012, pp. 685–691.
Imil'baev R. R., Krymskiy V. G., Yunusov A. R. Ispol'zovanie interval'nykh vremennykh ryadov dlya prognozirovaniya sostoyaniya gazoraspredelitel'noy seti [The use of interval time series to predict the gas distribution network status]. Elektrotekhnicheskie i informatsionnye kompleksy i sistemy [Electrical and information systems]. 2016, vol. 12, no. 4, pp. 62–72.
RFC 6228. Session Initiation Protocol (SIP) Response Code for Indication of Terminated Dialog. IETF, 2011. Available at: https://tools.ietf.org/html/rfc6228 (accessed 20.09.2019).
Smidovych L. S. Obnaruzhenie froda i tehnicheskih neispravnostej v setjah VOIP [Detecting fraud and technical malfunctions in VOIP networks]. Tezisy ІІІ mezhdunar. nauchno-tehnicheskoj konf. «Komp'juternoe modelirovanie i optimizacija slozhnyh sistem» (KMOSS-2017) [Abstracts of ІІІ international scientific and technical conf. "Computer modeling and optimization of complex systems" (KMOSS-2017)]. Dnipro, 2017, pp. 228–229.
Brutlag J. D. Aberrant Behavior Detection in Time Series for Network Monitoring. 14th System Administration Conference Proceedings. New Orleans, 2000, pp. 139-146. Available at: http://www.usenix.org/events/lisa00/full_papers/brutlag/brutlag_htm l/ (accessed 20.09.2019).
Downloads
How to Cite
Issue
Section
License
Copyright (c) 2020 Bulletin of National Technical University "KhPI". Series: System Analysis, Control and Information TechnologiesAuthors who publish with this journal agree to the following terms:
- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
