Maximum Likelihood Network Topology Identification Mark Coates McGill University Robert Nowak Rui Castro Rice University DYNAMICS May 5 th,2003

Network Tomography Inferring network topology based on “external” end-to-end measurements. Traceroute requires cooperation of routers: May not be met in practice This paper assumes no internal network cooperation Solely host-based unicast measurements

How does it work? The Problem Statement R Unique Sender

How does it work? Information we have End-to-end measurements that measure the degree of correlation between receivers Associate metric  i,j with pair of receivers i,j  R Monotonicity property: p i,p j,p k : Paths from sender to i,j,k If p i shares more links with p j than with p k, then  i,j >  i,k

An example Here  18,19 >  i,19 for all other i Examples ? Simple Bottom-up merging algorithms can be used to identify full, logical topology

Two-fold Contribution Novel measurement scheme: –Sandwich Probing –Each probe: three packets –Main Idea: Small packets queues behind the large, inducing extra seperation between small packets on shared links A stochastic search method for topology identification

Sandwich Probing  01 : queuing delay of p 2 on link 0  1,  35 =  01  ij : sum of  ’s on the shared links to receiver i and j no cross-traffic: p1p1 p2p2

more shared queues  larger   34 =  01 +  12  35 =  01 Sandwich Probing

Advantages over loss and delay based metrics  Probe loss is rare on Internet. Large number of measurements required  For measuring delay, clock sync required  Each measurement contributes here.

Measurement framework Measurement of  ij contaminated by cross traffic Multiple measurements CLT Cross traffic: zero-mean effect on

Likelihood Formulation Estimated metrics are randomly distributed according to density p p parameterized by underlying topology T and set of true metric values When is viewed as function of T and , it is called the likelihood of T and .

Likelihood Formulation Maximum Likelihood Tree is given by: F denotes forest of all possible trees G denotes set of all metrics satisfying monotonicity property Maximization involved is formidable Brute Force method: for N = 10, more than 1.8 x 10 6 trees

Simplifying the problem Parameters  are chosen to maximize the value for a given tree T To provide the very best fit T can provide to Data Log likelihood of T Maximum Likelihood Tree is the one in the forest that has the largest likelihood value

Stochastic Search Reversible Markov Chain Monte Carlo Method Using above techniques, authors devise a rapid search method to find optimal trees. “Learning using Bayesian Statistics” Prior and Posterior distributions Main Idea: Posterior Distribution gives the region of high likelihood trees in F

Birth Move (insert node) T 1 T 2

Death Move (delete node) T 2 T 1

ns-2 Simulations source

Simulation results % Correct Number of Probes DBT MPLT

MCMC Algorithm true topologyMCMC topology Can Layer 2 branching points High speed connections can fool tomography

Summary Delay-based measurement, no need for clock synchronization MCMC algorithm to explore forest and identify maximum (penalized) likelihood tree