XIS13-6: Grid Services and Distributed Networking - Essay Example

XIS13-6: Grid Services and Distributed Networking Present-day powerful computer and high-speed network technology with sophisticated software has dramatically changed the way in which modem computing, scientific research and resource shearing is done. Nevertheless it does not provide an effective seamless way to build high-performance computing systems, allowing users to efficiently access and integrate geographically distributed computers, data, and applications. Grid technology promises to provide the next generation computational infrastructure; a layered network services that allow users single sign-on access to a picture perfect distributed collection of computers, data and application resources. This new loom to network computing is also termed as metacomputing, scalable computing, global computing, Internet computing and more recently peer-to-peer (P2P) computing. Based on the service-oriented computing principles, Grids technology creates an illusion of a simple yet large powerful, virtual computer, by aggregating a heterogeneous geographically distributed data and storage resources as shown in fig. 1.This next generation virtual system is intended to be self-managing, self-repairing, fault tolerant and scalable system. These goals plan to achieve through an extension of Decision Support System (DSS) that is to enable the middle ware to real time analyze the gathered information and to control the information providing resources /sensors. If a comparison is made between the security management of a large powerful high speed network, where the presence of suspicious anomalies and their sources are detected and filtered out by network manager, than theses Remote Instrumentation Grids (RIGs) seem to provide a base or platform for developing distributed network monitoring and anomaly detection systems. Hence Grid services can be applied for an anomaly detection system too. Grid technology provides a mean to collect and analyze the date received from geographically distributed heterogeneous sensors. Following can be the building blocks of proposed grid application. 1. Architecture Before proposing the basic architecture for a large anomaly detection system following concerns should be dealt. a. As there is a great number of sensors involved in such anomaly system and they have to communicate with each other, hence this can only be achieved if all sensors have a common communication protocol. b. Privacy issues c. Data traffic or communication overhead management. To meet these challenges following building blocks are proposed as shown in Fig. 2. Fig. 1 a. Virtual Anomaly Grid Services (VAGS): This block consists of Anomaly Sensors which measure various network elements and link to Grid Control Instrument Manager (GCIM) for monitoring and control. VAGS can be defined as in the EU 6th Framework IST project GRIDCC (2004). For real time detection it is crucial that Grid middleware assures such a mechanism by which the reports from VAGS are delivered swiftly and reliably. b. The communication block: It accomplishes the communication task between different domains, thus allowing access to interconnected VIGS’s. c. The Decision Support Web Service (DSWS): It provides algorithms to fuse the collected data to a simplistic processing of independent sensor views. Fig. 2 This distributed monitoring and anomaly detection application is based on trusted Network Operation Centers (NOCs) and above paradigm domain idea can be extended to multi-domain environment in which a NOC acts as Virtual Organization (VO) with in the grid environment. 2. Anomaly detection It involves following steps. a. Data Gathering: The above architecture can only be realize if the present day sensors which are based on different network monitoring technologies, like packet capturing, Netflow exports and SNMP MIBs are modified to identify anomalies for specific traffic components and have fuzzy outputs that can be interpreted as anomaly indications. b. Data fusion: The local data detection can be enhanced by using various data fusion techniques. One of the most interesting options is based on the Dempster - Shafer (D-S) theory of evidence (metrics correlation) (Shafer, 1976). By using D-S as the low-level modeling framework one gains the advantage that the data reported by the individual sensors are plain belief metrics (Siaterlis, C. & Maglaris, B, 2004). On the other hand, the DSWS could use the reports of every sensor and the knowledge of the network topology to improve the detection results via spatial correlation methods (Lakhina, A., Crovella, M. & Diot, C. 2004). c. Principal Component Analysis: The dimensionality of data can be reduced by principal component analysis. In this process a large number of interrelated variables are eliminated and refined non-related components are called Principal Components (PC). PC can be estimated from the eigenvectors of the covariance matrix of the original variables. References Baker, M., Buyya, R. & Laforenza, D. (2000) Grids and Grid technologies for wide-area distributed computing. Softw. Pract. Exper. [Internet] vol.32 (10) pp.3-30. [Access 20 March 2007] Shafer, G. (1976) A Mathematical Theory of Evidence. Princeton: Princeton University Press. Siaterlis, & B. Maglaris, B. (2004) Detecting DDoS attacks with passive measurement based heuristics in ISCC2004. Egypt. Lakhina, A., Crovella, M. & Diot, C. (2004) Diagnosing network-wide traffic anomalies. ACM SIGCOMM Computer Communication Review. vol. 34(4). Read More