Category: CMUTR
Institution: Department of Computer Science, Carnegie
        Mellon University
Abstract: A new method of network fault diagnosis is described based on
        host behavior categorization.
        Monitored network traffic is used to represent a host's behavior
        as a point in a high-dimensional parameter space.
        A number of these points (one for each host) is categorized by 
        an inductive Bayesian classifier and the resulting 
        categorization is used to predict future network host behavior.
        If a host's subsequent behavior is not consistent with its 
        expected class, the host is flagged anomalous and becomes a 
        focus of further diagnosis.
        The system has been tested on approximately a network-year of 
        data and has successfully diagnosed all known faults in this 
        data due to programmer error and has even pointed out several 
        that had previously gone undetected.
        Ways to improve the system's performance with complementary 
        diagnostic techniques are introduced.
Number: CMU-CS-91-194
Bibtype: TechReport
Month: oct
Author: Christopher Maeda
Title: Categorization for Network Fault Diagnosis
Year: 1991
Address: Pittsburgh, PA
Super: @CMUTR