Information Assurance

16.1. Introduction

Network problems such as faults and security attacks are expressed in a network as one or more symptoms (e.g., alarms, logs, troupe tickets). Network problem diagnosis is the process of correlating or analyzing the observed symptoms in order to identify the root cause. As network faults and security attacks might show similar symptoms, it is possible to incorrectly identify faults as security attacks or vice versa. For example, host/network reachablility problems could be due to either a denial of service (DoS) attack or link or protocol failure. These cause more false alarms and incorrect response actions. Therefore, integrating fault and security management is important for practical network management systems in order to ...