att_abstract={{Operators typically monitor the performance of network server farms
using rule-based scripts to automatically flag "events of interest" on
an array of active and passive performance measurement feeds.
However, such automatic detection is typically limited to events with
known properties. A different challenge involves detecting the
"unknown unknowns" --  the events of interest whose properties are
unknown, and therefore, cannot be defined beforehand. Visualization
can significantly aid the rapid discovery of such unknown patterns, as
network operators, with domain expertise, may quickly notice
unexpected shifts in traffic patterns when represented visually.
However, the volume of Internet-wide raw performance data can easily
overwhelm human comprehension, and therefore, an effective
visualization needs to be sparse in representation, yet discriminating
of good and poor performance.

This paper presents a tool that can be used to visualize performance metrics at Internet-scale. At its core, the tool builds decision trees over the IP address space using performance measurements, so that IP addresses with similar performance characteristics are clustered together, and those with significant performance differences are separated. These decision trees need to be dynamic -- i.e., learnt online, and adapt to changes in the underlying network.  We build these adaptive decision trees by extending online decision-tree learning algorithms to the unique  challenges of classifying performance measurements across the Internet, and  
our tool then visualizes these adaptive decision trees, distinguishing parts of the
network with good performance from those with poor performance. We
show that the differences in the visualized decision trees helps us
quickly discover new patterns of usage and novel anomalies in latency
measurements at a large server farm.
	att_authors={sv1623, jp935w, ss2864, os1872},
	att_copyright_notice={{The definitive version was published in Proceedings of the Annual Technical Conference, Usenix. {{, 2011-06-15}}}},
	author={Shobha Venkataraman and Jeffrey Pang and Subhabrata Sen and Oliver Spatscheck},
	institution={{Usenix Annual Technical Conference}},
	title={{Internet-scale Visualization and Detection of Performance Events}},