Covering all bases with a short blanket: A dynamic monitoring resource allocation scheme

The ability of a management system to dynamically reallocate monitoring resources in order to address changes in the current state is a very important building block of future self-enable management systems. In a world where the total amount of management resources is bounded, being able to focus on the most important threat at any given time can make management systems much more reliable and cost effective. In this paper we study this resource allocation problem, where the network monitoring resources should be allocated to the current threats according to their relative severeness. We formally define a model describing the problem and show that it is NP-hard and does not obey any constant factor approximation. Nevertheless, under reasonable constraints, that hold in most practical scenarios, we present a centralized algorithm that achieves a constant factor approximation. We evaluate the performance of this algorithm using extensive simulation study. We alThe ability of a management system to dynamically reallocate monitoring resources in order to address changes in the current state is a very important building block of future self- enable management systems. In a world where the total amount of management resources is bounded, being able to focus on the most important threat at any given time can make management systems much more reliable and cost effective. In this paper we study this resource allocation problem, where the network monitoring resources should be allocated to the current threats according to their relative severeness. We formally define a model describing the problem and show that it is NP-hard and does not obey any constant factor approximation. Nevertheless, under reasonable constraints, that hold in most practical scenarios, we present a centralized algorithm that achieves a constant factor approximation. We evaluate the performance of this algorithm using extensive simulation study. We also study a distributed version of this algorithm, a muc- h better candidate for real settings, and show that one can get similar performances using the fully distributed version of our algorithm.so study a distributed version of this algorithm, a much better candidate for real settings, and show that one can get similar performances using the fully distributed version of our algorithm.