A Distributed Spatio-Temporal Event Correlation Protocol for Multi-Layer Virtual Networks

We present a distributed spatio-temporal event correlation protocol for multi-layer networks. The problems that we address relate to scalability in stacked overlay networks and network equipment with asynchronous clocks, which complicates the problem of event correlation. We describe a cross-layer protocol designed to address these problems, operating in a fully distributed manner and taking into account asynchronous timestamps. It is assumed that events in one layer may arise from a series of events in lower layers. Detected events that are spatially related in one layer are aggregated using a gossip-like protocol, and constitute a root cause. The set of aggregated events is disseminated to lower layers and used for temporal correlation. We have tested the scalability and the performance of the distributed event protocol, using both synthetically generated and real-world topologies. The results indicate that the average overhead produced for collecting events down the stack of overlays increases with the number of layers. For a fixed number of layers, the protocol scales similarly with the graph-theoretic properties for a network of increasing size.