# Detecting Network Soft-failures with the Network Link Outlier Factor (NLOF)

## TL;DR

This paper introduces NLOF, a method using NetFlow data to detect soft-failures in communication networks by identifying outliers in flow throughput, enabling early failure detection across the network.

## Contribution

The paper presents NLOF, a novel outlier detection approach based on clustering throughput data to identify soft-failures in network links.

## Key findings

- NLOF scores correlate strongly with actual link failures.
- NLOF effectively detects soft-failures across large networks.
- Experimental evaluation confirms NLOF's accuracy and robustness.

## Abstract

In this paper, we describe and experimentally evaluate the performance of our Network Link Outlier Factor (NLOF) for detecting soft-failures in communication networks. The NLOF is computed using the throughput values derived from NetFlow records. The flow throughput values are clustered in two stages, outlier values are determined within each cluster, and the flow outliers are used to compute the outlier factor or score for each network link. When sampling NetFlow records across the full span of a network, NLOF enables the detection of soft-failures across the span of the network; large NLOF scores correlate well with links experiencing failure.