MAVERICK: Proactively detecting network control plane bugs using structural outlierness

TL;DR

MAVERICK is a proactive control plane verification tool that detects network configuration bugs by identifying structural outliers, significantly reducing false positives and false negatives with minimal administrator input.

Contribution

It introduces a signature-based outlier detection approach for network control plane configurations, enabling automatic bug detection with high accuracy and minimal manual tuning.

Findings

Detects network bugs with ~75% accuracy initially.

Improves detection to 94-100% with minimal tuning.

Reduces false positives and ranks bugs by severity.

Abstract

Proactive detection of network configuration bugs is important to ensure its proper functioning and reduce cost of network administrator. In this research, we propose to build the control plane verification engine MAVERICK that detects the bugs in the network control plane i.e., network device configurations and control plane states. MAVERICK automatically infers signatures for the control plane configurations (e.g., ACLs, route-maps, route-policies and so on) and states that allows administrators to automatically detect bugs with minimal human intervention. MAVERICK achieves this by effectively leveraging any structural deviation i.e., outliers in the network configurations that is organized as simple or complexly nested key-value pairs. The outliers that are calculated using signature-based outlier detection mechanism are further characterized for its severity and ranked or re-prioritized according to their criticality. We consider a wide set of heuristics and domain expertise factors for effectively to reduce both false positives and false negatives.Our evaluation on four medium to large-scale enterprise networks show that MAVERICK can automatically detect the bugs present in the network with approximately 75% accuracy. Further-more, With minimal administrator input i.e., with a few minutes of signature re-tuning, MAVERICK allows the administrators to effectively detect approximately 94 - 100% of the bugs present in the network, thereby ranking down less severe bugs and removing false positives.