A layered and aggregated queuing network simulator for detection of abnormalities

Driven by the needs to monitor, detect, and prevent catastrophic failures for complex information systems in real-time, we develop in this paper a discrete-time queuing network simulator. The dynamic model for the simulator abstracts network dynamics by taking an aggregated and layered structure. Comparative studies verify capabilities of the simulator in terms of accuracy and computational efficiency. We illustrate the model structure, flow processing mechanisms, and simulator implementation. We also illustrate the use of this simulator to detect distributed denial-of-service (DDoS) flooding attacks, based on a cross-correlation-based measure. Finally, we show that the layered structure provides new insights on the spatiotemporal spread patterns of cascading failure, by revealing spreads both horizontally within a sub-network and vertically across sub-networks.