Extracting Network-Wide Correlated Changes from Longitudinal Configuration Data

IP network operators face the challenge of making and managing router configuration changes to serve rapidly evolving user and organizational needs. Changes are expressed in low-level languages, and often impact multiple parts of a configuration file and multiple routers. These dependencies make configuration changes difficult for operators to reason about, detect problems in, and troubleshoot. In this paper, we present a methodology to extract networkwide correlations of changes. From longitudinal snapshots of low-level router configuration data, our methodology identifies syntactic configuration blocks that changed, applies data mining techniques to extract correlated changes, and highlights changes of interest via operator feedback. Employing our methodology, we analyze an 11-month archive of router configuration data from 5 different large-scale enterprise Virtual Private Networks (VPNs). Our study shows that our techniques effectively extract correlated configuration changes, within and across individual routers, and shed light on the prevalence and causes of systemwide and intertwined change operations. A deeper understanding of correlated changes has potential applications in the design of an auditing system that can help operators proactively detect errors during change management. To demonstrate this, we conduct an initial study analyzing the prevalence and causes of anomalies in system-wide changes.