# Topology Inference and Link Parameter Estimation Based on End-to-End Measurements +
## 5 Motivating Detection Application  
As previously mentioned, one of the main objectives of this work is to go beyond validating the feasibility of the proposed clustering algorithm to designing, implementing, and presenting an actual application that leverages the devised inferential monitoring approach for performing a tangible task in a real testing network. The reasons for pursuing this direction are manifold:  
1. We want to demonstrate the practical value of our technical content and point out that it is not limited to theoretical contributions. 2. We aim to motivate the adoption and further extension of our methods by researchers and developers working on related problems by providing a ready-to-use open-source implementation of an NT-enabled network service. 3. We try to highlight some representative tools and outline the overall process that can be followed for performing validation trials and experiments with real equipment. Monitoring and identifying unusual or anomalous activity is essential for ensuring the efficient operation of network infrastructures. Hereinafter, we combine the proposed clustering algorithm with change point analysis [20] for detecting the occurrence of performance anomalies (i.e., abrupt changes to loss events). The topology employed in our experiments is illustrated in Figure 4, and for change point detection we have leveraged the methods provided by the ruptures[21] library. In particular, the approach we follow consists of the following steps:  
1. execute active multicast probing at the periphery of the network,
2. apply the NN-extended clustering algorithm to estimate the loss rates of all links,
3. repeat the previous two steps at regular intervals/rounds and record the obtained estimates in a multivariate time series, and
4. perform offline change point analysis on the multivariate time series to detect the breakpoints, i.e., the rounds where the loss rates' distribution changes significantly. To coordinate the probing process and the required traffic captures, a node that can reach all terminal nodes is appointed as a controller. This controller is also charged with collecting all capture files and estimating the links' loss rates via network tomography at every round/iteration, to create a multivariate time series. The interactions between the controller and the terminal nodes (i.e., source and destinations) in every round/iteration are depicted in Figure 5. All communications between the nodes are realized with the ZeroMQ[22] asynchronous messaging library (following the request-reply messaging pattern) and, after constructing the multivariate time series, the linearly penalized segmentation (Pelt) algorithm [23] is employed for detecting the change points. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multicolumn{2}{c}{**Physical Tree**} & \multicolumn{1}{c}{**Single**} & \multicolumn{1}{c}{**Complete**} & \multicolumn{1}{c}{**Average**} & \multicolumn{1}{c}{**Weighted**} \\ \hline
**Type** & **\# Nds** & \multicolumn{3}{c}{**Jitter Estimation Execution Time (s)**} \\ \hline Bin. & 8 & 0.3229 & 0.3257 & 0.3212 & 0.3272 \\ Bin. & 16 & 0.4459 & 0.4515 & 0.4459 & 0.4448 \\ Bin. & 24 & 0.6800 & 0.6871 & 0.6803 & 0.6816 \\ Bin. & 32 & 0.9027 & 0.9021 & 0.9127 & 0.9140 \\ Gen. & 10 & 0.3823 & 0.3783 & 0.3830 & 0.3809 \\ Gen. & 20 & 0.6514 & 0.6620 & 0.6668 & 0.6620 \\ Gen. & 30 & 1.0172 & 1.0143 & 1.0189 & 1.0104 \\ Gen. & 40 & 1.3413 & 1.3435 & 1.3496 & 1.3294 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._Figure 6 illustrates the loss rate estimates for every link of the topology (obtained using the proposed algorithm) across 250 iterations/rounds. The change of color indicates the real breakpoints (i.e., the iterations when the underlying distribution of the links' loss rates was changed during the experiment--the ground truth) and the dashed lines denote the breakpoints that were detected by applying the offline change-point algorithm to the obtained estimates. As can be seen, the two sets of breakpoints are indistinguishable.