NDS LAB - Networking and Distributed Systems

http://www.dicgim.unipa.it/networks/

Monitoring wireless sensor networks through logical

deductive processes

L. Gatani, G. Lo Re, M. Ortolani

In Military Communications Conference, 2005. MILCOM 2005. IEEE,

pp. 1-6

Article

Accepted version

It is advisable to refer to the publisher’s version if you intend to cite

from the work.

Publisher: IEEE

http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1605670&tag=1

MONITORING WIRELESS SENSOR NETWORKS THROUGHLOGICAL DEDUCTIVE PROCESSES

Luca Gatani, Giuseppe Lo Re, Marco OrtolaniDipartimento di Ingegneria Informatica

Universita degli Studi di PalermoEmail: {gatani, lore, ortolani}@unipa.it

Abstract- This paper proposes a distributed multi-agent archi-tecture for wireless sensor networks management, which exploitsthe dynamic reasoning capabilities of the Situation Calculus inorder to emulate the reactive behavior of a human expert to faultsituations. The information related to network events is generatedby tunable agents installed on the network nodes and is collectedby a logical entity for network managing where it is mergedwith general domain knowledge, with the aim of identifyingthe root causes of faults, and deciding on reparative actions.The logical inference system has being devised to carry outautomated isolation, diagnosis, and, whenever possible, repair ofnetwork anomalies, thus enhancing the reliability, performance,and security of the network. To illustrate the advantages andpotential benefits deriving from the reasoning capabilities ofour management system, we also discuss an application scenarioconcerning the need of effectively coping with congestion arisingin critical parts of the network.

I. INTRODUCTIONWireless sensor networks (WSNs) are an emerging tech-

nology that allows for detailed environmental monitoringthrough measurement of characteristic quantities [1], [2]. Theytypically consist of up to several hundreds of tiny devices withprogrammable computing capabilities, equipped with sensingand communication features and characterized by a limitedenergy supply. Possible application scenarios range from en-vironmental monitoring to surveillance of sites for securityand battlefield sensing. This pervasive technology has peculiarneeds, including the necessity of implementing techniques forself-organization and autonomous topology discovery [3], [4];moreover, human intervention must be kept to a minimumonce the network is deployed.

Because of the relevance of the sensed information, man-aging wireless sensor networks represents a critical task,although it has not been fully addressed yet, especially dueto their intrinsic features such as the strict constraints onenergy consumption. Moreover, transmissions in those kind ofnetworks are typically unreliable due to non neglactable failurerates in nodes and links; considering also the unpredictabilityof the operating environment, WSNs can be regarded as highlydynamic systems so it is particularly hard to assess whetherdisconnections have occurred or whether a node is still aliveand working properly.

Those considerations motivate the research on automatedmonitoring instruments able to extract a high level representa-tion of the current state of the network while offering supportin decision making to the network administrator.

Traditional Network Management (NM) [5]-[7] schematashow their limitations when applied to this new scenario, since

they were designed to manage small sub-network areas andto rely on rigid predefined rules and protocols; consequently,they are not capable of facing unexpected occurrences ofevents. Namely, traditional management interactions are basedon a centralised, client/server model, where a central station(manager) collects, aggregates, and processes data retrievedfrom physically distributed devices (agents).

The centralized approach is known to suffer from severeinefficiencies and scalability limitations [8]; the process ofdata collection and analysis typically involves massive trans-fers of data causing considerable strain on network through-put, as well as processing bottlenecks at the central entity.Taken together, these problems suggest that the distributionof monitoring intelligence and management functions wouldoffer a rational way to overcoming the limitations of thecentralized approach. Distributed network management offersseveral perceived advantages: network traffic and processingload can be both reduced by performing data processingcloser to the managed devices; scalability to large networksis improved; searches can be performed closer to the data,improving speed and efficiency. Moreover, distributed networkmanagement is inherently more robust without dependingon continuous communications between managing entity andmanaged devices [9].

In the last years many proposals have been made aboutthe introduction of distributed approaches for network man-agement. Two typical distributed management models are theManagement by Delegation [10] model and the Managementby Mobile Agents [11] model. The goal is to build a newgeneration of network, that can drive its own deployment andconfiguration, that can diagnose its own problems, and makedefensible decisions about how to resolve them.

Following the guidelines in [12], we propose a dynamic rea-soning architecture for computer network management whoselogical system is designed with the aim of exploiting theintrinsic features of logic programming languages and artificialintelligence methodologies.

In order to produce a network model capable of capturingthe cause-effect relationships and the event dynamics, weextended previous work on network ontologies [13] to embeddetailed knowledge about the specific domain considered here.In order to capture the network dynamic behavior, networknodes are provided with tunable programs that monitor crit-ical quantities useful to determine the state of the network;moreover, nodes will store such values which will be accessedon demand by the Logical Reasoner in order to get a global

1 of 6

DRAFT

picture of the network's response to external stimuli. Sucha dynamic environment needs proper tools to be modeled; asuitable formalism is the Situation Calculus [14].

The remainder of the paper is structured as follows. Sec-tion II introduces the general architecture proposed for sen-sor network management, Section III illustrates the logicalapproach adopted in the present work, Section IV discussesan application scenario concerning congestion detection andfinally Section V presents our conclusions.

II. A LOGICAL FRAMEWORK FOR WSNMANAGEMENT

This section is concerned with the architecture that has beenadopted to implement the system proposed for logical networkmonitoring and management. The general framework shownin Figure 1 can be better explained once certain aspects havebeen discussed.

The Logical Reasoner acts primarily as a managing entityfor the system, which collects real-time data about the state ofthe network and is capable of commanding further monitoringactions, in order to infer root causes and to decide opportunecountermeasures. An external database is connected to theLogical Reasoner to maintain data summarization of pastevents. Since this global database (GDB) should contain onlythe minimal amount of meaningful information, the LogicalReasoner must be equipped with an on-line filtering capabilityto execute data mining procedures among all the networklogged data.

Secondarily, if a network user submits a query about specificanomalies which have already occurred in the past, a new,''ad-hoc", instance of the Reasoner is executed in order toperform off-line reasoning, thus exploiting locally logged nodehistory and data provided by the user. The Off-Line Reasoneris modularly designed so that it can load appropriate modulescapable of managing specific queries. The results of the Off-Line Reasoner inference process are also stored in the GDB,thus enriching the knowledge base of network events.

The proposed network management framework providesdistributed tunable agents, located at the network nodes, whichrepresent the end points ofmanagement communication. In theimplementation described here, Tunable Local Agents (TLAs)have been developed to monitor relevant quantitities in eachnode of the network; they monitor the values of characteristicquantitities of the network, such as node residual energy orchannel loss rates, and store them in what we call NetworkMonitoring Variables (NMVs). NMVs will be accessed bythe Logical Reasoner in order to carry on its planned actionsacross the whole network.

A. Logical Reasoner

The various challenges posed by network management,including the real-time monitoring of network events, pastevents management and the planning of future activities, areconsidered in this section. The management activity of theLogical Reasoner is performed in a twofold fashion: throughon-line reactive monitoring, or by off-line analyses of past

network behavior. Since these activities are quite different anduse different network representations (dynamic, for the former,and static for the latter), we designed an architecture capableof executing them as distinct tasks. To this end, the LogicalReasoner consists of two functional blocks, as depicted inFigure 1: the On-Line Reasoner (OnLR), devoted to on-linemonitoring, and the Off-Line Reasoner (OffLR), for off-linereasoning.

The OnLR is responsible for reactive behavior, and needsdynamic representation of network states. The dynamic rep-resentation of network states is obtained using the SituationCalculus formalism. OnLR exploits the TLAs located in thenetwork nodes and accesses the NMVs stored therein to keepits network representation up to date and to collect the eventswhich have already occurred. Using this information, theOnLR can focus its attention on specific network areas andmanagement issues, in order to determine the causes of theobserved abnormal behaviors.On the other hand, the OffLR has the main purpose of

performing "a posteriori" analyses of network functioning,using the information distributed at different network nodesand already processed by different system elements (i.e.,information passed by the OnLR, or previously deduced andstored in the global database, GDB). To this end, the OffLRis capable both of reconstructing the entire network state fora given interval of time, and of examining the event flow ina limited network area. Moreover, the OffLR can perform aglobal reasoning process to analyze general network behaviorand performance. The information deduced by means of thishigher level analysis can be used, for instance, to detect per-formance degradation in the communication infrastructure andto execute an opportune algorithm to prevent the occurrenceof congestion phenomena or to deal with them in an efficientway once they manifest themselves.

The OnLR main module (core module) is a lightweight reac-tive module that acts as a network events "sentinel", receivingnotification about significant network events. In reply to suchevents, it performs a basic reasoning activity, collecting furtherinformation about network states and, if necessary, delegatesspecialized logical modules to perform deeper analyses. Inorder to carry out this task, the OnLR can fine tune thebehavior of the TLAs by issuing specific commands to thenodes. The OnLR core module starts its reasoning processwhenever it detects an anomaly on the network. Anomaliesreported to OnLR represent fault conditions and are associatedto their local causes by means of the TLAs' distributedmonitoring capabilities. OnLR exploits its logical reasoningmechanism to carry out deeper analyses. It can thus detect theroot causes of the observed symptoms, identifying networkfaults that, due to their global nature, cannot be signaled bylocal variable monitoring. For instance, packet losses can beinterpreted as possible symptoms of certain network problems,such as network disconnection or congestion. In particular,whilst network disconnection can be immediately detectedby the OnLR core module using any notified data and itsgeneral domain knowledge, congestion analysis is delegated

2 of 6

DRAFT

NetkorkMoni toigViaraGtewy NetworkMonitringvar2

Netwerk orkAdmiGtrator ea t L

On-Line Reasoner

Dynamic LightweightManagement Reacive

e........................Moae Mo A

|lManagemenMtanagemeii a ---_Mo le IlA ni il

>. .. lnagmlt............... .. XalgdSl.s........... .ol

DRAFT

TABLE IRELEVANT GDB RELATIONS

GDB Relation DescriptionInference maintains the inference results obtained by the

OnLR.Disconnetion is populated both with the summarized information

obtained from the data in the Inference table,and with the specialized inferences deduced "aposteriori" by the OffLR.

CongestionArea maintains the values which represent the conges-tion measurements for the monitored areas.

AreaNodes defines the monitored areas as sets of nodes andconnecting links.

CongestedNodes is populated with information related to all thosenodes which belong to a certain area and haveexperienced utilization above the alert threshold

PacketCongestion maintains references to those packet streams whichare most involved in a congestion situation (relatedto a given area, during a given temporal range).

EnergyMatrix contains a representation of the residual energy inthe network nodes.

the OffLR exploits this information for its own reasoning, andcan insert new knowledge inferred by its deductive processes.Table I shows some of the most important GDB relations.

Moreover, each local agent stores occurrences of a fewrelevant events, with their related data, on its local memory,in order to make them available whenever a Logical Reasonerrequest is performed to analyze past situations. In otherwords, each node records a minimal amount of data relevantto reconstructing its state. For instance, in order to detectfaults which have occurred in the past, the Logical Reasonercan require some additional information about the network'sdynamic condition in all nodes belonging to a given areaduring a given interval of time. TLAs located at the interestednodes can then process their recordings and single out therequired information.

D. Gateway

In order to perform its management tasks, the LogicalReasoner sends queries and receives replies to and froma node hosting a Gateway service which carries out twobasic tasks: message multiplexing/demultiplexing, and reliabletransmission towards the monitored devices. In general, severalnodes in the monitored network can serve as Gateway points.

The Logical Reasoner can then use the Gateway to managedistributed and tunable services, which are capable of carryingout specific tasks on its behalf (such as the retrieval of aparticular item of information from a node, or the verificationof compound tests on several nodes) .

III. LOGICAL APPROACH TO WSN MANAGEMENT

This paper adopts a logical approach to WSN managementwith the aim of exploiting the intrinsic features of logic pro-gramming languages and artificial intelligence methodologiesin terms of synthesis capability, ease of classification, de-ductive reasoning, faculty of planning and correlating severalevents, and anomaly diagnosis.

C)owltThingjC Abnoniialty

C NetCongestionC NetPaiitioning

CtAdioiC Actoi

C TLA

C~ NM'OIC Eveit

C LostPkl_EvtC Staecha(ngeEvtC Ti affir-_EvtC LowResidualEnerigy_Evt

C NetEntityv C IF-etEiftlty

C eiiso[uodevC POWelusupply

C ResidualEinei gyC Pi ocessilgUlit

SellsillqUgrltC Ti aismissioniDevike

C WiilelesLinIkC VetEnity

C RouiMngTTi afficEIty

Fig. 2. The WSN Ontology Hierarchy

In order to provide the most generalized representation ofthe ontological elements designed, we adopted the expressiveWeb Ontology Language (OWL) [18] recently defined by theWorld Wide Web Consortium (W3C), which is consideredextremely suitable for the representation of general knowledge.As shown in Figure 2, the network ontology presents a

hierarchical structure, that glues together classes representingnetwork entities and associations between them. We usedclasses to model hardware and software entities constitutingthe communications infrastructure, the events occurring in thenetwork, the actors operating on the network, and networktraffic.

Hardware entities are strongly linked with the physical net-work structure, since they represent sensor nodes and wirelesslinks and are used to define the network topology. The dynamicbehavior of hardware entities is represented using both classproperties that model the entity state, and references to thesoftware entities involved.

Software entities model some important network elementsand measurements, such as routing information and queues forincoming and outgoing data, and so on. Hardware and softwareentities represent both the static and dynamic structure of thenetwork.

However, to understand the reasoning mechanisms adoptedby the logical entity, it is also necessary to explicitly model

4 of 6

DRAFT

dynamic behavior. This behavior is characterized by the eventsoccurring in the network, by entity status variations, and bynetwork traffic. In order to capture dynamic behavior, theLogical Reasoner acts upon the TLAs in order to access dataregarding local network state.

The management system we have designed can be classifiedas an intelligent system that adopts a case-based strategy [19]owning a thorough knowledge of the working environment.Moreover, we provided the system with the further capabilityof retrieving new knowledge on the basis of the currentsituation where the world lies. Situation Calculus is adoptedas the logical formalism capable of representing the network'sdynamic evolution.

This approach presents several interesting potentialities,which are made available by the Reactive Golog [20] logicprogramming language. Situation Calculus is a sorted first-order formalism with equality. The sorts include differenttypes for primitive actions, situations and everything else(including domain objects). We represented each action as a(possibly parameterized) first-class object within the language.The axiomatization of our domain is performed through well-formed formulae of the first order logic, while the dynamicityis captured through the primitive concepts of states, primitiveactions and fluents.Network evolution is represented by means of a succession

of situations, each of them characterizing a different networkfunctioning state, with the transition from one situation toanother being forced by action performance. A situation canbe thought of as a simple sequence of actions performed bythe network since a known starting state. The evolution of thedomain can therefore be viewed as a tree rooted at a distinctinitial situation. The branches of the tree are determined by thepossible future situations that could arise from the realizationof particular sequences of actions.

IV. AN APPLICATION SCENARIO: REACTING TOCONGESTION IN WSN

In order to exploit the advantages and potential benefitsderiving from the reasoning capabilities of our managementsystem, we considered a sample usage case, related to dealingwith congestion phenomena in sensor networks.As discussed in [21], typical usage of wireless sensor

networks requires them to be in an idle state for most of thetime; only after the occurrence of some triggering event, oras a consequence of a user request, the network awakens andneeds to collect the data related to the detected phenomenonin a timely fashion. Such sudden bursty traffic may lead to thearising of hot spots and likely consequent congestion aroundoverloaded sensor nodes, also depending on the configurationof the network. Clearly, it would be useful to enable thenetwork to quickly react and adjust itself according to varyingtraffic conditions. This would require that the monitoringsystem is able to provide early detection of congestion andadopt a reactive approach to sudden changes in the trafficpattern in order to take the proper countermeasures.

Our system has been implemented and tested adopting themote technology [22] as a wireless sensor network platform;in particular, we used the latest generation of the widely usedBerkeley motes known as MICAz motes. Those devices areequipped with a small processor, an omni-directional antennaand adhere to the IEEE 802.15.4 standard for communications.They also feature a 4-Mbit serial flash memory which supportsover 100,000 measurement readings and can be used for stor-ing data, measurements, and other user-defined information.This storage memory may be accessed through TinyOS [23],the specialized Operating System developed at UCBerkeleyand, although in limited amounts, allows our TLAs to storelocal data.As already mentioned, wireless sensor networks are char-

acterized by a high unreliability, due to operating and en-vironmental conditions and to their intrinsic features. Nodesand link failures are far from uncommon and this obviouslyconstitutes a challenge when dealing with congestion. In suchscenarios it is important to monitor possible congested nodesor areas, but it is hard to infere their presence from the lackof communication from the nodes, which might be simplydue to a shortage in the connectivity. This might lead to falsealarms that are usually very expensive in terms of energy sincethey cause an ineffective increment in control traffic. On theother hand, actual failures in one or more nodes may leadto network partitioning. If this information were available tothe reasoner together with some knowledge of the networkstructure, additional information might be inferred, such asthe unreachability of further nodes; moreover if an entire areais known to be experiencing congestion, the reasoner mightreact to this by shutting down some of the closer nodes inorder to reduce traffic.Our system is able to take advantage of a combination of

implicit and explicit control in order to effectively deal withcongestion. As shown in previous studies [24], [25] the formerapproach is prone to generating an excessive traffic overhead,whereas the latter suffers from a too limited scope and mightnot be sufficienty effective. Our framework, on the other hand,couples local reactions from the TLAs with global measurestaken by the reasoner as a consequence of logical inferences,based on the current and previous network state as stored inits database.

Congestion will be initially detected "in-situ" as nodes areequipped with TLAs that monitor present and past channelloading conditions and current buffer occupancy; althoughthis is just a local approach, it can be attained at no costin terms of wasted energy as pointed out in [21]. Afternoticing that some pre-defined threshold has been exceeded,local agents may independently decide to react using an open-loop hop-by-hop backpressure technique. This minimizes theneed for communication towards the reasoner and may easethe pressure on the nodes quickly as in case of impulse dataevents in dense networks backpressure will likely propagateto the sources.

This approach may not work in all cases, though, as persis-tent congestion phenomena may also occur, so a global action

5 of 6

DRAFT

at the reasoner's level is needed as well. Depending on pastobservations, after receiving signals of possible congestiondetection, the reasoner might take some stronger counter-action by acting upon the affected TLAs; for instance itmight force traffic sources to require an ACK to be sent afterevery transmission; lack ofACK reception would trigger sometransmission regulation mechanism in the sources themselves.

Experiments are currently being carried out, both using thewell known network simulator ns-2 [26] and on the MICAztestbed, in order to assess the effectiveness of the proposedapproach.

V. CONCLUSIONS

This paper proposes an architecture for wireless sensornetwork management which exploits the dynamic reasoningcapabilities of Situation Calculus in order to emulate the reac-tive behavior of a human expert to fault situations. The noveltyof this project arises from the original idea of applying thecapability of capturing enebts dynamicity, typical of SituationCalculus, to a challenging environment such as the one ofwireless sensor networks. The proposed system is capableof performing high-level management tasks and dealing withunusual network situations better than traditional managementsystems. A sample case of functioning has been consideredwhich illustrates an application related to coping with con-gestion arising in critical parts of the network, showing theautomated reasoning capabilities of the logical entity. Theexample exploits the system's ability to identify the root causesof failure and to gather any additional data required by thereasoning process.

REFERENCES

[1] D. Estrin, L. Girod, G. Pottie, and M. Srivastava, "Instrumenting theworld with wireless sensor networks," in Proc. ofInt. Conf on Acoustics,Speech, and Signal Processing (ICASSP 2001), Salt Lake City, Utah,May 2001.

[2] I.F. Akyildiz, W. Su, Y Sankarasubramaniam, and E. Cayirci, "A surveyon sensor networks," IEEE Communication Magazine, vol. 40, no. 8,pp. 102-114, Aug. 2002.

[3] Chalermek Intanagonwiwat, Ramesh Govindan, and Deborah Estrin,"Directed diffusion: a scalable and robust communication paradigm forsensor networks," in Mobile Computing and Networking, 2000, pp. 56-67.

[4] Deepak Ganesan, Alberto Cerpa, Yan Yu, and Deborah Estrin, "Net-working issues in wireless sensor networks," Journal of Parallel andDistributed Computing, Special Issue on Frontiers in Distributed SensorNetworks, 2004.

[5] W. Stallings, SNMP, SNMPv2, SNMPv3, and RMON 1 and 2: ThirdEdition, Addison Wesley, 2003.

[6] M. Sloman, Network and Distributed Systems Management, AddisonWesley, 1994.

[7] H.G. Hegering, S. Abeck, and B.Neumair, Integrated Management ofNetworked System, Morgan Kaufman, 1999.

[8] M. Kahani and H. Beadl, "Decentralized approaches for networkmanagemen," Computer Communication Review, vol. 27, pp. 36-47,July 1997.

[9] T. M. Chen and S. S. Liu, "A model and evaluation of distributednetwork management approaches," IEEE Journal on Selected Areas inCommunications, vol. 20, no. 4, pp. 850-857, May 2002.

[10] Y. Yemini, G. Goldszmidt, and S. Yemini, "Network management bydelegation," in Proc. ofIFIP ISINM'91, 1991, pp. 95 - 107.

[11] T. Magedanz and T. Eckardt, "Mobile software agents: A new paradigmfor telecommunication management," in Proc. ofIFIPIIEEE NOMS'96,1996, pp. 360 - 369.

[12] D. D. Clark, C. Partridge, J. C. Ramming, and J. T. Wroclawski, "Aknowledge plane for the Internet," Proc. ACM SIGCOMM, pp. 3 - 10,Aug. 2003.

[13] A. De Paola, L. Gatani, G. Lo Re, A. Pizzitola, and A. Urso, "A networkontology for computer network management," Tech. Rep. 22, ICAR-CNR, Sezione di Palermo, Dec. 2003.

[14] J. McCarthy, "Situations, actions and causal laws," in SemanticInformation Processing, M. Minsky, Ed., Cambridge, Massachussets,1968, pp. 410 - 417, The MIT Press.

[15] Y J. Zhao, R. Govindan, and D. Estrin, "Residual energy scan formonitoring sensor networks," in Proc. ofIEEE Wireless Communicationsand Networking Conference. IEEE, March 2002, WCNC.

[16] S. Gaglio, L. Gatani, G. Lo Re, and A. Urso, "Exploiting deductiveprocesses for automated network management," in Proc. of the 12thIEEE Inter Conf on Networks (ICON 2004), Nov 2004, vol. 1, pp.221-225.

[17] N. J. Nilson, Artificial Intelligence: A New Synthesis, MorganKaufmann, 1998.

[18] G. Antoniou and F. van Harmelen, "Web Ontology Language: OWL,"in The Handbook on Ontologies in Information Systems, S. Staab andR. Studer, Eds. 2003, Springer Verlag.

[19] K. D. Cebulka, M. J. Muller, and C. A. Riley, "Applications of artificialintelligence for meeting network management challenges of the 1990s,"in Proc. ofIEEE Global Telecommunications Conference (GLOBECOM89), Dallas, TX, USA, Nov. 1989, pp. 501 - 506.

[20] R. Reiter, Knowledge in action: Logical Foundations for specifyingand implementing Dynamical Systems, The MIT Press, Cambridge,Massachusetts, 2001.

[21] Chieh-Yih Wan, Shane B. Eisenman, and Andrew T. Campbell, "CODA:congestion detection and avoidance in sensor networks," in Proc. of theFirst Int. Conf on Embedded Networked Sensor Systems, Los Angeles,CA, USA, Nov 2003, pp. 266-279, ACM Press.

[22] J. Hill and D. Culler, "A wireless embedded sensor architecture forsystem-level optimization," Tech. Rep., UC Berkeley, 2002.

[23] J. Hill, R. Szewczyk, A. Woo, S. Hollar, D. Culler, and K. Pister,"System architecture directions for network sensors," in Proc. of the9th Inter Conf on Arch. Support for Programming Languages andOperating Systems, Nov 2000, pp. 93-104.

[24] Chih fan Hsin and Mingyan Liu, "A distributed monitoring mechanismfor wireless sensor networks," in Proc. ofthe ACMworkshop on Wirelesssecurity at the Int. Conf on Mobile Computing and Networking, Atlanta,GA, USA, 2002, pp. 57-66, ACM Press.

[25] Y J. Zhao, R. Govindan, and D. Estrin, "Computing aggregates formonitoring wireless sensor networks," in Proc. of the First IEEE Int.Workshop on Sensor Network Protocols and Applications, May 2003,pp. 139-148.

[26] Various Authors, ns-2, network simulator (ver 2),http://www.isi.edu/nsnam/ns/, 2000.

6 of 6

DRAFT