A Decision-Theoretic Approach to Network Fault Diagnosis and Follow-up Action

Fault management and security of computer networks present new challenges of increasing complexity. Decision procedures for fault diagnosis, security-related threats, and follow-up actions must, however, be evaluated on the basis of sound theoretical foundations and economic costs of various strategies. This paper presents a minimum expected cost solution for fault diagnosis and corrective actions. Several notions new to fault management are introduced. The methodology is applicable to both non-malicious and malicious faults. As a novel security-related application, the problem of choosing between two strategies for containing the spread of network worms is discussed.