{"schema_version":"0.1","map_id":"paper-30-map","publication_id":30,"publication_anchor":"paper-30","slug":"paper-30","canonical_path":"/knowledge/papers/paper-30/","machine_path":"/knowledge/papers/paper-30.json","root_node_id":"paper-30","stage":"mapped_draft","contribution_type_vocabulary_version":"0.1","contribution_types":["algorithm"],"title":"Automated Inference of Dependencies of Network Services and Applications via Transfer Entropy","year":2016,"status":"Published","venue":"IEEE COMPSAC, ADMNET workshop","topic":"ai-machine-learning","labels":["Applied"],"ai_ml_labels":["AI for security"],"authors":["Karim Eldefrawy","Tiffany Kim","Pape M. Sylla"],"keywords":["network service dependencies","transfer entropy","causal inference","network management"],"abstract":"As the scale and complexity of modern computer networks increases, administrators and operators of such networks need tools to accurately infer dependencies between different network services and applications. Such tools can aid in (1) detecting misconfigurations, (2) effectively scheduling major software and hardware maintenance operations with minimal disruptions, and (3) exposing potential anomalies in a timely manner. Existing tools either only consider temporal correlations which require installing additional software to monitor interfaces, ignore network service profiles of more than two services, or do not necessarily capture actual causations. Such shortcomings result in high false detection rates of inferred dependencies. This paper presents the design and evaluation of an algorithm that utilizes the notion of Transfer Entropy (TE) to passively analyze and identify dependencies between various network services and applications. With TE, our algorithm formalizes and measures the amount of information exchanged between two entities (services or applications) in a computer network. By constructing time series of the interactions of such services and applications and computing the pairwise TE from such time series, our algorithm accurately infers dependencies based on causation with low false (positive and negative) alarms. Using collected network traffic from a test and production network, we demonstrate that the algorithm provides lower false alarms with efficient run time and computational requirements.","research_question":"Can dependencies among network services and applications be inferred passively from traffic with fewer false positives and negatives than correlation-oriented approaches?","central_answer":"The source abstract reports an algorithm that builds interaction time series, computes directional pairwise transfer entropy, and validates inferred dependencies on test and production traffic; because the manuscript body was not retrievable, the estimator, decision rule, ground truth, baselines, sample sizes, and numerical results remain pending.","curation":{"drafted_at":"2026-07-11","drafted_by":[{"actor_type":"ai","name":"OpenAI Codex","role":"abstract-grounded method decomposition, provenance search, and initial assessment"}],"method":"Conservative mapping of the complete abstract previously transcribed from the public ResearchGate author-uploaded PDF, plus the IEEE record. Direct retrieval was blocked by the host and no alternative legitimate author/archive copy was found; body-level claims were not reconstructed from secondary sources.","source_scope":"metadata_and_source_abstract","approval":{"status":"pending","note":"AI-authored abstract-grounded map awaiting author verification and full manuscript audit."}},"sources":[{"id":"source-paper-30-author","type":"author_full_text_route","title":"ResearchGate author-uploaded PDF","url":"https://www.researchgate.net/profile/Karim-Eldefrawy-2/publication/303252585_Automated_Identification_of_Network_Service_Dependencies_via_Transfer_Entropy/links/573dee7808ae9ace84112561/Automated-Identification-of-Network-Service-Dependencies-via-Transfer-Entropy.pdf","provenance_category":"author","scope_note":"Complete abstract is transcribed in this map; body retrieval was blocked during this audit."},{"id":"source-paper-30-official","type":"publication_record","title":"IEEE COMPSAC publication record","url":"https://doi.org/10.1109/COMPSAC.2016.68"},{"id":"source-paper-30-citations","type":"scholarly_index","title":"OpenAlex work record for paper #30","url":"https://openalex.org/W2518247105","accessed_at":"2026-07-11"}],"source_anchors":[{"id":"anchor-paper-30-abstract","source_id":"source-paper-30-author","label":"Complete author-uploaded source abstract","locator":"Abstract transcribed from author-uploaded PDF; body not audited","url":"https://www.researchgate.net/profile/Karim-Eldefrawy-2/publication/303252585_Automated_Identification_of_Network_Service_Dependencies_via_Transfer_Entropy/links/573dee7808ae9ace84112561/Automated-Identification-of-Network-Service-Dependencies-via-Transfer-Entropy.pdf"},{"id":"anchor-paper-30-publication","source_id":"source-paper-30-official","label":"Official IEEE publication record","locator":"COMPSAC Workshops 2016, pages 32-37","url":"https://doi.org/10.1109/COMPSAC.2016.68"},{"id":"anchor-paper-30-citations","source_id":"source-paper-30-citations","label":"Dated OpenAlex citation snapshot","locator":"cited_by_count = 3, accessed 2026-07-11","url":"https://openalex.org/W2518247105"}],"nodes":[{"id":"paper-30","kind":"paper","parent_id":null,"order":1,"epistemic_status":"published_abstract_audited","title":"Automated Inference via Transfer Entropy","summary":"An abstract-grounded passive algorithm for identifying directional dependencies between network services and applications from interaction time series.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-question","kind":"question","parent_id":"paper-30","order":1,"epistemic_status":"research_question_from_abstract","title":"Research question","summary":"Can service dependencies be inferred without host instrumentation while improving on pairwise temporal correlation and reducing false alarms?","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-answer","kind":"contribution","parent_id":"paper-30","order":2,"epistemic_status":"source_abstract_asserted","title":"Central answer","summary":"Convert observed service interactions into time series, calculate pairwise directional transfer entropy, and classify dependencies from information transfer.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-scope","kind":"scope","parent_id":"paper-30","order":3,"epistemic_status":"abstract_level","title":"Operational scope","summary":"The intended uses are dependency mapping for misconfiguration detection, maintenance planning, anomaly exposure, and general network management.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-method","kind":"method","parent_id":"paper-30","order":4,"epistemic_status":"source_abstract_asserted","title":"Transfer-entropy pipeline","summary":"The abstract describes passive traffic collection, interaction time-series construction, pairwise TE computation, and dependency inference; it does not expose preprocessing, estimator, lag selection, significance test, or decision threshold.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-method-directionality","kind":"component","parent_id":"paper-30-method","order":1,"epistemic_status":"source_abstract_asserted","title":"Directional dependence signal","summary":"Transfer entropy is used to measure predictive information flow from one service/application time series to another rather than only symmetric temporal correlation.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-claims","kind":"claim_group","parent_id":"paper-30","order":5,"epistemic_status":"abstract_only","title":"Abstract-level findings","summary":"The abstract reports low false-positive and false-negative alarms, lower false alarms than existing tools, and efficient runtime on test and production-network traffic.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-evidence","kind":"evidence_group","parent_id":"paper-30","order":6,"epistemic_status":"not_body_audited","title":"Reported evaluation","summary":"Only the abstract's statement that test and production traffic were used is visible; datasets, labels, baselines, metrics, numerical results, and uncertainty were not inspected.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-boundaries","kind":"limitation_group","parent_id":"paper-30","order":7,"epistemic_status":"material_source_gap","title":"Unverified boundaries","summary":"The map cannot determine how dependencies were ground-truthed, how TE bias and common causes were handled, whether results generalize across networks, or what computational scaling was measured.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-boundary-causality","kind":"limitation","parent_id":"paper-30-boundaries","order":1,"epistemic_status":"interpretation_boundary","title":"Transfer entropy is not intervention proof","summary":"The abstract uses causal language, but directional predictive information alone does not rule out confounding, indirect paths, or shared drivers; the body is needed to see what causal assumptions and controls were used.","source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"paper-30-artifacts","kind":"artifact_group","parent_id":"paper-30","order":8,"epistemic_status":"public_route_not_locally_fixed","title":"Artifacts and resources","summary":"An IEEE record and author-uploaded PDF route exist, but no local fixed manuscript, code, traffic trace, or experiment package was added because direct retrieval was blocked.","source_anchor_ids":["anchor-paper-30-abstract","anchor-paper-30-publication"]},{"id":"paper-30-scrutiny","kind":"scrutiny","parent_id":"paper-30","order":9,"epistemic_status":"publication_recorded","title":"External scrutiny","summary":"The work was published at the IEEE COMPSAC ADMNET workshop; reviews, independent replication, and operational deployment were not audited.","source_anchor_ids":["anchor-paper-30-publication"]},{"id":"paper-30-lineage","kind":"lineage","parent_id":"paper-30","order":10,"epistemic_status":"source_abstract_asserted","title":"Research lineage","summary":"The method applies information-theoretic directional dependence estimation to service-dependency discovery as an alternative to correlation and host-instrumented tools.","source_anchor_ids":["anchor-paper-30-abstract"]}],"relations":[{"id":"relation-paper-30-answer-addresses-question","type":"addresses","from_id":"paper-30-answer","to_id":"paper-30-question"},{"id":"relation-paper-30-method-realizes-answer","type":"realizes","from_id":"paper-30-method","to_id":"paper-30-answer"},{"id":"relation-paper-30-evidence-supports-claims","type":"supports","from_id":"paper-30-evidence","to_id":"paper-30-claims"},{"id":"relation-paper-30-causality-qualifies-answer","type":"qualifies","from_id":"paper-30-boundary-causality","to_id":"paper-30-answer"},{"id":"relation-paper-30-boundaries-qualify-claims","type":"qualifies","from_id":"paper-30-boundaries","to_id":"paper-30-claims"}],"assessment":{"id":"paper-30-assessment-2026-07-11","rubric_version":"0.2","assessed_at":"2026-07-11","status":"ai_draft_author_review_pending","note":"These dimensions describe documented support and process, not truth, correctness, or a universal ranking. No composite score is calculated.","axes":[{"id":"epistemic_evidence","level":"low","rationale":"The complete source abstract identifies an algorithm and reports production/test-traffic evaluation, but methods, datasets, baselines, and numerical evidence were not body-audited.","basis_source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"auditability","level":"high","rationale":"A public author-uploaded full-text route exists, satisfying the site's author-copy rule; direct body retrieval and local fixity were not achieved in this audit.","basis_source_anchor_ids":["anchor-paper-30-abstract"]},{"id":"production_provenance","level":"medium","rationale":"Named authorship, an author-uploaded route, and an IEEE record establish baseline provenance; roles, code/data versions, and revision history are unknown.","basis_source_anchor_ids":["anchor-paper-30-abstract","anchor-paper-30-publication"]},{"id":"external_scrutiny","level":"medium","rationale":"The paper has an IEEE workshop publication record, but reviews, replication, and deployment were not inspected.","basis_source_anchor_ids":["anchor-paper-30-publication"]},{"id":"reception","level":"low","rationale":"OpenAlex reports 3 located citations as of 2026-07-11. The count is index-specific and may omit versions or citations.","basis_source_anchor_ids":["anchor-paper-30-citations"]},{"id":"contribution_significance","level":"medium","rationale":"The abstract presents a concrete passive dependency-inference algorithm with operational uses, but novelty, empirical strength, and downstream impact were not body-audited.","basis_source_anchor_ids":["anchor-paper-30-abstract"]}]},"reception_snapshot":{"as_of":"2026-07-11","method":"OpenAlex DOI work record cited_by_count","source_url":"https://openalex.org/W2518247105","citation_count":3,"signals":[],"limitation":"OpenAlex coverage and record matching are incomplete; this is a dated located-citation snapshot."}}