Cross-Layer Approach for Minimizing RoutingDisruption in IP Networks

Qiang Zheng, Student Member, IEEE, Guohong Cao, Fellow, IEEE, Thomas F. La Porta, Fellow, IEEE,and Ananthram Swami, Fellow, IEEE

Abstract—Backup paths are widely used in IP networks to protect IP links from failures. However, existing solutions such asthe commonly used independent model and Shared Risk Link Group (SRLG) model do not accurately reflect the correlation betweenIP link failures, and thus may not choose reliable backup paths. We propose a cross-layer approach for minimizing routing disruptioncaused by IP link failures. We develop a probabilistically correlated failure (PCF) model to quantify the impact of IP link failure onthe reliability of backup paths. With the PCF model, we propose an algorithm to choose multiple reliable backup paths to protecteach IP link. When an IP link fails, its traffic is split onto multiple backup paths to ensure that the rerouted traffic load on each IP linkdoes not exceed the usable bandwidth. We evaluate our approach using real ISP networks with both optical and IP layer topologies.Experimental results show that two backup paths are adequate for protecting a logical link. Compared with existing works, the backuppaths selected by our approach are at least 18 percent more reliable and the routing disruption is reduced by at least 22 percent.Unlike prior works, the proposed approach prevents the rerouted traffic from interfering with normal traffic.

Index Terms—Routing, failures, cross-layer, recovery, IP networks

Ç

1 INTRODUCTION

IP link failures are fairly common in the Internet for variousreasons. In high speed IP networks like the Internet

backbone, disconnection of a link for several seconds canlead to millions of packets being dropped [1]. Therefore,quickly recovering from IP link failures is important forenhancing Internet reliability and availability, and hasreceived much attention in recent years. Currently, backuppath-based protection [2], [3], and [4] is widely used byInternet Service Providers (ISPs) to protect their domains. Inthis approach, backup paths are precomputed, configured,and stored in routers. When a link failure is detected, trafficoriginally traversing the link is immediately switched to thebackup path of this link. Through this, the routing disruptionduration is reduced to the failure detection time which istypically less than 50 ms [5].

Selecting backup paths is a critical problem in backuppath-based protection. Existing approaches mainly focuson choosing reliable backup paths to reduce the routingdisruption caused by IP link failures. However, they sufferfrom two limitations. First, the widely used failure modelsdo not accurately reflect the correlation between IP linkfailures. As a result, the selected backup paths may beunreliable. Second, most prior works consider backup path

selection as a connectivity problem, but ignore the trafficload and bandwidth constraint of IP links.

Current IP backbone networks are primarily built on theWavelength Division Multiplexing (WDM) infrastructure [6].In this layered structure, the IP layer topology (logicaltopology) is embedded on the optical layer topology (physicaltopology), and each IP link (logical link) is mapped to alightpath in the physical topology. An IP link may consist ofmultiple fiber links, and a fiber link may be shared by multipleIP links. When a fiber link fails, all the logical links embeddedon it fail simultaneously. Fig. 1 shows an example of thetopology mapping in IP-over-WDM networks. The logicaltopology in Fig. 1a is embedded on the physical topologyshown in Fig. 1b, in which nodes v5, v6, and v7 are optical layerdevices and hence do not appear in the logical topology.Logical links are mapped to lightpaths as shown in Fig. 1c.For example, e1;4 shares fiber link f1;5 with e1;3 and sharesfiber link f4;7 with e3;4.

In prior works, logical link failures were considered asindependent events [7], [8], [9], and [10] or modeled as aShared Risk Link Group (SRLG1) [11], [12], and [13].However, both models have limitations. First, logical linkfailures are not independent because of the topologymapping. In Fig. 1, when fiber link f1;5 fails, logical linkse1;2, e1;3, and e1;4 will fail together. This shows that failuresof e1;2, e1;3, and e1;4 are correlated rather than independent.Second, sharing fiber links does not imply that logical linksin the same SRLG must fail simultaneously. For example,e1;2, e1;3, and e1;4 are in the same SRLG. When e1;4 fails, itdoes not mean that e1;2 and e1;3 must also fail. If the failureof e1;4 is caused by fiber link f4;7, e1;2 and e1;3 may be live. In

. Q. Zheng is with the The Pennsylvania State University, Department ofComputer Science and Engineering, University Park, PA 16802 USA.

. G. Cao is with the The Pennsylvania State University, Department ofComputer Science, University Park, PA 16802 USA.

. T.F. La Porta is with the Pennsylvania State University, EIC,Transactions on Mobile Computing, University Park, PA 16802 USA.

. A. Swami is with the Army Research Laboratory, Adelphi, MA USA.

Manuscript received 7 Nov. 2012; revised 24 Apr. 2013; accepted 28 May2013. Date of publication 13 June 2013; date of current version 13 June 2014.Recommended for acceptance by J. Lloret.For information on obtaining reprints of this article, please send e-mail to:reprints@ieee.org, and reference the Digital Object Identifier below.Digital Object Identifier no. 10.1109/TPDS.2013.157

1. A SRLG is a set of IP links that share the same risk such as a fiberlink failure. If an IP link fails, all the IP links within the same SRLG areconsidered as failed.

1045-9219 � 2013 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 7, JULY 2014 1659

fact, recent Internet measurements [14], [15] show thatindependent failures and correlated failures coexist in theInternet. When e1;4 fails, it may be an independent failure ora correlated failure due to shared fiber links. Therefore, e1;2

and e1;3 may also fail with a certain probability, i.e., failuresof e1;2, e1;3, and e1;4 are probabilistically correlated. Thisfeature cannot be modeled by the traditional independentand SRLG models, and has not been investigated in backuppath selection.

Most existing approaches focus on selecting reliablebackup paths, but ignore the fact that a backup path maynot have enough bandwidth for the rerouted traffic. As aresult, the rerouted traffic load on some logical links mayexceed their usable bandwidth, and thus cause linkoverload. As Iyer et al. observed [16], most link overloadin an IP backbone is caused by the traffic rerouted due to IPlink failures. In a survey in 2010, two of the largest ISPs inthe world reported congestion caused by rerouted traffic intheir networks [17]. Therefore, backup paths should becarefully selected to prevent causing link overload.

We propose a cross-layer approach to minimize routingdisruption caused by IP link failures. The basic idea is toconsider the correlation between IP link failures in backuppath selection and protect each IP link with multiplereliable backup paths. A key observation is that the backuppath for an IP link is used only when the IP link fails.Therefore, the reliability of backup path should be calcu-lated under the condition that the IP link fails. We develop aprobabilistically correlated failure (PCF) model based onthe topology mapping and the failure probability of fiberlinks and logical links. The PCF model calculates the failureprobability of fiber links, logical links, and backup pathsunder the condition that an IP link fails. Hence, we candetermine reliable backup paths with the PCF model.With the PCF model, we propose an algorithm to select atmost N reliable backup paths for each IP link and computethe rerouted traffic load on each backup path. This ensuresthat the rerouted traffic load on each IP link does not exceedits usable bandwidth so as to avoid link overload.

Our approach is different from prior works in threeaspects. First, it is based on a cross-layer design, whichconsiders the correlation between logical and physicaltopologies. The proposed PCF model can reflect theprobabilistic correlation between logical link failures.Second, we protect each logical link with multiple backuppaths to effectively reroute traffic and avoid link overload,whereas most prior works select single backup path for eachlogical link. Third, our approach considers the traffic load

and bandwidth constraint. It guarantees that the reroutedtraffic load does not exceed the usable bandwidth, evenwhen multiple logical links fail simultaneously. We eval-uate the proposed approach using real ISP networks withboth optical and IP layer topologies. Experimental resultsshow that two backup paths are adequate for protecting alogical link. Compared with existing works, the backuppaths selected by our approach are at least 18 percent morereliable and the routing disruption is reduced by at least22 percent. Moreover, the proposed approach preventslogical link overload caused by the rerouted traffic.

The rest of this paper is organized as follows. Section 2presents the background for our work. Section 3 presentsthe PCF model. Section 4 describes the backup pathselection problem and solution. Section 5 presents theperformance evaluation and Section 6 reviews relatedwork. Finally, Section 7 concludes the paper.

2 PRELIMINARIES

This section introduces backup path-based IP link protec-tion and a model of IP-over-WDM networks.

2.1 Backup Path-Based IP Link ProtectionIn the current Internet, each router monitors the connec-tivity with its neighboring routers. When a logical link fails,only the two routers connected by it can detect the failure.Hence, a router may not have the overall information offailures in the network. Although the failed logical linkscan be identified within a few seconds [18], this waitingtime translates to a lot of dropped packets on a highbandwidth optical link. As a result, a recovery approachcannot wait until finishing collecting the overall informa-tion of failures and then reroute traffic.

Instead, backup paths are widely used to quickly reroutethe traffic affected by failures. In backup path-based IP linkprotection, a router precomputes backup paths for each ofits logical links. On detecting a link failure, the routerimmediately switches the traffic originally sent on thatlogical link onto the corresponding backup paths. After therouting protocol converges to a new network topology,routing paths will not contain the failed logical link and therouter has a reachable next hop for each destination.Therefore, the router stops using the backup path to reroutetraffic. Moreover, routers recompute backup paths basedon the new network topology. Backup paths can beimplemented with Multi-Protocol Label Switching [19]which is widely supported in the current Internet. Each

Fig. 1. Example of the mapping between the logical and physical topologies in IP-over-WDM networks. (a) Logical topology. (b) Physical topology.(c) Mapping between the logical and fiber links.

IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 7, JULY 20141660

backup path is configured as a Label-Switched Path (LSP)and the rerouted traffic can be split on backup paths.

2.2 Model of IP-over-WDM NetworksBackup path-based protection is primarily used for intro-domain routing, which is really deployed by ISPs to protecttheir domains. Similarly, our approach is also for intra-domain routing. ISPs instrument their networks heavilyand have the network topology, link capacity, and trafficdemands which are used in our approach. The IP-over-WDM network under study has a logical topology and aphysical topology, which are commonly modeled as twoundirected graphs [20], [21], [22], and [23]. In the physicaltopology GP ¼ ðVP ; FP Þ, VP is a set of nodes and FP is a setof fiber links. The fiber link from vm 2 VP to vn 2 VP isdenoted by fm;n. In the logical topology GL ¼ ðVL; ELÞ,VL � VP andEL is a set of logical links. The logical link fromvi 2 VL to vj 2 VL is denoted by ei;j. Each logical link ismapped on the physical topology as a lightpath, i.e., a pathover the fiber links. Hence a logical link is embedded on fiberlinks, or a fiber link carries logical links. The topologymapping is established during network configuration, andthus is known to us. Unlike logical link states, the topologymapping is quite stable and does not frequently change.When the network administrator adjusts the topologymapping, the topology mapping information at routers canalso be updated. Table 1 summarizes the notations used inthis paper.

3 PROBABILISTICALLY CORRELATEDFAILURE MODEL

This section describes the probabilistically correlated failure(PCF) model. We first provide some motivation and thenpresent the details of this model. We also provide an examplein Appendix A, which can be found on the Computer SocietyDigital Library at http://doi.ieeecomputersociety.org/10.1109/TPDS.2013.157, to show how the model works and

differentiate it from the traditional independent and SRLGmodels.

3.1 MotivationRecent measurements [14], [15] show that there are twotypes of IP link failures in the Internet, i.e., independentfailures and correlated failures. Independent failures areunrelated. They occur for several reasons, such as hard-ware failures, configuration errors, and software bugs.Correlated failures are mainly caused by failures of fiberlinks carrying multiple logical links. When a logical linkhas a correlated failure, it implies that some other logicallinks sharing fiber links with it may also fail.

Since each router only monitors the connectivity with itsneighboring routers, routers cannot determine whether alogical link failure is independent or correlated. The failureof ei;j implies that the logical links sharing at least one fiberlink with ei;j may also fail with a certain probability. Therefore,backup path selection approaches should consider thisprobabilistic correlation between logical link failures. How-ever, the traditional independent and SRLG models take thecorrelation between logical link failures as a none-or-allrelation. The independent model considers that logical linksonly have independent failures and thus it usually under-estimates the failure probability of logical links; whereas theSRLG model considers that logical links only have correlatedfailures and usually overestimates the failure probability.

We develop a PCF model based on the topologymapping and the failure probability of fiber links andlogical links. The PCF model considers the probabilisticrelation between logical link failures. The objective is toquantify the impact of a logical link failure on the failureprobability of other logical links and backup paths. Withthe PCF model, we propose an algorithm to choose reliablebackup paths to minimize the routing disruption.

3.2 The PCF ModelThe PCF model is built on three kinds of information, i.e.,the topology mapping, failure probability of fiber links,and failure probability of logical links, all of which arealready gathered by ISPs. ISPs configure their topologymapping, and thus they have this information. The failureprobability of fiber links and logical links can be obtainedwith Internet measurement approaches [14], [15] deployedat the optical and IP layers. Monitoring mechanisms at theoptical layer can detect fiber link failures through SONETalarms. The information of logical link failures can beextracted from routing updates. ISPs also maintain failureinformation, because they monitor the optical and IP layersof their networks.

A key observation is that the failure probability of thebackup paths for logical link ei;j should be computed underthe condition that ei;j fails, because the backup paths are usedonly when ei;j fails. A backup path is built on logical links, anda logical link is embedded on fiber links. Hence, we firstcompute the failure probability of fiber links under thecondition that ei;j fails. Then, we compute the conditionalfailure probability of logical links and backup paths.

The unconditional failure probability of logical link ei;j isdenoted by pi;j 2 ½0; 1Þ, which includes independent and

TABLE 1Table of Notations

ZHENG ET AL.: CROSS-LAYER APPROACH FOR MINIMIZING ROUTING DISRUPTION IN IP NETWORKS 1661

correlated failures. However, it cannot reveal the correlationbetween logical link failures and thus we cannot directly use itto compute the conditional failure probability of backuppaths. Unlike logical links, most fiber link failures areindependent [13], [23]. We assume that a fiber link fm;n failsindependently with probability qm;n 2 ½0; 1Þ. In practice, wemay obtain pi;j and qm;n based on previous logical link failuresand fiber link failures. Let ai;jm;n defined in Eq. (1) express themapping between logical link ei;j and fiber link fm;n

ai;jm;n ¼1 if ei;j is embedded on fm;n0 otherwise.

�(1)

A logical link is subject to failures and correlated failuresare caused by the fiber links carrying multiple logical links.Let Fi;j be the set of fiber links shared by ei;j and otherlogical links. Fi;j is defined by Eq. (2). Suppose that a fiberlink fm;n carries ei;j, i.e., ai;jm;n ¼ 1. If there is another logicallink es;t that is also carried by fm;n, fm;n is in the set Fi;j

Fi;j ¼ fm;njai;jm;nas;tm;n ¼ 1; ei;j 2 EL; 9es;t 2 EL;n

8fm;n 2 FP�: (2)

Let pCi;j be the probability that ei;j has correlated failureswith other logical links. Since fiber link failures areindependent, pCi;j is computed by Eq. (3). If ei;j does notshare a fiber link with other logical links, its correlatedfailure probability is 0

pCi;j ¼0 if Fi;j ¼ ;1�

Qfm;n2Fi;jð1� qm;nÞ otherwise.

�(3)

Suppose the independent failure probability of ei;j is pIi;j.We have the relation shown in Eq. (4), because failures ofei;j are either independent or correlated. Lemma 1 showsthat pIi;j must be strictly less than unity

pi;j ¼ 1� 1� pIi;j� �

1� pCi;j� �

: (4)

Lemma 1. pIi;j 2 ½0; 1Þ.

Proof. According to Eq. (4), pIi;j ¼pi;j�pCi;j1�pCi;j

. Since qm;n 2 ½0; 1Þfor each fiber link qm;n, we have pCi;j 2 ½0; 1Þ. Together

with pi;j 2 ½0; 1Þ, we have pIi;j G 1. Therefore, pIi;j 2 ½0; 1Þ. g

Based on the above information, we compute the failureprobability of fiber links under the condition that ei;j fails.Let P ðfm;njei;jÞ be this conditional failure probability. Weonly need to deal with the fiber link fm;n with failureprobability qm;n 9 0. There are three cases as follows.

. Case 1: ei;j is not embedded on fm;n. It means thatthe failure of ei;j is not related with fm;n. Hence,P ðfm;njei;jÞ is equal to qm;n.

. Case 2: fm;n only carries ei;j, then a failure of fm;nleads to an independent failure of ei;j. In this case,P ðfm;njei;jÞ is calculated by Eq. (5), where P ðeIi;jjei;jÞis the probability that ei;j has an independent failurewhen it fails, and P ðfm;njeIi;jÞ is the probability thatthis independent failure is caused by fm;n

P ðfm;njei;jÞ ¼ P eIi;jjei;j� �

� P fm;njeIi;j� �

: (5)

Based on Bayes’ theorem, P ðeIi;jjei;jÞ is calculated byEq. (6). P ðei;jjeIi;jÞ is the failure probability of ei;jwhen its independent failures occur, which is 1.P ðeIi;jÞ is the independent failure probability of ei;j,i.e., pIi;j. P ðei;jÞ is the failure probability of ei;j, i.e., pi;j

P eIi;jjei;j� �

¼P ei;jjeIi;j� �

P eIi;j

� �P ðei;jÞ

¼P eIi;j

� �P ðei;jÞ

¼pIi;jpi;j

: (6)

Similarly, P ðfm;njeIi;jÞ is computed by Eq. (7). Sinceqm;n is not 0, pIi;j cannot be 0

P fm;njeIi;j� �

¼P eIi;jjfm;n� �

P ðfm;nÞ

P eIi;j

� � ¼ qm;npIi;j

: (7)

Based on Eqs. (5), (6), (7), P ðfm;njei;jÞ ¼ qm;npi;j

.. Case 3: fm;n carries ei;j and some other logical

links, then a failure of fm;n leads to correlatedfailures. The calculation of P ðfm;njei;jÞ is similar tothat in case 2, in which eIi;j is replaced by eCi;j and pIi;jis replaced by pCi;j. The result is the same as in case 2,i,e., P ðfm;njei;jÞ ¼ qm;n

pi;j.

In summary, the conditional failure probability P ðfm;njei;jÞis given by Eq. (8). It is only defined for ei;j whose failureprobability pi;j is not 0. If pi;j is 0, ei;j never fails, and thus wedo not need to select backup paths for it

P ðfm;njei;jÞ ¼qm;n ai;jm;n ¼ 0qm;npi;j

ai;jm;n ¼ 1:

((8)

The conditional probability cannot be smaller than theunconditional probability. The following Lemma 2 shows thatconditioning strictly increases the probability of fiber links.

Lemma 2. If fm;n carries ei;j and qm;n 9 0, P ðfm;njei;jÞ 9 qm;n.

Proof. If fm;n carries ei;j, the second case of Eq. (8) holds, i.e.,P ðfm;njei;jÞ ¼ qm;n

pi;j. Since qm;n 9 0, the failure probability of

ei;j is above 0. Since pi;j 2 ½0; 1Þ, we have pi;j 2 ð0; 1Þ.Therefore, P ðfm;njei;jÞ ¼ qm;n

pi;j9 qm;n. g

Lemma 2 indicates the condition under which theposterior probability of fm;n is increased due to a failureof ei;j. Accordingly, the failure probability of the logicallinks embedded on fm;n is affected by the failure of ei;j.

Next, we calculate the failure probability of logical linksunder the condition that ei;j fails. A logical link es;t hasindependent failures and correlated failures. Its indepen-dent failure probability is pIs;t, whether or not ei;j fails.However, its correlated failure probability may be affectedby the failure of ei;j. We use P ðeCs;tjei;jÞ to denote thecorrelated failure probability of es;t under the conditionthat ei;j fails. It is calculated by Eq. (9) (see also Eq. (3)). SetFs;t contains all fiber links shared by es;t and other logicallinks. If es;t does not share a fiber link with other logical links(i.e., Fs;t is empty), es;t does not have correlated failures andthus its correlated failure probability under condition of ei;jfailure is 0. If Fs;t is not empty, P ðeCs;tjei;jÞ is computed using

IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 7, JULY 20141662

each fiber link fm;n in Fs;t, because only these fiber links arerelated with the correlated failure of es;t

P eCs;tjei;j� �

¼ 0 if Fs;t ¼ ;1�

Qfm;n2Fs;t 1� P ðfm;njei;jÞ

� �otherwise.

�(9)

Based on this, Eq. (10) computes the failure probabilityof es;t under the condition that ei;j fails, which is denoted byP ðes;tjei;jÞ (see also Eq. (4))

P ðes;tjei;jÞ ¼ 1� 1� pIs;t� �

1� P eCs;tjei;j� �� �

: (10)

Theorem 1 shows that conditioning strictly increases theprobability of logical links.

Theorem 1. P ðes;tjei;jÞ 9 ps;t, if there is a fiber link fm;n satis-fying as;tm;n ¼ 1, ai;jm;n ¼ 1, and qm;n 9 0.

Proof. Since pIs;t 2 ½0; 1Þ as shown by Lemma 1, 1� pIs;t 2 ð0; 1�.According to Eq. (4) and Eq. (10), we need to proveP ðeCs;tjei;jÞ 9 pCs;t to show P ðes;tjei;jÞ 9 ps;t. With Eq. (3) andEq. (9), it is equivalent to proving the following relation:Y

fm;n2Fi;j1� P ðfm;njei;jÞ� �

GY

fm;n2Fi;jð1� qm;nÞ:

If qm;n is 0,P ðfm;njei;jÞ is also 0, and thus 1� P ðfm;njei;jÞ ¼ 1and 1� qm;n ¼ 1. If fm;n carries ei;j and qm;n 9 0, Lemma 2 showsthat P ðfm;njei;jÞ 9 qm;n. Therefore,

Qfm;n2Fi;jð1� P ðfm;njei;jÞÞ GQ

fm;n2Fi;jð1� qm;nÞ, if there is a fiber link fm;n shared by ei;j andes;t and qm;n 9 0. It means that P ðes;tjei;jÞ 9 ps;t.

As shown by Theorem 1, if logical link es;t shares a fiberlink fm;n with ei;j and qm;n is not 0, the failure probabilityof es;t is increased due to the failure of ei;j. Accordingly,the failure probability of the backup paths built on es;t isincreased when ei;j fails.

Next, we calculate the failure probability of backup pathsunder the condition that ei;j fails. Let Bk

i;j denote the kthbackup path of ei;j, and P ðBk

i;jjei;jÞ denote the failure pro-bability of Bk

i;j when ei;j fails. The variable xi;j;ks;t 2 f0; 1g isdefined as follows to express if Bk

i;j uses the logical link es;t:

xi;j;ks;t ¼ 1 if Bki;j uses es;t

0 otherwise.

�(11)

P ðBki;jjei;jÞ is computed by Eq. (12), which enumerates

logical links and counts the ones traversed by Bi;j

P Bki;jjei;j

� �¼ 1�

Yes;t2EL

1� xi;j;ks;t P ðes;tjei;jÞ� �

: (12)

We provide an example in Appendix A which can befound in the online supplemental material to show how thePCF model works and the differences from the indepen-dent and SRLG models.

4 BACKUP PATH SELECTION

With the PCF model, we propose an algorithm to selectmultiple backup paths to protect each IP link. Ouralgorithm considers both reliability and bandwidthconstraints. It aims at minimizing routing disruption bychoosing reliable backup paths and splitting the reroutedtraffic onto them. Furthermore, it controls the reroutedtraffic load to prevent causing logical link overload.

4.1 MotivationMost existing protection approaches focus on choosingreliable backup paths, but ignore the fact that a backuppath may not have enough bandwidth for the reroutedtraffic. Without considering the bandwidth constraint, theycommonly choose one backup path to protect each logicallink. Our approach considers both reliability and band-width constraint. It protects each logical link with multiplebackup paths and splits the rerouted traffic onto them,because there may be no individual backup path that hasenough bandwidth for the rerouted traffic.

Fig. 2 illustrates the need for protecting a logicallink with multiple backup paths. Logical links havecapacity 1, and the number on a logical link is its trafficload under normal conditions. In Fig. 2a, v1 uses a singlebackup path to protect e1;4, whose usable bandwidth isminf1� 0:6; 1� 0:5g ¼ 0:4. When e1;4 fails, the total trafficload on e1;2 will exceed its bandwidth, and hence linkoverload occurs. Our approach protects e1;4 with twobackup paths as shown in Fig. 2b. When e1;4 fails, thererouted traffic load split onto the left one is 0.4, andthat onto the right one is 0.2. With this approach, the entiretraffic of e1;4 can be rerouted without causing link overload.

Using more backup paths to protect a logical link is helpfulfor rerouting traffic, but increases the time for computingbackup paths, configuration complexity, and storage over-head. We require that each logical link can have at most Nbackup paths. An appropriate N should be chosen based onusable network resources. In Section 5, we will investigate theimpact of parameter N on the performance of our approach.

4.2 Problem Definition and FormulationWe consider both reliability of backup paths and band-width constraint of logical links. The objective is to mini-mize the routing disruption of the entire network, whichwas also the major objective in prior works. Furthermore,the rerouted traffic load on a logical link should not exceedits usable bandwidth to prevent logical link overload andinterfering with normal traffic. This constraint is ignoredby existing approaches.

First, we define routing disruption based on the PCFmodel. Suppose the capacity of logical link ei;j is ci;j.Under normal conditions, the traffic load on ei;j is li;jwhich satisfies li;j � ci;j. Network administrators config-ure the link cost to achieve traffic engineering goals, andhence traffic load li;j is known. The bandwidth of ei;j that

Fig. 2. Motivation for protecting a logical link with multiple backup paths.(a) Single backup path may not have enough bandwidth. (b) The reroutedtraffic is split on two backup paths.

ZHENG ET AL.: CROSS-LAYER APPROACH FOR MINIMIZING ROUTING DISRUPTION IN IP NETWORKS 1663

can be used by backup paths is ci;j � li;j. ei;j is overloaded ifthe rerouted traffic load on it exceeds ci;j � li;j. The kthbackup path is denoted byBk

i;j, and the bandwidth reservedfor it is rki;j, which is the traffic load split onto Bk

i;j when ei;jfails. The traffic load of ei;j protected by backup paths isPN

k¼1 rki;j, and the unprotected traffic load is li;j �

PNk¼1 r

ki;j.

When ei;j fails, the unprotected traffic is disrupted. If Bki;j

also fails, the traffic rerouted onBki;j is disrupted. Therefore,

the traffic disruption of ei;j is defined in Eq. (13), which isthe mathematical expectation of the disrupted traffic load

Di;j ¼ pi;jXNk¼1

P Bki;jjei;j

� �rki;j þ li;j �

XNk¼1

rki;j

!: (13)

The routing disruption of the entire network is thendefined in Eq. (14), which is the mathematical expectationof traffic disruption in the entire network

D ¼Xei;j2EL

Di;j: (14)

The backup path selection problem is described inDefinition 1.

Definition 1 (Problem Definition). We aim to select at mostN backup paths for each logical link and compute the reroutedtraffic load for each backup path, such that (1) the routing dis-ruption of the entire network is minimized; (2) the rerouted trafficload on each logical link does not exceed its usable bandwidth.

Our problem can be formally defined as an optimizationproblem as shown in Eqs. (15), (16), (17), (18), (19), in whichxi;j;ks;t and rki;j are unknown variables. Eq. (16) is anexpression commonly used in network flow theory todenote the connectivity constraint. For a backup path Bk

i;j,Eq. (16) means that the logical links selected for Bk

i;j arerequired to form a path from node vi to node vj. The firstsum in Eq. (16) is the number of the logical links on Bk

i;j

that leave node vs. The second sum is the number of thelogical links on Bk

i;j that enter node vs. Eq. (16) includesthree cases. If vs is the source, the outgoing logical linksshould be one more than the ingoing logical links. If vs isthe destination, the outgoing logical links should be one lessthan the ingoing logical links. If vs is neither the source northe destination, the two numbers are equal. The constraintin Eq. (17) requires that the overall rerouted traffic loadon each logical link does not exceed its usable bandwidth.Eq. (18) specifies that the rerouted traffic load on the backuppaths for ei;j does not exceed li;j. Ideally, all the traffic loadof ei;j should be rerouted. In some cases, the network doesnot have enough bandwidth, and hence the overall reroutedtraffic load of ei;j may be lower than li;j as shown in Eq. (19)

minimize D (15)

subject to

8ei;j 2 EL 8es;t 2 EL 1 � k � N

X8t:es;t2EL

xi;j;ks;t �X

8t:et;s2ELxi;j;kt;s ¼

1 i ¼ s�1 i ¼ t0 otherwise

8<: (16)

Xei;j2EL

XNk¼1

xi;j;ks;t rki;j � cs;t � ls;t (17)

XNk¼1

rki;j � li;j (18)

xi;j;ks;t 2 f0; 1g; 0 � rki;j � li;j: (19)

4.3 An AlgorithmBackup paths are computed by routers. Routers in high speedIP networks need to forward packets very quickly. Usingtoo much CPU time for recovery computation interfereswith forwarding the packets which are not affected byfailures. The above formulation is a mixed integer nonlinearprogramming problem which is NP-hard. Therefore, routerscannot compute backup paths by directly solving thisproblem. Instead, we propose a heuristic-based multi-roundalgorithm SelectBP to efficiently solve the problem. The basicidea is to select backup paths one by one until there is nousable bandwidth or no logical link can have more backuppaths. We use Di;j defined in Eq. (13) as the weight of ei;j. Ineach round, the algorithm SelectBP picks out the logical linkei;j with the largest weight, and then selects a backup path forei;j and determines the rerouted traffic load. Suppose ei;jalready has k� 1 backup paths. Adding one more backuppath reduces traffic disruption Di;j by Di;j shown in Eq. (20).The heuristic of the algorithm SelectBP is that it reduces asmuch Di;j as possible in each round

Di;j ¼ pi;jrki;j 1� P Bki;jjei;j

� �� �: (20)

We develop an algorithm MaxWeightPath to chooseBki;j and determine rki;j to maximize Di;j. The basic idea is

similar to Dijkstra’s algorithm for calculating the shortestpath. Starting from node vi, the algorithm gradually addslogical links to expand the backup path. The rerouted trafficload is the smaller one between the unprotected traffic load ofei;j and the usable bandwidth of the backup path. Thealgorithm MaxWeightPath operates similar to Dijkstra’salgorithm, and thus has the same computational complexityOððjELj þ jVLjÞ logðjVLjÞÞ as Dijkstra’s algorithm. Since thenetwork has jELj logical links and each of them can have up toN backup paths, the algorithm SelectBP invokes thealgorithm MaxWeightPath at most N jELj times. Therefore,the computational complexity of the algorithm SelectBP isOðN jELjðjELj þ jVLjÞ logðjVLjÞÞ in the worst case. The detailedpseudocode of the two algorithms is shown in Appendix Bwhich can be found in the online supplemental material.

5 PERFORMANCE EVALUATION

We evaluate the performance of the proposed approachand compare it with other backup path-based approaches.

5.1 Simulation Setup

5.1.1 Network TopologyThe simulation is based on four real ISP networks with bothphysical and logical topologies, i.e., ChinaNet2,3, Level34,

2. http://www.chinatelecomusa.com/content_images/NationalFiber_Full.jpg

3. http://www.chinatelecomusa.com/content_images/ChinaNet_Full.jpg

4. http://www.level3.com/en/About-Us/~/media/Assets/maps/level_3_network_map.ashx

IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 7, JULY 20141664

Qwest5, and XO.6 We use the PoP-level logical topology,where nodes correspond to cities. Table 2 summarizes thephysical and logical topologies in the four networks. Due tolack of lightpath information, we build the topologymapping with the method in [20] to minimize the numberof fiber links shared by logical links.

5.1.2 IP Layer ConfigurationThe logical link capacity of Qwest and XO networks is set tothe value provided in their logical topologies. For China-Net and Level3, we use the method in [24] to assign thelogical link capacity. This method assumes that high degreenodes are Level-1 PoP. The logical links between Level-1PoP have high capacity (10Gb/s) and other logical linkshave low capacity (2.5 Gb/s), which match the recent ISPcase studies [25]. Similar to [17], we use the gravity modelto generate synthetic traffic demands. This methodassumes that the incoming traffic at a PoP is proportionalto the combined capacity of its outgoing links. The averagelogical link utilization of generated traffic is varied from5 percent to 40 percent in increments of 5 percent. We use40 percent as the upper bound because ISPs usuallyupgrade their infrastructure when the logical link utiliza-tion exceeds 40 percent [24], [25]. Finally, we use themethod in [26] to optimize the link cost based on the linkcapacity and traffic demands. Each logical topology adoptsthe shortest path routing calculated based on the optimizedlink cost.

5.1.3 Failure ScenariosThe link failure scenarios are set according to the Internetmeasurement [14]. We randomly choose 2.5 percent logicallinks to be high failure links. Their failure probability isbetween 0.5 percent and 0.1 percent and satisfies thepower-law distribution with parameter �0.73. For otherlogical links, their failure probability is between 0.1 percentand 0.01 percent and satisfies the power-law distributionwith parameter �1.35. The failure probability of fiber linksis between 0.05 percent and 0.01 percent and satisfies thepower-law distribution with parameter �1. In the simula-tion, we use 100 failure probability settings and eachsimulation is run 1,000 times for each failure probabilitysetting. Each time, we randomly choose one logical linkand determine if it is an independent failure or a correlatedfailure based on the failure probability. If it is a correlatedfailure, we fail one fiber link which is shared by this logicallink and other logical links. The logical links embedded onthe failed fiber link all fail.

5.1.4 AlgorithmsWe compare our algorithms with Not-via [27] and PSRLG-based Diverse Routing (DR) with disjointness constraint[13]. Not-via is an IP fast-rerouting (IPFRR) techniquewidely deployed in the Internet. DR uses a parameter pto specify the failure probability of logical links whenthe underlying fiber link fails. We set p to three typicalvalues 0.2, 0.5, and 0.8. In summary, we compare ouralgorithms with five algorithms as follows.

. Not-via: Not-via built on the independent model.

. Not-via+SRLG: Not-via built on the SRLG model.

. DR (0.2): DR with its parameter p of 0.2.

. DR (0.5): DR with its parameter p of 0.5.

. DR (0.8): DR with its parameter p of 0.8.

5.2 Reliability of Backup PathsWe first investigate the reliability of the backup paths. Inour algorithm SelectBP, the logical link capacity is set toinfinity and the parameter N is 1. Hence, the algorithmchooses the backup path with the lowest failure probabilityfor each logical link. It is possible that a logical link may nothave a backup path, because the network becomes twoconnected components after removing the logical link.This may happen to all backup path-based protectionapproaches. In a test case, if a failed logical link has a livebackup path, this logical link failure can be recovered. Thefailure recovery rate is the percentage of recovered logicallink failures and is used as a performance metric.

The average failure recovery rate across 100,000 testcases is shown in Fig. 3. We highlight three features. First,our algorithm SelectBP outperforms the other fivealgorithms in all four networks. This shows that the PCFmodel is effective for finding reliable backup paths. Not-via ignores the correlation between logical link failures,and thus backup paths may traverse some failed logicallinks. Not-via+SRLG may remove some useful logical linksand even disconnect the topology. Consequently, somelogical links may not have backup paths. Second, unlikeSelectBP, the performance of the other five algorithmsis not consistent across the four networks. For example,

5. http://www.qwest.com/largebusiness/enterprisesolutions/networkMaps/

6. http://www.xo.com/about/network/Pages/maps.aspx

TABLE 2Real ISP Topologies Used for Evaluation

Fig. 3. Average failure recovery rate. (a) ChinaNet. (b) Level3. (c) Qwest.(d) XO.

ZHENG ET AL.: CROSS-LAYER APPROACH FOR MINIMIZING ROUTING DISRUPTION IN IP NETWORKS 1665

Not-via+SRLG is the second best in Qwest and XO, whileit is the worst in ChinaNet. Similarly, DR (0.8) is betterthan DR (0.2) and DR (0.5) in Qwest and XO, but it is worsethan them in ChinaNet and Level3. Third, the parameterp strongly affects the performance of DR, and it is difficultto choose an appropriate p to achieve good performance inall networks.

The overall result for the four networks is shown inFig. 4. On average, the reliability of the backup pathschosen by our approach is at least 18 percent higher thanthat achieved by the best of the other five algorithms, whichvaries from scenario to scenario.

5.3 Routing Disruption and Logical Link OverloadNext, we consider the traffic load and bandwidth con-straint. Parameter N in the algorithm SelectBP is variedfrom 1 to 5. We define the following two metrics formeasuring the benefit and negative impact.

. Routing disruption: For a failed logical link ei;j, if abackup path does not contain any failed or over-loaded logical link, the traffic rerouted by it isrecovered. Suppose the overall traffic load of failedlogical links is T and the recovered traffic load is Tr,the routing disruption is defined as T�Tr

T . Theoptimal value (0 percent) means that no traffic isdisrupted by failures.

. Overload rate: In a test case, we count the logical linkstraversed by the rerouted traffic and denote thisnumber as L. We also count the overloaded onesamong them. A logical link is overloaded if itscapacity is smaller than the traffic load on it,including its own traffic and the rerouted traffic.Suppose there are Lo overloaded logical links. Theoverload rate is defined as Lo

L , and it quantifies thenegative impact caused by the rerouted traffic.

The average routing disruption is shown in Fig. 5. Wehighlight four important aspects of the simulation results.First, using more backup paths can reduce the routingdisruption, especially when the logical link utilization ishigh. The performance of SelectBP does not vary muchwhen N � 2 and thus we only show the result when N ¼ 1and N ¼ 2. It means that two backup paths should beadequate for protecting a logical link. Second, SelectBPoutperforms the other five algorithms under differentlogical link utilizations in each network. Third, the perfor-mance of the other five algorithms is not consistent acrossthe four networks, which is similar to the failure recoveryrate in Fig. 3. Our approach is better than the other five in

adapting to different networks and logical link utilizations.Fourth, the routing disruption increases as the logical linkutilization increases due to lack of usable bandwidth. Forexample, if the logical link utilization is 25 percent, theusable bandwidth is 3 times the traffic load. However, whenit increases to 40 percent, the usable bandwidth decreases to1.5 times the traffic load. A small increase in the traffic loadmakes rerouting much more difficult.

The overall result for the four networks is shown inFig. 6. On average, the routing disruption of our approachis at least 22 percent lower that that of the other fivealgorithms.

Next, we evaluate the overload rate under differentlogical link utilizations, which is shown in Fig. 7. SelectBPavoids logical link overload with two techniques, i.e., usinglogical links with usable bandwidth and controlling thererouted traffic load. The other five algorithms may havequite high overload rate when the logical link utilization isabove 20 percent.

We also measure the maximum logical link utilizationon recovery paths, and show the result when the averagelogical link utilization is 40 percent in Table 3. Byconsidering the bandwidth constraint, the maximum

Fig. 4. Overall failure recovery rate for the four networks.

Fig. 5. Average routing disruption under different logical link utilizations.(a) ChinaNet. (b) Level3. (c) Qwest. (d) XO.

Fig. 6. Overall routing disruption for the four networks.

IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 7, JULY 20141666

logical link utilization in SelectBP is 100 percent, whichmeans that SelectBP fully utilizes the bandwidth anddoes not cause logical link overload. The other fivealgorithms do not consider the bandwidth constraint, andhence some logical links may be used by many backuppaths at the same time. As a result, the maximum logicallink utilization in these algorithms is quite high.

6 RELATED WORK

There are three categories of existing works that are relatedto our approach.

6.1 Backup Path-Based IP Link ProtectionMost prior works consider backup path selection as aconnectivity problem and mainly focus on finding backuppaths to bypass the failed IP links [4], [7], [8], [9], [13], and[27]. However, they ignore the fact that a backup path maynot have enough bandwidth. Consequently, the reroutedtraffic may cause severe link overload on an IP backbone asobserved by Iyer et al. [16]. A recent work [10] addresses thelink overload problem in the backup path selection, but itaims at minimizing the bandwidth allocated to backuppaths rather than minimizing routing disruption. All thesemethods use IP layer information for backup path selec-tion, consider logical link failures as independent events,and select one backup path for each logical link. Differentfrom these methods, we develop a PCF model to reflect theprobabilistic correlation between logical link failures, andsplit the rerouted traffic onto multiple backup paths tominimize routing disruption and avoid link overload.

6.2 Correlation between the Logical andPhysical Topologies

Some works on IP-over-WDM networks consider thecorrelation between the logical and physical topologies.

Most of them focus on the survivable routing problem [20],[21], [28], and [29], i.e., building the mapping betweenlogical and fiber links to minimize the impact of fiber linkfailures on logical links. Lee et al. [22], [23] showed that thereliability of IP layer is strongly affected by the topologymapping. However, these works do not address theproblem of selecting backup paths to protect IP links.Moreover, they do not model the correlation betweenlogical link failures as is done in our PCF model. Cui et al.[30] considered correlated failures in backup path alloca-tion for overlay networks. However, they only use overlaylayer information, while our approach is based on a cross-layer design. Moreover, they aim at finding reliable backuppaths; whereas our objective is to minimize routingdisruption. A preliminary version [31] of the paper alsoconsiders the topology mapping, but it is different in twoaspects. First, the PCF model considers both independentand correlated logical link failures, whereas the model in[31] only considers correlated failures. Second, each logicallink is protected by multiple backup paths in this paper,but protected by single backup path in [31].

6.3 Multipath Routing and Bandwidth AllocationQuality-of-Service (QoS) routing protocols [32], [33], [34],and [35] use multiple paths between a source-destinationpair to achieve traffic engineering goals, e.g., minimizingthe maximal link utilization. Kodialam et al. [36] proposedan algorithm for dynamic routing of bandwidth guaran-teed tunnels. However, they do not consider the correlationbetween logical link failures. There are few recoveryapproaches that are built on multiple recovery paths. Theapproach in [37] aims at minimizing the bandwidthreserved for backup paths. It only uses IP layer informationfor backup path selection and assumes that the network hasa single logical link failure. R3 [17] reroutes traffic withmultiple paths and the method in [38] jointly addressesfailure recovery and traffic engineering in multipathrouting. They focus on traffic engineering goals ratherthan minimizing routing disruption. Moreover, they ignorethe correlation between logical link failures and considerbackup paths to have the same reliability.

7 CONCLUSION

The commonly used independent and SRLG models ignorethe correlation between the optical and IP layer topologies.As a result, they do not accurately reflect the correlationbetween logical link failures and may not select reliablebackup paths. We propose a cross-layer approach forminimizing routing disruption caused by IP link failures.

Fig. 7. Overload rate under different logical link utilizations. (a) ChinaNet.(b) Level3. (c) Qwest. (d) XO.

TABLE 3Maximum Logical Link Utilization When the Average Logical

Link Utilization is 40 Percent

ZHENG ET AL.: CROSS-LAYER APPROACH FOR MINIMIZING ROUTING DISRUPTION IN IP NETWORKS 1667

We develop a probabilistically correlated failure (PCF)model to quantify the impact of IP link failure on thereliability of backup paths. With this model, we propose analgorithm to minimize the routing disruption by choosingmultiple reliable backup paths to protect each IP link. Theproposed approach ensures that the rerouted traffic doesnot cause logical link overload, even when multiple logicallinks fail simultaneously. We evaluate our approach usingreal ISP networks with both optical and IP layer topologies.Experimental results show that two backup paths areadequate for protecting a logical link. Compared withexisting works, the backup paths selected by our methodare at least 18 percent more reliable and the routingdisruption is reduced by at least 22 percent. Moreover, theproposed approach prevents logical link overload causedby the rerouted traffic.

REFERENCES

[1] Q. Zheng, G. Cao, T.L. Porta, and A. Swami, ‘‘Optimal Recoveryfrom Large-Scale Failures in IP Networks,’’ in Proc. IEEE ICDCS,2012, pp. 295-304.

[2] A. Bremler-Barr, Y. Afek, H. Kaplan, E. Cohen, and M. Merritt,‘‘Restoration by Path Concatenation: Fast Recovery of MPLsPaths,’’ in Proc. ACM PODC, 2001, pp. 43-52.

[3] V. Sharma and F. Hellstrand, Framework for MPLS-BasedRecovery, RFC 3469, 2003.

[4] M. Shand and S. Bryant, IP Fast Reroute Framework, RFC5714,Jan. 2010.

[5] P. Francois, C. Filsfils, J. Evans, and O. Bonaventure, ‘‘AchievingSub-Second IGP Convergence in Large IP Networks,’’ ACMSIGCOMM Comput. Commun. Rev., vol. 35, no. 3, pp. 35-44,July 2005.

[6] F. Giroire, A. Nucci, N. Taft, and C. Diot, ‘‘Increasing theRobustness of IP Backbones in the Absence of Optical LevelProtection,’’ in Proc. IEEE INFOCOM, 2003, pp. 1-11.

[7] A. Kvalbein, A.F. Hansen, T. Cicic, S. Gjessing, and O. Lysne,‘‘Fast IP Network Recovery Using Multiple Routing Configura-tions,’’ in Proc. IEEE INFOCOM, 2006, pp. 1-11.

[8] S. Kini, S. Ramasubramanian, A. Kvalbein, and A.F. Hansen,‘‘Fast Recovery from Dual Link Failures in IP Networks,’’ in Proc.IEEE INFOCOM, 2009, pp. 1368-1376.

[9] M. Hou, D. Wang, M. Xu, and J. Yang, ‘‘Selective Protection: ACost-Efficient Backup Scheme for Link State Routing,’’ in Proc.IEEE ICDCS, 2009, pp. 68-75.

[10] M. Johnston, H.-W. Lee, and E. Modiano, ‘‘A Robust Optimiza-tion Approach to Backup Network Design with Random Fail-ures,’’ in Proc. IEEE INFOCOM, 2011, pp. 1512-1520.

[11] E. Oki, N. Matsuura, K. Shiomoto, and N. Yamanaka, ‘‘A DisjointPath Selection Scheme with Shared Risk Link Groups in GMPLSNetworks,’’ IEEE Commun. Lett., vol. 6, no. 9, pp. 406-408,Sept. 2002.

[12] L. Shen, X. Yang, and B. Ramamurthy, ‘‘Shared Risk Link Group(SRLG)-Diverse Path Provisioning Under Hybrid Service LevelAgreements in Wavelength-Routed Optical Mesh Networks,’’ Proc.IEEE/ACM Trans. Netw., vol. 13, no. 4, pp. 918-931, Aug. 2005.

[13] H.-W. Lee and E. Modiano, ‘‘Diverse Routing in Networkswith Probabilistic Failures,’’ in Proc. IEEE INFOCOM, 2009,pp. 1035-1043.

[14] A. Markopoulou, G. Iannaccone, S. Bhattacharyya, C.-N. Chuah,Y. Ganjali, and C. Diot, ‘‘Characterization of Failures in anOperational IP Backbone Network,’’ IEEE/ACM Trans. Netw.,vol. 16, no. 4, pp. 749-762, Aug. 2008.

[15] D. Turner, K. Levchenko, A.C. Snoeren, and S. Savage,‘‘California Fault Lines: Understanding the Causes and Impactof Network Failures,’’ in Proc. ACM SIGCOMM, 2010, pp. 315-326.

[16] S. Iyer, S. Bhattacharyya, N. Taft, and C. Diot, ‘‘An Approach toAlleviate Link Overload as Observed on an IP Backbone,’’ inProc. IEEE INFOCOM, 2003, pp. 406-416.

[17] Y. Wang, H. Wang, A. Mahimkar, R. Alimi, Y. Zhang, L. Qiu, andY.R. Yang, ‘‘R3: Resilient Routing Reconfiguration,’’ in Proc.ACM SIGCOMM, 2010, pp. 291-302.

[18] Q. Zheng and G. Cao, ‘‘Minimizing Probing Cost and AchievingIdentifiability in Probe Based Network Link Monitoring,’’ IEEETrans. Comput., vol. 62, no. 3, pp. 510-523, Mar. 2013.

[19] E. Rosen, A. Viswanathan, and R. Callon, Multiprotocol LabelSwitching Architecture, RFC 3031, Jan. 2001.

[20] E. Modiano and A. Narula-Tam, ‘‘Survivable Lightpath Routing:A New Approach to the Design of WDM-Based Networks,’’ IEEEJ. Sel. Areas Commun., vol. 20, no. 4, pp. 800-809, May 2002.

[21] A. Todimala and B. Ramamurthy, ‘‘A Scalable Approach forSurvivable Virtual Topology Routing in Optical WDM Networks,’’IEEE J. Sel. Areas Commun., vol. 25, no. 6, pp. 63-69, Aug. 2007.

[22] K. Lee and E. Modiano, ‘‘Cross-Layer Survivability in WDM-Based Networks,’’ in Proc. IEEE INFOCOM, 2009, pp. 1017-1025.

[23] K. Lee, H.-W. Lee, and E. Modiano, ‘‘Reliability in LayeredNetworks with Random Link Failures,’’ in Proc. IEEE INFOCOM,2010, pp. 1-9.

[24] S. Kandula, D. Katabi, B. Davie, and A. Charny, ‘‘Walking theTightrope: Responsive Yet Stable Traffic Engineering,’’ in Proc.ACM SIGCOMM, 2005, pp. 253-264.

[25] J. Guichard, F. le Faucheur, and J.P. Vasseur, Definitive MPLSNetwork Design. Indianapolis, IN, USA: Cisco Press, 2005.

[26] B. Fortz and M. Thorup, ‘‘Internet Traffic Engineering by Optimiz-ing OSPF Weights,’’ in Proc. IEEE INFOCOM, 2000, pp. 519-528.

[27] S. Bryant, M. Shand, and S. Previdi, IP Fast Reroute Using Not-viaAddresses, Internet draft, 2011. [Online]. Available: http://tools.ietf.org/html/draft-ietf-rtgwg-ipfrr-notvia-addresses-03.

[28] M. Kurant and P. Thiran, ‘‘On Survivable Routing of MeshTopologies in IP-Over-WDM Networks,’’ in Proc. IEEE INFOCOM,2005, pp. 1106-1116.

[29] K. Thulasiraman, M.S. Javed, and G.L. Xue, ‘‘Circuits/CutsetsDuality and a Unified Algorithmic Framework for SurvivableLogical Topology Design in IP-over-WDM Optical Networks,’’ inProc. IEEE INFOCOM, 2009, pp. 1026-1034.

[30] W. Cui, I. Stoica, and R.H. Katz, ‘‘Backup Path Allocation Basedon a Correlated Link Failure Probability Model in OverlayNetworks,’’ in Proc. IEEE ICNP, 2002, pp. 236-245.

[31] Q. Zheng, J. Zhao, and G. Cao, ‘‘A Cross-Layer Approach for IPNetwork Protection,’’ in Proc. IEEE/IFIP DSN, 2012, pp. 1-12.

[32] A. Orda and A. Sprintson, ‘‘Efficient Algorithms for ComputingDisjoint QoS Paths,’’ in Proc. IEEE INFOCOM, 2004, pp. 727-738.

[33] Y. Ohara, S. Imahori, and R.V. Meter, ‘‘MARA: MaximumAlternative Routing Algorithm,’’ in Proc. IEEE INFOCOM, 2009,pp. 298-306.

[34] S. Misra, G. Xue, and D. Yang, ‘‘Polynomial Time Approxima-tions for Multi-Path Routing with Bandwidth and DelayConstraints,’’ in Proc. IEEE INFOCOM, 2009, pp. 558-566.

[35] W. Zhang, J. Tang, C. Wang, and S. de Soysa, ‘‘Reliable AdaptiveMultipath Provisioning with Bandwidth and Differential DelayConstraints,’’ in Proc. IEEE INFOCOM, 2010, pp. 1-9.

[36] M. Kodialam and T.V. Lakshman, ‘‘Minimum InterferenceRouting with Applications to MPLS Traffic Engineering,’’ inProc. IEEE INFOCOM, 2000, pp. 884-893.

[37] R. Banner and A. Orda, ‘‘Designing Low-Capacity Backup Net-works for Fast Restoration,’’ in Proc. IEEE INFOCOM, 2010, pp. 1-9.

[38] M. Suchara, D. Xu, R. Doverspike, D. Johnson, and J. Rexford,‘‘Network Architecture for Joint Failure Recovery and TrafficEngineering,’’ in Proc. ACM SIGMETRICS, 2011, pp. 97-108.

Qiang Zheng received the BS degree in computerscience from Nankai University, Tianjin, China, in2004, the ME degree in computer science fromChinese Academy of Sciences, Beijing, China, in2007, and the PhD degree in computer scienceand engineering from The Pennsylvania StateUniversity, State College, PA, USA, in 2012.His research interests include network failuredetection, localization, and fast recovery. He is aStudent Member of the IEEE.

IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 7, JULY 20141668

Guohong Cao received the BS degree incomputer science from Xian Jiaotong University,Shaanxi, China, and the PhD degree in computerscience from the Ohio State University, Columbus,OH,USA, in 1999. Since then, he has beenwith theDepartment of Computer Science and Engineeringat the Pennsylvania State University, State Col-lege, PA, USA where he is currently a Professor.He has published more than 200 papers in theareas of wireless networks, wireless security,vehicular networks, wireless sensor networks,

cache management, and distributed fault tolerant computing. He hasserved on the editorial board of IEEE Transactions on Mobile Computing,IEEE Transactions on Wireless Communications, IEEE Transactions onVehicular Technology, and has served on the organizing and technicalprogram committees of many conferences, including the TPC Chair/Co-Chair of IEEE SRDS’2009, MASS’2010, and INFOCOM’2013. Hewas a recipient of the NSF CAREER award in 2001. He is a Fellow ofthe IEEE.

Thomas F. La Porta is the William E. LeonhardChair Professor in the Computer Science andEngineering Department at Penn State, PA,USA. He is the Director of the Networking andSecurity Research Center at Penn State. Prior tojoining Penn State, Dr. La Porta was with BellLaboratories since 1986. He was the Director ofthe Mobile Networking Research Department inBell Laboratories, Lucent Technologies wherehe led various projects in wireless and mobilenetworking. He is a Bell Labs Fellow and he

received the Bell Labs Distinguished Technical Staff Award in 1996. Healso won a Thomas Alva Edison Patent Awards in 2005 and 2009.Dr. La Porta was the founding Editor-in-Chief of the IEEE Transactionson Mobile Computing. He served as Editor-in-Chief of IEEE PersonalCommunications Magazine. He was the Director of Magazines for theIEEE Communications Society and was on its Board of Governors forthree years. He has published numerous papers and holds 35 patents.He was an adjunct member of faculty at Columbia University for 7 yearswhere he taught courses on mobile networking and protocol design.He is a Fellow of the IEEE.

Ananthram Swami received the BTech degreefrom IIT-Bombay, Maharashtra, India, the MSdegree from Rice University, Houston, TX, USAand thePhDdegree from theUniversity ofSouthernCalifornia (USC), Los Angeles, CA, USA, all inelectrical engineering. He is with the U.S. ArmyResearch Laboratory (ARL) as the Army’s SeniorResearch Scientist (ST) for Network Science. He isan ARL Fellow. He has held positions with UnocalCorporation, the University of Southern California(USC), CS-3, and Malgudi Systems. He was a

Statistical Consultant to the California Lottery, developed a MATLAB-based toolbox for non-Gaussian signal processing, and has held visitingfaculty positions at INP, Toulouse. His research interests are in the broadarea of network science, with an emphasis on applications in compositetactical networks. He is a Fellow of the IEEE.

. For more information on this or any other computing topic,please visit our Digital Library at www.computer.org/publications/dlib.

ZHENG ET AL.: CROSS-LAYER APPROACH FOR MINIMIZING ROUTING DISRUPTION IN IP NETWORKS 1669