Abstract:Detecting traffic anomalies is essential. for diagnosing attacks. High-Speed Backbone Networks (HSBN) require Traffic Anomaly Detection Systems (TADS) which are accurate (high detection and low false positive rates) and efficient. The proposed approach utilizes entropy as traffic distributions metric over some traffic dimensions. An efficient algorithm, having low computational and space complexity, is used to estimate entropy. Entropy values over all dimensions are collected to form a detection vector for every sliding window. One class support vector machine classifies all detection vectors into one of two groups: abnormal vectors and normal vectors. A Multi-Windows Correlation Algorithm (MWCA) calculates comprehensive anomaly scores observed in a sequence of windows in order to reduce false positive rates and obtain high detection rates. Some real-world traffic traces have been used to validate and evaluate the efficiency and accuracy of this system through three experiments. In Experiment 1, the estimating algorithm of entropy which costs less memory and runs faster than traditional algorithms is more suitable for detection anomalies. In Experiment 2, the classification and correlation algorithms can improve the detection accuracy significantly. Experiment 3 compares the subject system and three well-known systems. Ours system is the most accurate one. Those results have indicated that the proposed system significantly improves the accuracy and efficiency.

Network Anomaly Detection Using Time Series Analysis

Network Anomaly Detection Based on Statistical Approach and Time Series Analysis

Method of Detecting Network Anomaly on Multi-Time-scale

Analyzing and Visualizing Anomalies and Events in Time Series of Network Traffic

A Time-Frequency Detecting Method for Network Traffic Anomalies

A time-relevant network traffic anomaly detection approach

Survey of Research on Anomaly Detection of Wavelet Analysis Based on Network Traffic

A Detection Algorithm to Anomaly Network Traffic Based on Spectral Kurtosis Analysis

A Real-Time Detection Approach to Network Traffic Anomalies in Communication Networks

An Effective Method for Computer Network Anomaly Detection

Using Graph to Detect Network Traffic Anomaly

Detecting Distributed Network Traffic Anomaly with Network-Wide Correlation Analysis

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

Detecting DDoS Attacks Against Web Server Using Time Series Analysis

Anomaly detection application on IP backbone using time series forecast.

Traffic Model Analysis for Anomaly Detection

Behavior Pattern Mining from Traffic and Its Application to Network Anomaly Detection

Traffic Anomaly Detection in Backbone Networks Using Classification of Multidimensional Time Series of Entropy

PRACTICAL NETWORK ANOMALY DETECTION USING DATA MINING TECHNIQUES

Research on the detection of abnormal traffic for multi-channel network

Multiple Time Series Data Mining Approach of Large-Scale IP Network Abnormal Traffic Feature Analysis