Abstract:Anomaly detection is the first step with a challenging task of securing a communication network, as the anomalies may indicate suspicious behaviors, attacks, network malfunctions, or failures. In this paper, we address the problem of not only detecting different anomalies, such as volume based (e.g., DDoS or Flash crowd) and spatial based (e.g., network scan), that arise simultaneously in the wild but also of attributing the anomalous point to a single-anomaly event causing it. Besides, we also tackle the problem of low-detection accuracy caused by the phenomenon of traffic drift. To this end, a novel adaptive profile-based anomaly detection scheme is proposed. More specifically, a more comprehensive metrics set is defined from the dimensions of temporal, spatial, category, and intensity to compose IP traffic behavior characteristic spectrum for fine-grained traffic characterization. Then, the digital signature matrix obtained by using the ant colony optimization (ACO) algorithm is applied to construct the baseline profile of the normal traffic behavior. Anomalous points are identified and analyzed by using confidence bands and a generic clustering technique, respectively. Finally, a lightweight updating strategy is applied to reduce the number of false positives. Real-world data of China Education Research Network backbone and synthetic data are collected to verify our proposal. The experimental results demonstrate that our approach provides a fine-grained behavior description ability and has significantly increased the detection accuracy compared with other similar alternatives.

A2C: Anti-Attack Counters for Traffic Measurement

Flow Anomaly Telemetry Driven by Programmable Data Plane

Accurate and Efficient Traffic Monitoring Using Adaptive Non-Linear Sampling Method

A Memory-Compact and Fast Sketch for Online Tracking Heavy Hitters in a Data Stream

A Hybrid Sampling Approach for Network Flow Monitoring.

Adaptive Sampling Measurement for High Speed Network Traffic Flow

ANLS: Adaptive Non-Linear Sampling Method for Accurate Flow Size Measurement.

A Sampling Method for Intrusion Detection System

Highly Compact Virtual Counters For Per-Flow Traffic Measurement Through Register Sharing

Construction of Two Statistical Anomaly Features for Small-Sample APT Attack Traffic Classification

A novel spread estimation based abnormal flow detection in high-speed networks

A Double-Sampling And Hold Based Approach For Accurate And Efficient Network Flow Monitoring

An Adaptive Profile-Based Approach for Detecting Anomalous Traffic in Backbone.

An Efficient K-Persistent Spread Estimator for Traffic Measurement in High-Speed Networks

An Efficient Adaptive Denoising Sketch for Per-flow Traffic Measurement

A real-time and reliable approach to detecting traffic variations at abnormally high and low rates

Time Stratified Adaptive Packet Sampling Based on Traffic Load

DAP-Sketch: An accurate and effective network measurement sketch with Deterministic Admission Policy

S3: Smart selection of sampling function for passive network measurement

A Temporal Correlation and Traffic Analysis Approach for APT Attacks Detection.

Packet-level Adaptive Sampling on Multi-Fluctuation Scale Traffic