Abstract:ABSTRACTDetecting distributed abnormal events has become an increasingly significant task for efficient network management and operation. However, it is still challenging to uncover these distributed behaviors in backbone networks because of the voluminous amount of noisy, high‐dimensional traffic data. In this paper, we present a novel system for detecting distributed abnormal events in backbone networks. The proposed system emphasizes on detecting distributed correlated abnormal events, which are caused by the same reason. In contrast, existing methods are not able to distinguish correlated abnormal events from the independent abnormal events. In our proposed system, a set of data mining techniques is used for modeling and detecting distributed correlated abnormal events by analyzing the traffic features. Specifically, traffic behavior representation is constructed to define and select traffic features for describing the traffic behaviors of interest, feature clustering is performed to group together similar transformations in each feature, behavioral data mining is employed to discover the most significant patterns in network interactions with respect to typical behavior, and behavior classification is used to expose the behaviors of interest. Experiment results using real traffic data present the effectiveness of our proposed methods for detecting distributed correlated abnormal events in the backbone network. Copyright © 2013 John Wiley & Sons, Ltd.

Large-scale IP Network Behavior Anomaly Detection and Identification Using Substructure-Based Approach and Multivariate Time Series Mining

Multiple Time Series Data Mining Approach of Large-Scale IP Network Abnormal Traffic Feature Analysis

Behavior Pattern Mining from Traffic and Its Application to Network Anomaly Detection

A Two-Stage Spatiotemporal Approach for Mining Traffic Flows Across Multiple Networks.

Using Graph to Detect Network Traffic Anomaly

Large-Scale Ip Network Flow-Level Abnormal Behavior Trends Analysis Using Combined Anomaly Grey Forecasting Algorithm

Intranet Anomaly Detection Method Using Flow Mining and Graph Mining

A Data Mining System for Distributed Abnormal Event Detection in Backbone Networks.

Detection and Characterization of Network Anomalies in Large-Scale RTT Time Series

Analyze Large-Scale Communication Network Behavior Through Mining TCP Control Segment Information

Anomaly Detection Based on Traffic Information Structure

Network Anomaly Detection Based on Frequent Sub-Graph Mining Approach and Association Analysis

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

Anomaly detection application on IP backbone using time series forecast.

Network Anomaly Detection Based On Multi-Scale Dynamic Characteristics Of Traffic

Multi‐scale Anomaly Detection for High‐speed Network Traffic

Traffic System Anomaly Detection Using Spatiotemporal Pattern Networks

IP traffic behavior characterization via semantic mining

Anomalous Trafifc Detection Based on Trafifc Behavior Characteristics

An Anomalies Detection Method Supplied for the IP Address Traceability

A Large-Scale Network Data Analysis Via Sparse and Low Rank Reconstruction