Abstract:Network always suffers from the traffic anomaly such as router rate change, device restart or the worm attack. The early detection of unusual anomaly in the network is a key to fast recover and avoidance of future serious problem to provide a stable network transmission. In this paper we present a statistical approach to analysis the distribution of network traffic to identify the normal network traffic behavior. We adapt the EM algorism to estimate the distribution parameter of Gaussian mixture distribution model. If only there is a statistical signature of unusual fluctuation or change in the network traffic an alarm will be triggered. We adapt the time series analysis of the statistical analysis result. Up bound and low bound will be defined through the analysis. The exceeding of the bound will be the signal of traffic anomaly. Another time series analysis approach also can reflect the fluctuation of network with the crossover of two indicator lines called K line and D line. These two indicator lines are some think like the mean value of the historical data in a time slice with one more sensitive to the change of the new coming data and another not. The approach three-MACD indicator approach is like the K D approach but more blunt to the unusual fluctuation of network traffic which can submit an alarm more correctly.

Detection of network traffic anomaly based on instantaneous parameters analysis

Detection of Network Traffic Anomaly on Instantaneous Frequency Analysis

A Time-Frequency Detecting Method for Network Traffic Anomalies

A scheme for fast network traffic anomaly detection

Network Anomaly Detection Based on Traffic Prediction

A Real-Time Detection Approach to Network Traffic Anomalies in Communication Networks

Detection Network Anomalies Based on Packet and Flow Analysis

A Detection Algorithm to Anomaly Network Traffic Based on Spectral Kurtosis Analysis

Traffic Anomaly Detection Using Multi-Flows and Multi-Parameters in Backbone Network

Method of Detecting Network Anomaly on Multi-Time-scale

Multi‐scale Anomaly Detection for High‐speed Network Traffic

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

Algorithm of Traffic Anomaly Detection Based on Steady Model

Fast Network Traffic Anomaly Detection Based on Iteration

A Haar Transform-Based Detection Approach to Network Traffic Anomalies in Power Telecommunication Access Networks

Network Anomaly Detection Based on Statistical Approach and Time Series Analysis

Analyzing and Visualizing Anomalies and Events in Time Series of Network Traffic

Packet Payload Based Anomalous Network Intrusion Detection

Network Traffic Anomaly Detection Based on Sliding Window

Anomaly Detection of Network Traffic Based on Wavelet Packet

High-speed anomaly traffic detection based on staged frequency domain features