Abstract:Detecting traffic anomalies is essential. for diagnosing attacks. High-Speed Backbone Networks (HSBN) require Traffic Anomaly Detection Systems (TADS) which are accurate (high detection and low false positive rates) and efficient. The proposed approach utilizes entropy as traffic distributions metric over some traffic dimensions. An efficient algorithm, having low computational and space complexity, is used to estimate entropy. Entropy values over all dimensions are collected to form a detection vector for every sliding window. One class support vector machine classifies all detection vectors into one of two groups: abnormal vectors and normal vectors. A Multi-Windows Correlation Algorithm (MWCA) calculates comprehensive anomaly scores observed in a sequence of windows in order to reduce false positive rates and obtain high detection rates. Some real-world traffic traces have been used to validate and evaluate the efficiency and accuracy of this system through three experiments. In Experiment 1, the estimating algorithm of entropy which costs less memory and runs faster than traditional algorithms is more suitable for detection anomalies. In Experiment 2, the classification and correlation algorithms can improve the detection accuracy significantly. Experiment 3 compares the subject system and three well-known systems. Ours system is the most accurate one. Those results have indicated that the proposed system significantly improves the accuracy and efficiency.

Multi‐scale Anomaly Detection for High‐speed Network Traffic

An Continuous Wavelet Transform-Based Detection Approach to Traffic Anomalies

The scale self-adjusting multi-resolution network traffic anomaly detection

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

A Wavelet-Based Detection Approach to Traffic Anomalies

Anomaly Detection of Network Traffic Based on Wavelet Packet

Detection Network Anomalies Based on Packet and Flow Analysis

A Time-Frequency Detecting Method for Network Traffic Anomalies

Method of Detecting Network Anomaly on Multi-Time-scale

Network Traffic Anomaly Detection Method Based on Multi scale Residual Feature

Network Anomaly Detection Based On Multi-Scale Dynamic Characteristics Of Traffic

Traffic Anomaly Detection Using Multi-Flows and Multi-Parameters in Backbone Network

Survey of Research on Anomaly Detection of Wavelet Analysis Based on Network Traffic

Distributed Stealthy Traffic Anomaly Detection Based on Wavelet Packet Analysis

A Detection Algorithm to Anomaly Network Traffic Based on Spectral Kurtosis Analysis

A multi-channel anomaly detection method with feature selection and multi-scale analysis

Research on the detection of abnormal traffic for multi-channel network

A Traffic Anomaly Detection Approach in Communication Networks for Applications of Multimedia Medical Devices

Traffic Anomaly Detection in Backbone Networks Using Classification of Multidimensional Time Series of Entropy

Detection and Characterization of Network Anomalies in Large-Scale RTT Time Series

Detecting Distributed Network Traffic Anomaly with Network-Wide Correlation Analysis