Abstract:Anomaly detection is the first step with a challenging task of securing a communication network, as the anomalies may indicate suspicious behaviors, attacks, network malfunctions, or failures. In this paper, we address the problem of not only detecting different anomalies, such as volume based (e.g., DDoS or Flash crowd) and spatial based (e.g., network scan), that arise simultaneously in the wild but also of attributing the anomalous point to a single-anomaly event causing it. Besides, we also tackle the problem of low-detection accuracy caused by the phenomenon of traffic drift. To this end, a novel adaptive profile-based anomaly detection scheme is proposed. More specifically, a more comprehensive metrics set is defined from the dimensions of temporal, spatial, category, and intensity to compose IP traffic behavior characteristic spectrum for fine-grained traffic characterization. Then, the digital signature matrix obtained by using the ant colony optimization (ACO) algorithm is applied to construct the baseline profile of the normal traffic behavior. Anomalous points are identified and analyzed by using confidence bands and a generic clustering technique, respectively. Finally, a lightweight updating strategy is applied to reduce the number of false positives. Real-world data of China Education Research Network backbone and synthetic data are collected to verify our proposal. The experimental results demonstrate that our approach provides a fine-grained behavior description ability and has significantly increased the detection accuracy compared with other similar alternatives.

A BasisEvolution Framework for Network Traffic Anomaly Detection

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

An Adaptive Profile-Based Approach for Detecting Anomalous Traffic in Backbone.

A Real-Time Detection Approach to Network Traffic Anomalies in Communication Networks

Network Anomaly Detection Based on Traffic Prediction

Network Traffic Anomaly Detection Method Based on Multi scale Residual Feature

A Time-Frequency Detecting Method for Network Traffic Anomalies

A flow-based anomaly detection method using sketch and combinations of traffic features

A Flow-Based Anomaly Detection Method Using Entropy and Multiple Traffic Features

Detection Network Anomalies Based on Packet and Flow Analysis

Anomalous Trafifc Detection Based on Trafifc Behavior Characteristics

Anomaly Detections in Internet traffic Using Empirical Measures

A Detection Algorithm to Anomaly Network Traffic Based on Spectral Kurtosis Analysis

An Anomaly-Based Detection in Ubiquitous Network Using the Equilibrium State of the Catastrophe Theory

Traffic Anomaly Detection Using Multi-Flows and Multi-Parameters in Backbone Network

Traffic Anomaly Detection in Backbone Networks Using Classification of Multidimensional Time Series of Entropy

A Semi-Supervised Anomaly Network Traffic Detection Framework Via Multimodal Traffic Information Fusion

Research on the detection of abnormal traffic for multi-channel network

A scheme for fast network traffic anomaly detection

Towards A Multi-Layers Anomaly Detection Framework for Analyzing Network Traffic

A Human-in-the-Loop Anomaly Detection Architecture for Big Traffic Data of Cellular Network