Abstract:We present a method to detect anomalies in time series of flow interaction patterns. There are many existing methods for anomaly detection in network traffic, such as the number of packets. However, there is no established method to detect anomalies in time series of flow interaction patterns that can be represented as complex network. First, based on the proposed multivariate flow similarity method on temporal locality, a complex network model (MFS-TL) is constructed to describe the interactive behaviors of traffic flows. After analyzing the relationships between MFS-TL characteristics, temporal locality window, and multivariate flow similarity critical threshold, an approach for parameters determination was established. Observed the evolution of MFS-TL characteristics, three non-deterministic correlations were defined for network states (i.e., normal or abnormal). Furthermore, intuitionistic fuzzy set (IFS) is introduced to quantify three non-deterministic correlations, and an anomaly detection method is put forward for single characteristic sequence. In order to build an objective IFS, we design a Gaussian distribution-based membership function with a variable hesitation degree. To determine the mapping of IFS's clustering intervals to network states, a distinction index is developed. Furthermore, an IFS ensemble method (IFSE-AD) is proposed to eliminate the impacts of the inconsistent about MFS-TL characteristic to network state and to improve detection performance. Finally, we carried out extensive experiments on some network traffic datasets, and the results validate the effectiveness of our method and demonstrate the superiority of IFSE-AD to state-of-the-art approaches.

Anomalous Trafifc Detection Based on Trafifc Behavior Characteristics

An Abnormal Network Traffic Detection Algorithm Based on Big Data Analysis

Research on the detection of abnormal traffic for multi-channel network

Behavior Pattern Mining from Traffic and Its Application to Network Anomaly Detection

Traffic features extraction and clustering analysis for abnormal behavior detection.

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

Anomaly Detection Based on Traffic Information Structure

A time-relevant network traffic anomaly detection approach

Multi-layer Anomaly Detection for Internet Traffic Based on Data Mining

A Time-Frequency Detecting Method for Network Traffic Anomalies

Network Anomaly Detection Based on Traffic Clustering with Group-Entropy Similarity

Analyzing and Visualizing Anomalies and Events in Time Series of Network Traffic

Using Intuitionistic Fuzzy Set for Anomaly Detection of Network Traffic from Flow Interaction.

Detection Network Anomalies Based on Packet and Flow Analysis

Multidimensional Clustering Based Anomaly Detection Research

A New Framework for Anomaly Detection Based on KNN-Distort in the Metro Traffic Flow

Algorithm of Traffic Anomaly Detection Based on Steady Model

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

On Monitoring and Predicting Mobile Network Traffic Abnormality

A flow-based anomaly detection method using sketch and combinations of traffic features

Real-time anomaly traffic monitoring based on dynamic k-NN cumulative-distance abnormal detection algorithm