Abstract:The randomness in network behaviors poses serious challenges for discovering abnormal patterns in network traffic flows. This paper presents a systematic approach for monitoring abnormal network traffic. The DFlow model is proposed to reduce the flow records and extract four features to capture the traffic patterns. The blind source separation method is applied to obtain the routine and abnormal behaviors from those features. A scale space filter is applied to filter the randomness in the traffic flows without affecting the behavior patterns. A threshold is selected based on a systematic criterion to evaluate the degree of abnormality. The contributions of different traffic features to the abnormal behavior detection are analyzed. It is found that the number of connection degree is the most important feature for traffic monitoring. A salient feature of this method is that it is effective for detecting the abnormal behaviors not associated with significant changes in traffic volumes. Another advantage of the new method is that no supervised learning process is needed. This is very important since high quality labeled samples are very difficult to acquire in actual networks especially the data traces associated with attacks. The experimental results based on the actual network data show that the method presented in the paper is effective for monitoring abnormal traffic flows in the gigabytes traffic environment and the accuracy is above 95%.

Monitoring the Spatial-Temporal Effect of Internet Traffic Based on Random Matrix Theory

Monitoring of Link Traffic Patterns Based on Random Matrix Theory

A RMT and PCA-Based Method of Monitoring the Large-Scale Traffic Pattern

An Effective Method Of Monitoring The Large-Scale Traffic Pattern Based On Rmt And Pca

Modeling and Analysis of Resource'S Load-Scale in P2p Network

PCA Based Approach for Monitoring the Spatial-and-temporal Characteristics of P2P Traffic

A Model Approach to Estimate Peer-to-Peer Traffic Matrices

Analyzing peer-to-peer traffic’s impact on large scale networks

Analyzing BitTorrent Traf?c Across Large Network

A New Method on P2P Traffic Identification Based on Flow

Monitoring abnormal traffic flows based on independent component analysis

Measurement and Analysis of Peer-to-Peer Application Traffic Characteristics

Traffic distribution and self-similarity of P2P application

RMT-based Urban Traffic Cross-Correlation Analysis and Its Application on Traffic Incident Impact Analyses

A cross-correlation-based method for spatial-temporal traffic analysis

Analysis of Inter-Domain Traffic Correlations: Random Matrix Theory Approach

Modeling and Analysis Traffic Flows of Peer-to-Peer Application

A measurement study of peer-to-peer applications

Internet Traffic Matrix Structural Analysis Based on Multi-Resolution RPCA

Monitoring Abnormal Network Traffic Based on Blind Source Separation Approach

Structure Regularized Traffic Monitoring Model for Traffic Matrix Estimation and Anomaly Detection