Abstract:Identifying anomalies rapidly and accurately is critical to the efficient operation of large computer networks. Accurately characterizing important classes of anomalies greatly facilitates their identification; however, the subtleties and complexities of anomalous traffic can easily confound this process. In this paper we report results of signal analysis of four classes of network traffic anomalies: outages, flash crowds, attacks and measurement failures. Data for this study consists of IP flow and SNMP measurements collected over a six month period at the border router of a large university. Our results show that wavelet filters are quite effective at exposing the details of both ambient and anomalous traffic. Specifically, we show that a pseudo-spline filter tuned at specific aggregation levels will expose distinct characteristics of each class of anomaly. We show that an effective way of exposing anomalies is via the detection of a sharp increase in the local variance of the filtered data. We evaluate traffic anomaly signals at different points within a network based on topological distance from the anomaly source or destination. We show that anomalies can be exposed effectively even when aggregated with a large amount of additional traffic. We also compare the difference between the same traffic anomaly signals as seen in SNMP and IP flow data, and show that the more coarse-grained SNMP data can also be used to expose anomalies effectively.

Detection of Network Traffic Anomaly on Instantaneous Frequency Analysis

Detection of network traffic anomaly based on instantaneous parameters analysis

A Time-Frequency Detecting Method for Network Traffic Anomalies

A Detection Algorithm to Anomaly Network Traffic Based on Spectral Kurtosis Analysis

Network Traffic Anomaly Detection Based on Sliding Window

Survey of Research on Anomaly Detection of Wavelet Analysis Based on Network Traffic

Anomaly Detection of Network Traffic Based on Wavelet Packet

Detection Network Anomalies Based on Packet and Flow Analysis

Method of Detecting Network Anomaly on Multi-Time-scale

High-speed anomaly traffic detection based on staged frequency domain features

Network Traffic Anomaly Detection Based on Adaptive Filter Theory

Multi‐scale Anomaly Detection for High‐speed Network Traffic

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

A signal analysis of network traffic anomalies

A Real-Time Detection Approach to Network Traffic Anomalies in Communication Networks

Research on Network Traffic Anomaly Detection Algorithm

Traffic Model Analysis for Anomaly Detection

Anomaly detection for network traffic flow

Network Anomaly Detection Using Time Series Analysis

Real-Time and Self-adaptive Method for Abnormal Traffic Detection Based on Self-similarity

A Wavelet-Based Detection Approach to Traffic Anomalies