Methodology for statistical analysis of enterprise network data is becoming increasingly important in cyber-security. The volume and velocity of enterprise network data sources puts a premium on streaming analytics that pass over the data once, while handling temporal variation in the process. In this paper we introduce ReTiNA: a framework for streaming network anomaly detection. This procedure first detects anomalies in the correlation processes on individual edges of the network graph. Second, anomalies across multiple edges are combined and scored to give network-wide situational awareness. The approach is tested in simulation and demonstrated on two real Netflow datasets.

No abstract

No abstract

No abstract