Abstract-High-speed backbones are regularly affected by various kinds of network anomalies, ranging from malicious attacks to harmless large data transfers. Different types of anomalies affect the network in different ways, and it is difficult to know a priori how a potential anomaly will exhibit itself in traffic statistics. In this paper we describe an online, sequential, anomaly detection algorithm, that is suitable for use with multivariate data. The proposed algorithm is based on the kernel version of the recursive least squares algorithm. It assumes no model for network traffic or anomalies, and constructs and adapts a dictionary of features that approximately spans the subspace of normal behaviour. The algorithm raises an alarm immediately upon encountering a deviation from the norm. Through comparison with existing block-based offline methods based upon Principal Component Analysis, we demonstrate that our online algorithm is equally effective but has much faster time-to-detection and lower computational complexity. We also explore minimum volume set approaches in identifying the region of normality.

Large backbone networks are regularly affected by a range of anomalies. This paper presents an online anomaly detection algorithm based on Kernel Density Estimates. The proposed algorithm sequentially and adaptively learns the definition of normality in the given application, assumes no prior knowledge regarding the underlying distributions, and then detects anomalies subject to a user-set tolerance level for false alarms. Comparison with the existing methods of Geometric Entropy Minimization, Principal Component Analysis and OneClass Neighbor Machine demonstrates that the proposed method achieves superior performance with lower complexity.

In this paper we apply a recursive algorithm based on kernel mappings to propose an automated, real-time intruder detection mechanism for surveillance networks. Our proposed method is portable and adaptive, and does not require any expensive or sophisticated components. Through application to real images from BRAC University's closed-circuit television system and comparison with common methods based on Principle Component Analysis (PCA), we show that it is possible to obtain high detection accuracy with low complexity.

No abstract

No abstract