A Hough-transform-based anomaly detector with an adaptive time interval

Abstract

Internet traffic anomalies are a serious problem that compromises the availability of optimal network resources. Numerous anomaly detectors have recently been proposed, but maintaining their parameters optimally tuned is a difficult task that discredits their effectiveness for daily usage. This article proposes a new anomaly detection method based on pattern recognition and investigates the relationship between its parameter set and the traffic characteristics. This analysis highlights that constantly achieving a high detection rate requires continuous adjustments to the parameters according to the traffic fluctuations. Therefore, an adaptive time interval mechanism is proposed to enhance the robustness of the detection method to traffic variations. This adaptive anomaly detection method is evaluated by comparing it to three other anomaly detectors using four years of real backbone traffic. The evaluation reveals that the proposed adaptive detection method outperforms the other methods in terms of the true positive and false positive rate.

Improving an SVD-based combination strategy of anomaly detectors for traffic labelling

“…Further- Table 1: Heuristics labelling the traffic corresponding to a set of alarms into three categories ("Attack", "Special", and "Unknown"). These are originated from the anomalies previously reported [3,9] more, the majority of points are close to the "normal" reference point, and thus, far from the "abnormal" one. In order to understand where anomalies are located in the space, we then perform a breakdown of MAWILab anomalies regarding a heuristic-based classification.…”

“…This technique has been applied to several domains including anomaly detection of backbone traffic [9]. The approach proposed in [9] consists of first, monitoring the traffic in a 2-D scatter plot where the anomalous traffic appears as "lines", and second, identifies the anomalies with the Hough transform. The original data is retrieved from the identified plots, and the alarms reported by this method are aggregated sets of flows.…”

“…Consequently, the evaluation of a detector with simulated anomalies is restricted to certain kinds of anomaly, and thus, is insufficient for measuring the detector performance [20]. With real anomalies, researchers evaluate anomaly detectors by manually checking the reported alarms [4,6,13,14], or by comparing them to those reported by other anomaly detectors [9,[12][13][14]. Sometimes researchers also construct ground truth data by manually inspecting the analysed traffic [1].…”

A self-tuning self-optimizing approach for automated network anomaly detection systems

“…Recently there are a few studies on tuning specific models online [5,8,15]. The work in [15] examined the sensitivity of PCA to parameter settings and found that minor changes to the parameter settings increased the false positive rate by a factor of three or more.…”

“…A method for automatically learning optimal parameter setting and dynamically adapting the learning period was proposed. Fontugne et al described a Hugh transform method for anomaly detection that also automatically adjusts a parameter set in regards to the traffic fluctuations [5].…”