Detection of stationary network load increase using univariate network aggregate traffic data by dynamic PCA

Abstract

Network operators are now facing bandwidth outages as well as a growing pressure to ensure good Quality of Service (QoS). An important practical issue for network service providers is to pay close attention to the load changes of network traffic, in particular, the stationary increase of load from a normal demand. Many network monitoring applications and performance analysis tools are based on the study of an aggregate measure of network traffic, e.g. number of packets in transit (NPT), which is a long-term univariate time series. To classify this type of network traffic data and detect any increase of network source load, we propose a dynamic principal component analysis (PCA) method, first to extract data features and then to detect a stationary load increase of network traffic. The proposed detection schemes are based on either the major or the minor principal components of network traffic data. To demonstrate the applications of the proposed feature extraction method and the detection schemes, we applied them to network traffic data simulated from the packet switching network (PSN) model. Additionally, we propose a combined detection scheme that uses both the major and the minor principal components. The proposed detection schemes, based on dynamic PCA, show enhanced performance in detecting an increase of network load for the simulated network traffic data. These results offer a new feature extraction method based on dynamic PCA that creates additional feature variables for event detection in a univariate time series.

Study of Stationary Load Increase of Computer-Network Traffic via Dynamic Principal-Component Analysis

“…The volatility of NPT data increases with the increase of source-load value for each ecf ONE, QS, and QSPO. However, from our empirical studies [17], the changes of volatilities for ecf QS and QSPO are difficult to distinguish. To detect an increase of network source load, for each type of ecf, the simulated NPT data is categorized into two groups, normal traffic and normal-high traffic.…”

Flow‐oriented detection of low‐rate denial of service attacks

“…In this paper, the PCA algorithm is used to reduce the space dimensionality of network flows for the purpose of detecting LDoS attacks [7]. In mathematics, feature extraction is the mapping from the measurement space R m to the feature space R n .…”

“…Hence, PCA algorithm is a technique, which can be applied to analyze network traffic and detect LDoS attacks. In this paper, the PCA algorithm is used to reduce the space dimensionality of network flows for the purpose of detecting LDoS attacks [7].…”