Internet Anomaly Detection based on Complex Network Path

Abstract

Detecting the anomaly behaviors such as network failure or Internet intentional attack in the large-scale Internet is a vital but challenging task. While numerous techniques have been developed based on Internet traffic in past years, anomaly detection for structured datasets by complex network have just been of focus recently. In this paper, a anomaly detection method for large-scale Internet topology is proposed by considering the changes of network crashes. In order to quantify the dynamic changes of Internet topology, the network path changes coefficient(NPCC) is put forward which will highlight the Internet abnormal state after it is attacked continuously. Furthermore we proposed the decision function which is inspired by Fibonacci Sequence to determine whether the Internet is abnormal or not. That is the current Internet is abnormal if its NPCC is beyond the normal domain which structured by the previous k NPCCs of Internet topology. Finally the new Internet anomaly detection method was tested over the topology data of three Internet anomaly events. The results show that the detection accuracy of all events are over 97%, the detection precision of each event are 90.24%, 83.33% and 66.67%, when k = 36. According to the experimental values of the index F 1 , we found the the better the detection performance is, the bigger the k is, and our method has better performance for the anomaly behaviors caused by network failure than that caused by intentional attack. Compared with traditional anomaly detection, our work may be more simple and powerful for the government or organization in items of detecting large-scale abnormal events.

Using complex network theory for temporal locality in network traffic flows

“…Path Length: The network path length exhibits the effectiveness of information transmission in a network. Recently, researchers have defined multiple metrics about the path length quantify problem [28]. For instance, the shortest path length (SPL) is defined as the average number of steps along the shortest paths for all possible pairs of network nodes, and the network diameter is used to represent the maximum number of steps along the shortest paths.…”

Anomaly Detection of Complex Networks Based on Intuitionistic Fuzzy Set Ensemble

“…The network diameter denotes the worst communication path length. Under the intentional attack, network diameter will first increases and then decreases quickly [26]. In this section, we put forward the intuitionistic fuzzification method for single complex network characteristic.…”

“…In this Letter, the intuitionistic fuzzy set (IFS) [21] is adopted to depict the above uncertain problem. Its key idea is that similar networks probably share certain characteristics, for instance the anomaly detection studies based on a single network characteristic such as node closeness, [22] node betweenness, [23] node degree, [24] local clustering coefficient, [25] network diameter, [26] network entropy, [27] and network assortativity. Different from Ref.…”