Traffic Anomaly Detection Based on Robust Principal Component Analysis Using Periodic Traffic Behavior

Matsuda, Takahiro; Morita, Tatsuya; Takanori, Kudo; Takine, Tetsuya

doi:10.1587/transcom.2016ebp3239

Cited by 10 publications

(11 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The PCA (Joseph et al, 2016; Matsuda et al, 2017; Rahmani et al, 2017) combines multiple variables into a few independent synthetic variables (i.e. principal components) that can reflect most of the information in the original variables.…”

Section: Establishment Of a Diagnostic Model Based On Data Analysismentioning

confidence: 99%

Multi-model and multi-level aluminum electrolytic fault diagnosis method

Gao

Ji³

2019

Transactions of the Institute of Measurement and Control

View full text Add to dashboard Cite

A multi-model and multi-level aluminum electrolytic fault prediction method is proposed. In this method, it innovatively uses the image recognition technology to predict aluminum electrolytic faults, and superimposes the chaotic neural network model to form a dual-model parallel fault prediction system for aluminum electrolysis, which can obtain more faults information from different angles. Then, it designs the decision fusion layer, which combines the prediction results of the above two models to output the final prediction results and enhances the credibility of the prediction results. In addition, the data processing stage also uses principal component analysis (PCA) to extract the main features of fault information, which reduces the data dimension and speeds up the processing. Experimental results suggest that the proposed algorithm can predict faults in an effective manner, and outperform other algorithms in terms of accuracy, sensitivity and stability.

show abstract

Section: Establishment Of a Diagnostic Model Based On Data Analysismentioning

confidence: 99%

Multi-model and multi-level aluminum electrolytic fault diagnosis method

Gao

Ji³

2019

Transactions of the Institute of Measurement and Control

View full text Add to dashboard Cite

show abstract

“…Statistical-based approaches are suitable for the detection of anomaly. Matsuda et al 9 used principal component analysis (PCA)-based network traffic anomaly detection technology to project the measured flow data into normal subspace and abnormal subspace to detect traffic anomaly. This method increased the robustness of anomaly detection system and reduced the computational cost.…”

Section: Related Workmentioning

confidence: 99%

A parallel algorithm for network traffic anomaly detection based on Isolation Forest

Tao

Peng

Zhao

et al. 2018

International Journal of Distributed Sensor Networks

View full text Add to dashboard Cite

With the rapid development of large-scale complex networks and proliferation of various social network applications, the amount of network traffic data generated is increasing tremendously, and efficient anomaly detection on those massive network traffic data is crucial to many network applications, such as malware detection, load balancing, network intrusion detection. Although there are many methods around for network traffic anomaly detection, they are all designed for single machine, failing to deal with the case that the network traffic data are so large that it is prohibitive for a single computer to store and process the data. To solve these problems, we propose a parallel algorithm based on Isolation Forest and Spark for network traffic anomaly detection. We combine the advantages of Isolation Forest algorithm in network traffic anomaly detection and big data processing capability of Spark technology. Meanwhile, we apply the idea of parallelization to the process of modeling and evaluation. In the calculation process, by assigning tasks to multiple compute nodes, Isolation Forest and Spark can efficiently perform anomaly detection and evaluation process. By this way, we can also solve the problem of computation bottleneck on single machine. Extensive experiments on real world datasets show that our Isolation Forest and Spark is efficient and scales well for anomaly detection on large network traffic data.

show abstract

“…[19], the authors found the heavy hitters in terms of cardinality in massive traffic, and introduced a new algorithm to anomaly detection. Furthermore, the researchers has studied the Internet anomaly detection based on pattern recognition [5], [6], SVM [7] and PCA [8].Compare with the above traffic statistic studies, Iliofotou et.al [9] proposed the Traffic Dispersion Graph(TDG) to discover network-wide interactions of hosts, to monitor, analyze, and visualize network traffic. It is the first study which considers the inter-dependency relationship of network traffic data.…”

Section: Related Workmentioning

confidence: 99%

“…The past works mainly focus on the Internet traffic anomaly, that is keeping traffic statistic such as packet size, and inter-arrivals, flow accounts, byte volumes, etc., analyzing the traffic behaviors, constructing the outliers model of the traffic, and finally giving the traffic clustering results: normal and abnormal [3], [5]- [8]. However Iliofotou et.al [9] proposed the Traffic Dispersion Graph(TDG), which extracts on network-wide interactions of hosts, to monitor, analyze, and visualize network traffic.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Internet Anomaly Detection based on Complex Network Path

Wang¹,

Jia²,

Zhang³

et al. 2017

Preprint

View full text Add to dashboard Cite

Detecting the anomaly behaviors such as network failure or Internet intentional attack in the large-scale Internet is a vital but challenging task. While numerous techniques have been developed based on Internet traffic in past years, anomaly detection for structured datasets by complex network have just been of focus recently. In this paper, a anomaly detection method for large-scale Internet topology is proposed by considering the changes of network crashes. In order to quantify the dynamic changes of Internet topology, the network path changes coefficient(NPCC) is put forward which will highlight the Internet abnormal state after it is attacked continuously. Furthermore we proposed the decision function which is inspired by Fibonacci Sequence to determine whether the Internet is abnormal or not. That is the current Internet is abnormal if its NPCC is beyond the normal domain which structured by the previous k NPCCs of Internet topology. Finally the new Internet anomaly detection method was tested over the topology data of three Internet anomaly events. The results show that the detection accuracy of all events are over 97%, the detection precision of each event are 90.24%, 83.33% and 66.67%, when k = 36. According to the experimental values of the index F 1 , we found the the better the detection performance is, the bigger the k is, and our method has better performance for the anomaly behaviors caused by network failure than that caused by intentional attack. Compared with traditional anomaly detection, our work may be more simple and powerful for the government or organization in items of detecting large-scale abnormal events.

show abstract

Traffic Anomaly Detection Based on Robust Principal Component Analysis Using Periodic Traffic Behavior

Cited by 10 publications

References 27 publications

Multi-model and multi-level aluminum electrolytic fault diagnosis method

Multi-model and multi-level aluminum electrolytic fault diagnosis method

A parallel algorithm for network traffic anomaly detection based on Isolation Forest

Internet Anomaly Detection based on Complex Network Path

Contact Info

Product

Resources

About