Anomaly Extraction in Backbone Networks Using Association Rules

Daniela Brauckhoff (1) , Xenofontas Dimitropoulos (1) , Arno Wagner (1) , Kavé Salamatian (1)

1 TIK - Computer Engineering and Networks Laboratory

Anomaly extraction is an important problem essential to several applications ranging from root cause analysis, to attack mitigation, and testing anomaly detectors. Anomaly extraction is preceded by an anomaly detection step, which detects anomalous events and may identify a large set of possible associated event flows. The goal of anomaly extraction is to find and summarize the set of flows that are effectively caused by the anomalous event. In this work, we use meta-data provided by several histogram-based detectors to identify suspicious flows and then apply association rule mining to find and summarize the event flows. Using rich traffic data from a backbone network (SWITCH/AS559), we show that we can reduce the classification cost, in terms of items (flows or rules) that need to be classified, by several orders of magnitude. Further, we show that our techniques effectively isolate event flows in all analyzed cases and that on average trigger between 2 and 8.5 false positives, which can be trivially sorted out by an administrator.

Mots clés: Design; Experimentation; Measurement

Domaines: Réseaux et télécommunications [cs.NI]

Daniela Brauckhoff, Xenofontas Dimitropoulos, Arno Wagner, Kavé Salamatian. Anomaly Extraction in Backbone Networks Using Association Rules. Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference, 2009, pp.28-34. ⟨hal-00527139⟩