Sequential non Bayesian network traffic flows anomaly detection and isolation

Lionel Fillatre (1) , Igor V. Nikiforov (1) , Sandrine Vaton (2) , Pedro Casas Hernandez (2)

1 LM2S - Laboratoire Modélisation et Sûreté des Systèmes
2 INFO - Département informatique

Sequential detection (and isolation) of unusual and significant changes in network Origin-Destination (OD) traffic volumes from simple link load measurements is considered in the paper. The ambient traffic, i.e. the OD traffic matrix corresponding to the non-anomalous network state, is unknown and it is considered here as a nuisance parameter because it can mask the anomalies. Since the OD traffic matrix is not recoverable from the simple link load measurements, the anomaly detection is an ill-posed decision-making problem. The method discussed in this paper consists of finding a linear parsimonious model of ambient traffic (nuisance parameter) and detecting/isolating anomalies by using an invariant decision algorithm. An optimal sequential algorithm has been discussed in our previous publication, the main goal of the actuel paper is to discuss a simple ``snapshot'' algorithm based on the last vector of observations.

Mots clés: Statistical change detection/isolation; Nuisance parameters; Network traffic flows; Parsimonious model; Invariant decision algorithm

Domaines: Applications [stat.AP]

Lionel Fillatre, Igor V. Nikiforov, Sandrine Vaton, Pedro Casas Hernandez. Sequential non Bayesian network traffic flows anomaly detection and isolation. IWAP 2008: International Workshop on Applied Probability, Jul 2008, Compiègne, France. ⟨hal-00540885⟩