Optimal volume anomaly detection in network traffic flows

Abstract : Optimal detection of unusual and significant changes in network Origin-Destination (OD) traffic volumes from simple link load measurements is considered in the paper. The ambient traffic, i.e. the OD traffic matrix corresponding to the non-anomalous network state, is unknown and it is considered here as a nuisance parameter because it can mask the anomalies. Since the OD traffic matrix is not recoverable from simple link load measurements, the anomaly detection is an ill-posed decision-making problem. The method proposed in this paper consists of finding a linear parsimonious model of ambient traffic (nuisance parameter) and detecting anomalies by using an invariant detection algorithm based on a separation of the measurement space into disjoint subspaces corresponding to normal and anomalous network traffic. The method’s ability to detect anomalies is evaluated in real traffic from Abilene, a United States backbone network. The theoretically expected results are confirmed.
Complete list of metadatas

Cited literature [19 references]  Display  Hide  Download

Contributor : Bibliothèque Télécom Bretagne <>
Submitted on : Monday, November 29, 2010 - 2:27:42 PM
Last modification on : Thursday, October 17, 2019 - 12:33:47 PM
Long-term archiving on : Friday, December 2, 2016 - 2:14:33 PM


Files produced by the author(s)


  • HAL Id : hal-00540901, version 1


Lionel Fillatre, Igor Nikiforov, Pedro Casas Hernandez, Sandrine Vaton. Optimal volume anomaly detection in network traffic flows. EUSIPCO'08 : 16th European Signal Processing Conference, Aug 2008, Lausanne, Switzerland. ⟨hal-00540901⟩



Record views


Files downloads