Skip to Main content Skip to Navigation
Conference papers

Combining Filtering and Statistical Methods for Anomaly Detection

Augustin Soule 1 Kavé Salamatian 1 Nina Taft
1 NPA - Networks and Performance Analysis
LIP6 - Laboratoire d'Informatique de Paris 6
Abstract : In this work we develop an approach for anomaly detection for large scale networks such as that of an enterprize or an ISP. The traffic patterns we focus on for analysis are that of a network-wide view of the traffic state, called the traffic matrix. In the first step a Kalman filter is used to filter out the "normal" traffic. This is done by comparing our future predictions of the traffic matrix state to an inference of the actual traffic matrix that is made using more recent measurement data than those used for prediction. In the second step the residual filtered process is then examined for anomalies. We explain here how any anomaly detection method can be viewed as a problem in statistical hypothesis testing. We study and compare four different methods for analyzing residuals, two of which are new. These methods focus on different aspects of the traffic pattern change. One focuses on instantaneous behavior, another focuses on changes in the mean of the residual process, a third on changes in the variance behavior, and a fourth examines variance changes over multiple timescales. We evaluate and compare all of these methods using ROC curves that illustrate the full tradeoff between false positives and false negatives for the complete spectrum of decision thresholds.
Document type :
Conference papers
Complete list of metadatas

https://hal.archives-ouvertes.fr/hal-01489028
Contributor : Lip6 Publications <>
Submitted on : Tuesday, March 14, 2017 - 10:47:29 AM
Last modification on : Friday, January 8, 2021 - 5:38:04 PM

Identifiers

  • HAL Id : hal-01489028, version 1

Citation

Augustin Soule, Kavé Salamatian, Nina Taft. Combining Filtering and Statistical Methods for Anomaly Detection. IMC 2005 - 5th ACM SIGCOMM conference on Internet measurement, Oct 2005, Berkeley, CA, United States. pp.31-31. ⟨hal-01489028⟩

Share

Metrics

Record views

129