Network-Wide Traffic Anomaly Detection and Localization Based on Robust Multivariate Probabilistic Calibration Model

Abstract

Network anomaly detection and localization are of great significance to network security. Compared with the traditional methods of host computer, single link and single path, the network-wide anomaly detection approaches have distinctive advantages with respect to detection precision and range. However, when facing the actual problems of noise interference or data loss, the network-wide anomaly detection approaches also suffer significant performance reduction or may even become unavailable. Besides, researches on anomaly localization are rare. In order to solve the mentioned problems, this paper presents a robust multivariate probabilistic calibration model for network-wide anomaly detection and localization. It applies the latent variable probability theory with multivariate t-distribution to establish the normal traffic model. Not only does the algorithm implement network anomaly detection by judging whether the sample's Mahalanobis distance exceeds the threshold, but also it locates anomalies by contribution analysis. Both theoretical analysis and experimental results demonstrate its robustness and wider use. The algorithm is applicable when dealing with both data integrity and loss. It also has a stronger resistance over noise interference and lower sensitivity to the change of parameters, all of which indicate its performance stability.

Threat-Event Detection for Distributed Networks Based on Spatiotemporal Markov Random Field

“…Yang et al [28] proposed a Gaussian-mixture model-based detection scheme to mitigate data integrity attacks in a smart grid, which operates through narrowing the range of normal data. Li et al [29] presented a robust multivariate probabilistic calibration model for network-wide anomaly detection and localization. They applied the latent variable probability theory with multivariate t-distribution to establish the normal traffic model, and detected the network anomaly by the Mahalanobis distance of samples.…”