Sketch-based streaming PCA algorithm for network-wide traffic anomaly detection

Y Liu, L Zhang, Y Guan - 2010 IEEE 30th International …, 2010 - ieeexplore.ieee.org
Y Liu, L Zhang, Y Guan
2010 IEEE 30th International Conference on Distributed Computing …, 2010ieeexplore.ieee.org
Internet has become an essential part of the daily life for billions of users worldwide, who are
using a large variety of network services and applications everyday. However, there have
been serious security problems and network failures that are hard to resolve, for example,
botnet attacks, polymorphic worm/virus spreading, DDoS, and flash crowds. To address
many of these problems, we need to have a network-wide view of the traffic dynamics, and
more importantly, be able to detect traffic anomalies in a timely manner. Spatial analysis …
Internet has become an essential part of the daily life for billions of users worldwide, who are using a large variety of network services and applications everyday. However, there have been serious security problems and network failures that are hard to resolve, for example, botnet attacks, polymorphic worm/virus spreading, DDoS, and flash crowds. To address many of these problems, we need to have a network-wide view of the traffic dynamics, and more importantly, be able to detect traffic anomalies in a timely manner. Spatial analysis methods have been proved to be effective in detecting network-wide traffic anomalies that are not detectable at a single monitor. To our knowledge, Principle Component Analysis (PCA) is the best-known spatial detection method for the coordinated low-profile traffic anomalies. However, existing PCA-based solutions have scalability problems in that they require linear running time and space to analyze the traffic measurements within a sliding window, which makes it often infeasible to be deployed for monitoring large-scale high-speed networks. We propose a sketch-based streaming PCA algorithm for the network-wide traffic anomaly detection in a distributed fashion. Our algorithm only requires logarithmic running time and space at both local monitors and Network Operation Centers (NOCs), and can detect both high-profile and coordinated low-profile traffic anomalies with bounded errors.
ieeexplore.ieee.org
以上显示的是最相近的搜索结果。 查看全部搜索结果