Sketch-based streaming PCA algorithm for network-wide traffic anomaly detection
2010 IEEE 30th International Conference on Distributed Computing …, 2010•ieeexplore.ieee.org
Internet has become an essential part of the daily life for billions of users worldwide, who are
using a large variety of network services and applications everyday. However, there have
been serious security problems and network failures that are hard to resolve, for example,
botnet attacks, polymorphic worm/virus spreading, DDoS, and flash crowds. To address
many of these problems, we need to have a network-wide view of the traffic dynamics, and
more importantly, be able to detect traffic anomalies in a timely manner. Spatial analysis …
using a large variety of network services and applications everyday. However, there have
been serious security problems and network failures that are hard to resolve, for example,
botnet attacks, polymorphic worm/virus spreading, DDoS, and flash crowds. To address
many of these problems, we need to have a network-wide view of the traffic dynamics, and
more importantly, be able to detect traffic anomalies in a timely manner. Spatial analysis …
Internet has become an essential part of the daily life for billions of users worldwide, who are using a large variety of network services and applications everyday. However, there have been serious security problems and network failures that are hard to resolve, for example, botnet attacks, polymorphic worm/virus spreading, DDoS, and flash crowds. To address many of these problems, we need to have a network-wide view of the traffic dynamics, and more importantly, be able to detect traffic anomalies in a timely manner. Spatial analysis methods have been proved to be effective in detecting network-wide traffic anomalies that are not detectable at a single monitor. To our knowledge, Principle Component Analysis (PCA) is the best-known spatial detection method for the coordinated low-profile traffic anomalies. However, existing PCA-based solutions have scalability problems in that they require linear running time and space to analyze the traffic measurements within a sliding window, which makes it often infeasible to be deployed for monitoring large-scale high-speed networks. We propose a sketch-based streaming PCA algorithm for the network-wide traffic anomaly detection in a distributed fashion. Our algorithm only requires logarithmic running time and space at both local monitors and Network Operation Centers (NOCs), and can detect both high-profile and coordinated low-profile traffic anomalies with bounded errors.
ieeexplore.ieee.org
以上显示的是最相近的搜索结果。 查看全部搜索结果