Network calculus based modeling of anomaly detection
Muhammad Hassan Raza, Bill Robertson, William Phillips, Jacek Ilow · International Symposium on Performance Evaluation of Computer and Telecommunication Systems · 2010
Anomalous activities such as flash crowd/event and denial of service (DoS) overload a pool of servers that hosts web contents. This is a great challenge for the 24 by 7 provision of Web contents and may result in interruption of the Web services. Therefore, it is very important that the occurrence of such activities is monitored so that in case of the occurrence of such anomalies, a remedial action can be in placed. In this paper, we introduce a novel technique to model the excessive legitimate or illegitimate requests (to a server farm/cluster) in terms of the concepts and terminology of Network Calculus. Network Calculus deals very well with flow rates (such as the rate of arrival and service patterns) and the capacity of a system. Simulation results show that the model successfully identifies anomalies such as DoS and flash events, and this indication can be used to start the remedial steps.