A generic sampling framework for improving anomaly detection in the next generation network
Fazirulhisyam Hashim, Abbas Jamalipour · Security and Communication Networks · 2010
Abstract The heterogeneous nature of network traffic in next generation networks (NGNs) may impose scalability issue to traffic monitoring applications. While this issue can be well addressed by existing sampling approaches, owing to their inherent ‘lossy’ characteristic and data reduction principle, traditional sampling techniques suffer from incomplete traffic statistics, which can lead to inaccurate inferences of the network traffic. By focusing on two distinct traffic monitoring applications, namely, anomaly detection and traffic measurement, we highlight the possibility of addressing the accuracy of both applications without having to sacrifice one for the sake of the other. In light of this, we propose a generic sampling framework, which is capable of providing creditable network traffic statistics for accurate anomaly detection in the NGN, while at the same time preserves the principal purpose of sampling (i.e., to sample dominant traffic flows for accurate traffic measurement), and thus addressing the accuracy of both applications concurrently. With the emphasize on the accuracy of anomaly detection and the scalability of monitoring devices, the performance evaluation over real network traces demonstrates the superiority of the proposed framework over traditional sampling techniques. Copyright © 2010 John Wiley & Sons, Ltd.