Traffic Anomaly Detection and Containment Using Filter-Ary-Sketch
Liming Zheng, Peng Zou, Yan Jia, Weihong Han · Procedia Engineering · 2012
Traffic anomaly detection systems require not only efficiency and accuracy but also the ability of containment. For those special requirements, an anomaly detection system is proposed based on Filter-ary-Sketch. It records the traffic in Filter-ary-Sketch and detects anomalies over it. When an anomaly is detected, the anomalous dimension is notices and malicious buckets are identified. Finally, malicious packets are blocked using the packets filter algorithm. Using some traffic traces from backbone networks, we demonstrate that our system can detect anomalies with high accuracy, low computation and memory costs, and block the packets that are responsible for anomalies.