Online Mining of Risk Level of Traffic Anomalies with User~s Feedbacks
Meng Yu, Margaret H. Dunham · 2006
Traffic anomaly has been rated as an important risk indication in computer networks. Unsupervised online detection of possible risks is crucial to prompt resolutions when streams of traffic data are collected in a network. Current anomaly detection techniques using positive security method suffer from a high false alarm rate when a high detection rate is pursued. This paper presents a heuristic risk assessment model in a spatiotemporal environment which incorporates an anomaly detection model with user feedbacks to historical events. Operations proposed are solely based on the synopsis of the data stream profile characterized by a dynamic Markov chain with each state denoting a representative granule in the data space. The Markov property is used to determine the size of granules to reach an optimal performance. The model is efficient, incremental, and scalable, and thus suitable for soft real- time processing. The experiments conducted with VoIP CDR (Call Detail Records) data provided by Cisco Systems show that compared with a positive security-based anomaly detection model, the false alarm rate caused by the proposed model is significantly mitigated without losing a high detection rate.