Parameterized Anomaly Detection System with Automatic Configuration
Bruno Bogaz Zarpel�ão, Leonardo de Souza Mendes, Mário Lemes Proença, Joel J. P. C. Rodrigues · 2009
This work proposes a parameterized anomaly detection system, based on the method known as profile based. The analysis of network elements is performed in two levels: (i) analysis of simple network management protocol (SNMP) objects data using a hysteresis-based algorithm to detect behavior deviations; (ii) analysis of alerts generated in the first level using a dependency graph, which represents the relationships between the SNMP objects. The proposed system is also able to configure its own parameters automatically, aiming to meet the network administrator needs. Tests were performed in a real network environment and great results were obtained.