Algorithm of Anomaly Detection Based on Traffic Decomposition
Guo Qiang Lin · Jisuanji yingyong yanjiu · 2006
Diagnosing anomalies are difficult problem because one must extract and interpret anomalous patterns from large amounts of high-dimensional,noisy data.In this paper the network traffic is validated to possess a non-stationary characteristic and a general method was proposed to diagnose anomalies.This method is based on a separation of the non-stationary traffic into disjoint components corresponding to normal and anomalous network conditions.This separation can be performed effectively by both marginal distribution and qq-plot analysis of parameters of anomalous component.We evaluate the method's ability to diagnose both existing and synthetically injected traffic anomalies in real traffic.Experiment shows the method can: ①accurately detect when traffic anomaly is occurring;②does so with a very low false alarm rate.