A Probabilistic Principal Component Analysis Approach for Detecting Traffic Anomaly in Industrial Networks
Liang Liu · Xi'an Jiaotong Daxue xuebao · 2012
An algorithm using probabilistic principal component analysis(PPCA) is proposed to reduce the false alarm rate of anomaly detection of industrial networks using traditional principal component analysis(PCA).A PPCA model of industrial network traffic matrix is established by analyzing the causes of false alarm.Parameters in the model are identified by using the iterative variational Bayesian algorithm,and then are used to infer the rank of the PPCA model.Traffic anomaly is finally detected by making judgement on the rank.Simulated attack experiments show that the proposed method decreases false alarm rate by 32% in average,and effectively reduces the false alarm rate of PCA method.