Automatic Model Selection for Anomaly Detection
Ziyu Wang, Jiahai Yang, Shize Zhang, Chenxi Li, Hui Zhang · 2016
In this paper, we show that for a given pair of metrics, such as IGTE vs. IGFE, number of packets vs. number of network flows, etc., the functional relation between them may be complex and can not be described perfectly by linear equation. In order to capture this complex relationship, we make use of evidence function framework to automatically determine the optimal model for the metrics. Then we measure the deviation of the observed data from the established model to detect network anomalies.