An ISP-side view of AAA system anomalies detection
Dongting Sun, Yu Liu, Qingxin Tang, Wei Li · 2017
By analyzing AAA service log data of one main ISP in China, we found that the variations of authentication success ratio (ASR) exhibit counter-intuitive behavior. The ASR is actually higher during peak hours than off-peak hours. To account for this paradox and explain ASR variations in general, an analysis mechanism is proposed. It has the ability to separate ASR variations into systemic changes over time and anomalous variations due to unanticipated events. It is found that the systemic ASR variations primarily result from user status and access type changes. And then, we detected and diagnosed the service anomalies by rejecting the influence of systemic variations. The simulation shows that in this way, we use no more than 70% time to detect the anomalies and detects 30% more true anomalous than existing techniques and methods.