Real-Time Dynamic Network Anomaly Detection
Jordan Noble, Niall M. Adams · IEEE Intelligent Systems · 2018
Cybersecurity increasingly relies on the methodology used for statistical analysis of network data. The volume and velocity of enterprise network data sources puts a premium on streaming analytics that pass over the data once, while handling temporal variation in the process. In this paper we introduce ReTiNA: a framework for streaming network anomaly detection. This procedure first detects anomalies in the correlation processes on individual edges of the network graph. Second, anomalies across multiple edges are combined and scored to give network-wide situational awareness. The approach is tested in simulation and demonstrated on two real Netflow datasets.