Detecting traffic anomalies using an equilibrium property

When many flows are multiplexed on a non-saturated link, their volume changes over short timescales tend to cancel each other out, making the average change across flows close to zero. This equilibrium property holds if the flows are nearly independent, and it is violated by traffic changes caused by several correlated flows. We exploit this empirical property to design a computationally simple anomaly detection method. Categories and Subject Descriptors: C.2.3 [Computer-Communication Networks]: Network Operations General Terms: Experimentation, Measurement.

• Type: Conference
• Year: 2010
• Where: SIGMETRICS
• Authors: Fernando Silveira, Christophe Diot, Nina Taft, Ramesh Govindan
• Keywords: Correlated Flows, Hardware, Short Timescales, SIGMETRICS 2010, Simple Anomaly Detection