MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking

Evaluating anomaly detectors is a crucial task in traffic monitoring made particularly difficult due to the lack of ground truth. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labeled anomaly traffic traces. We aim at automatically finding anomalies in the MAWI archive using a new methodology that combines different and independent detectors. A key challenge is to compare the alarms raised by these detectors, though they operate at different traffic granularities. The main contribution is to propose a reliable graph-based methodology that combines any anomaly detector outputs. We evaluated four unsupervised combination strategies; the best is the one that is based on dimensionality reduction. The synergy between anomaly detectors permits to detect twice as many anomalies as the most accurate detector, and to reject numerous false positive alarms reported by the detectors. Significant anomalous traffic features are extrac...

• Type: Journal
• Year: 2010
• Where: CONEXT
• Authors: Romain Fontugne, Pierre Borgnat, Patrice Abry, Kensuke Fukuda
• Keywords: Computer Networks, CONEXT 2010, Detectors, MAWI Archive, Reliable Graph-based Methodology