A Two-Layered Anomaly Detection Technique Based on Multi-modal Flow Behavior Models

  • Marc Ph. Stoecklin
  • Jean-Yves Le Boudec
  • Andreas Kind
Conference paper

DOI: 10.1007/978-3-540-79232-1_22

Part of the Lecture Notes in Computer Science book series (LNCS, volume 4979)
Cite this paper as:
Stoecklin M.P., Le Boudec JY., Kind A. (2008) A Two-Layered Anomaly Detection Technique Based on Multi-modal Flow Behavior Models. In: Claypool M., Uhlig S. (eds) Passive and Active Network Measurement. PAM 2008. Lecture Notes in Computer Science, vol 4979. Springer, Berlin, Heidelberg

Abstract

We present a novel technique to detect traffic anomalies based on network flow behavior in different traffic features. Based on the observation that a network has multiple behavior modes, we estimate the modes in each feature component and extract their model parameters during a learning phase. Observed network behavior is then compared to the baseline models by means of a two-layered distance computation: first, component-wise anomaly indices and second, a global anomaly index for each traffic feature enable effective detection of aberrant behavior. Our technique supports on-line detection and incorporation of administrator feedback and does not make use of explicit prior knowledge about normal and abnormal traffic. We expect benefits from the modeling and detection strategy chosen to reliably expose abnormal events of diverse nature at both detection layers while being resilient to seasonal effects. Experiments on simulated and real network traces confirm our expectations in detecting true anomalies without increasing the false positive rate. A comparison of our technique with entropy- and histogram-based approaches demonstrates its ability to reveal anomalies that disappear in the background noise of output signals from these techniques.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Marc Ph. Stoecklin
    • 1
  • Jean-Yves Le Boudec
    • 2
  • Andreas Kind
    • 1
  1. 1.IBM Zurich Research Laboratory 
  2. 2.Ecole Polytechnique Fédérale de Lausanne (EPFL) 

Personalised recommendations