Anomaly Detections in Internet Traffic Using Empirical Measures
Introducing Internet traffic anomaly detection mechanism based on large deviations results for empirical measures. Using past traffic traces the authors characterize network traffic during various time-of-day intervals, assuming that it is anomaly-free. Throughout, they compare the two approaches presenting their advantages and disadvantages to identify and classify temporal network anomalies. They also demonstrate how their framework can be used to monitor traffic from multiple network elements in order to identify both spatial and temporal anomalies. They validate their techniques by analyzing real traffic traces with time-stamped anomalies.