We introduce Internet traffic anomaly detection Mechanism based on large deviations results for empirical Measures. Using past traffic traces we characterize network traffic during various time-of-day intervals, assuming that it is Anomaly-free. We present two different approaches to characterize traffic: (i) a model-free approach based on the method of types and Sanov’s theorem and (ii) a model-based approach modeling traffic using a Markov modulated process.
Using these characterizations as a reference we continuously monitor traffic and employ large deviations and decision theory results to “compare” the empirical measure of the monitored traffic with the corresponding reference characterization, thus, identifying traffic anomalies in real-time. Our experimental results show that applying our methodology anomalies are identified within a small number of observations.
- Large Deviation
- Decision Theory
- A Model-free Approach
- A Model-Based Approach
- Comparisons of Modeled Result