PCA-based multivariate statistical network monitoring for anomaly detection
PCA-based multivariate statistical network monitoring for anomaly detection
复制标题
DOI：
10.1016/j.cose.2016.02.008
复制
发表时间：
2016-06-01
影响因子：
5.6
通讯作者：
Macia-Fernandez, Gabriel
中科院分区：
文献类型：
--
作者：
Camacho, Jose;Perez-Villegas, Alejandro;Macia-Fernandez, Gabriel
十年前，基于主成分分析（PCA）的多变量异常检测方法受到了网络社区的广泛关注，这主要得益于Lakhina及其同事的工作。然而，这项工作受到了一些作者的批评，他们声称该方法存在一些局限性。最初的提案和批评出版物都没有完全意识到PCA异常检测的既定方法，到那时，PCA异常检测已经在工业监测和化学计量学领域发展了三十多年，作为多元统计过程控制（MSPC）理论的一部分。本文介绍了基于主成分分析的MSPC方法的主要步骤；回顾了相关的网络文献，突出了与MSPC的一些差异和它们的方法的缺点；分析了MSPC在网络中应用的特点和面临的挑战。所有这些都是通过支持我们的讨论和推理的说明性实验来证明的。(C) 2016 Elsevier Ltd.版权所有。
The multivariate approach based on Principal Component Analysis (PCA) for anomaly detection received a lot of attention from the networking community one decade ago, mainly thanks to the work of Lakhina and co-workers. However, this work was criticized by several authors who claimed a number of limitations of the approach. Neither the original proposal nor the critic publications were completely aware of the established methodology for PCA anomaly detection, which by that time had been developed for more than three decades in the area of industrial monitoring and chemometrics as part of the Multivariate Statistical Process Control (MSPC) theory. In this paper, the main steps of the MSPC approach based on PCA are introduced; related networking literature is reviewed, highlighting some differences with MSPC and drawbacks in their approaches; and specificities and challenges in the application of MSPC to networking are analyzed. All of this is demonstrated through illustrative experimentation that supports our discussion and reasoning. (C) 2016 Elsevier Ltd. All rights reserved.