Methods for network traffic anomaly detection

点击翻译按钮获取中文摘要

Network anomalies are unusual and significant changes in the general characteristics of traffic flows. Such changes can span over multiple links and involve diverse traffic parameters (e.g., changes in traffic volume, suspicious variability of source-destination IP addresses, etc.). Diagnosing anomalies is critical for both network operators and end users. The reason is that such anomalies may point to a variety of forthcoming network failures. Such failures can be categorized into two forms, soft failures and hard failures. A soft failure can be thought of as a performance degradation; whereas, a hard failure would result in network devices/elements ceasing to operate. Depending on the network, these failures can cause mild or severe inconveniences, loss of productivity, loss of economic activity, or even, loss of public well-being.