Predicting network failures using anomaly detection methods

使用异常检测方法预测网络故障

• 批准号: 485098-2015
• 负责人: Japkowicz, Nathalie
• 金额: $ 1.82万
• 依托单位: University of Ottawa
• 依托单位国家: 加拿大
• 项目类别: Engage Grants Program
• 财政年份: 2015
• 资助国家: 加拿大
• 起止时间: 2015-01-01 至 2016-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=584724
• 关键词: Predicting; network; failures; using; anomaly

Networks of all kinds often experience anomalous behaviour that is a sudden and short-lived deviation from its normal operation. Examples include attacks or large data transfers in networks. Some anomalies are deliberately caused by intruders with malicious intent such as cyber-attack, while others may be purely accidental such as an overpass falling in a busy road network. Quick detection is needed to initiate a timely response, especially if the goal of the detector is to identify and/or predict network failures, to detect security issues such as intrusion or denial of services attacks, to detect changing traffic patterns, etc. The purpose of this project is to generate a general tool applicable to different kind of networks. For this reason, it is useful to consider machine learning based techniques that can adapt to each network's specific conditions. Furthermore, given that anomalies in networks can take many different forms that cannot be anticipated ahead of time, anomaly detection algorithms such as one-class learning systems are desirable. Indeed, such approaches will allow to model the normal operation of the network and issue an alarm when a deviation from this normal operation is detected. The networks that will be considered in this project will be massive networks and may be generating stream data. Therefore, we will adapt existing one-class learning techniques or develop new ones that scale well to big data sets and can deal with a fast online data presentation regimen.

所有类型的网络经常经历异常行为，这是对其正常运行的突然和短暂的偏离。例如，网络中的攻击或大数据传输。有些异常是入侵者故意造成的，带有恶意意图，如网络攻击，而另一些可能纯粹是意外，如立交桥坠落在繁忙的路网中。需要快速检测来启动及时响应，特别是如果检测器的目标是识别和/或预测网络故障、检测诸如入侵或拒绝服务攻击等安全问题、检测不断变化的流量模式等。 这个项目的目的是生成一个适用于不同类型网络的通用工具。因此，考虑基于机器学习的技术以适应每个网络的特定条件是有用的。此外，考虑到网络中的异常可以采取许多不同的形式，并且无法提前预测，因此需要诸如单类学习系统之类的异常检测算法。事实上，这种方法将允许对网络的正常操作进行建模，并在检测到偏离该正常操作时发出警报。 本项目将考虑的网络将是大规模网络，可能会产生流数据。因此，我们将调整现有的单课学习技术，或开发新的技术，使其能够很好地扩展到大数据集，并能够处理快速的在线数据呈现方案。