Premium
Improving PCA‐based anomaly detection by using multiple time scale analysis and Kullback–Leibler divergence
Author(s) -
Callegari Christian,
Gazzarrini Loris,
Giordano Stefano,
Pagano Michele,
Pepe Teresa
Publication year - 2014
Publication title -
international journal of communication systems
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.344
H-Index - 49
eISSN - 1099-1131
pISSN - 1074-5351
DOI - 10.1002/dac.2432
Subject(s) - computer science , kullback–leibler divergence , anomaly detection , divergence (linguistics) , anomaly (physics) , data mining , scale (ratio) , artificial intelligence , philosophy , linguistics , physics , quantum mechanics , condensed matter physics
SUMMARY The increasing number of network attacks causes growing problems for network operators and users. Thus, detecting anomalous traffic is of primary interest in IP networks management. In this paper, we address the problem considering a method based on PCA for detecting network anomalies. In more detail, this paper presents a new technique that extends the state of the art in PCA‐based anomaly detection. Indeed, by means of multi‐scale analysis and Kullback–Leibler divergence, we are able to obtain great improvements with respect to the performance of the ‘classical’ approach. Moreover, we also introduce a method for identifying the flows responsible for an anomaly detected at the aggregated level. The performance analysis, presented in this paper, demonstrates the effectiveness of the proposed method.Copyright © 2012 John Wiley & Sons, Ltd.