作者: Guillaume Dewaele , Kensuke Fukuda , Pierre Borgnat , Patrice Abry , Kenjiro Cho
关键词: Computer science 、 Anomaly (natural sciences) 、 Reduction (complexity) 、 Curse of dimensionality 、 Pattern recognition 、 Artificial intelligence 、 Marginal distribution 、 Identification (information) 、 Gaussian 、 Anomaly detection 、 Random projection
摘要: A new profile-based anomaly detection and characterization procedure is proposed. It aims at performing prompt accurate of both short-lived long-lasting low-intensity anomalies, without the recourse any prior knowledge targetted traffic. Key features algorithm lie in joint use random projection techniques (sketches) a multiresolution non Gaussian marginal distribution modeling. The former enables reduction dimensionality data measurement reference (i.e., normal) traffic behavior, while latter extracts anomalies different aggregation levels. This used to blindly analyze large-scale packet trace database collected on trans-Pacific transit link from 2001 2006. can detect identify large number known unknown attacks, whose intensities are low (down below one percent). Using sketches also makes possible real-time identification source or destination IP addresses associated detected hence their mitigation.