Resilient real-time network anomaly detection using novel non-parametric statistical tests

摘要: Abstract This work describes a novel application of robust estimation to the detection volumetric anomalies in computer network traffic. The proposed tests are based on sample location and dispersion derived from relatively unknown Zero Order Statistics. non-parametric suitable for range applications heavy-tailed data analysis outside performance these is examined using two different real-world denial-of-service attacks contained actual high-volume backbone outperform traditional metrics such as mean variance due presence heavy tails traffic, frequent characteristic traffic networks. Monte Carlo used quantify gains show an improvement accuracy between 7 11% at very low false alarm rates. also demonstrate equivalent or superior median, common statistic. Constructive timing key system processes near real-time performance. Three- six- second windows containing 750 1200 elements can be processed less than one commodity hardware running unoptimized code. These results imply scalability variety networks commercial applications. Scalability prospects further enhanced by demonstrating resilient attack volumes 25 100 percent baseline rates both real generated