TY - JOUR

T1 - Effects of sampling and spatio/temporal granularity in traffic monitoring on anomaly detectability

AU - Ishibashi, Keisuke

AU - Kawahara, Ryoichi

AU - Mori, Tatsuya

AU - Kondoh, Tsuyoshi

AU - Asano, Shoichiro

PY - 2012/2

Y1 - 2012/2

N2 - We quantitatively evaluate how sampling and spatio/ temporal granularity in traffic monitoring affect the detectability of anomalous traffic. Those parameters also affect the monitoring burden, so network operators face a trade-off between the monitoring burden and detectability and need to know which are the optimal paramter values. We derive equations to calculate the false positive ratio and false negative ratio for given values of the sampling rate, granularity, statistics of normal traffic, and volume of anomalies to be detected. Specifically, assuming that the normal traffic has a Gaussian distribution, which is parameterized by its mean and standard deviation, we analyze how sampling and monitoring granularity change these distribution parameters. This analysis is based on observation of the backbone traffic, which exhibits spatially uncorrelated and temporally long-range dependence. Then we derive the equations for detectability. With those equations, we can answer the practical questions that arise in actual network operations: what sampling rate to set to find the given volume of anomaly, or, if the sampling is too high for actual operation, what granularity is optimal to find the anomaly for a given lower limit of sampling rate.

AB - We quantitatively evaluate how sampling and spatio/ temporal granularity in traffic monitoring affect the detectability of anomalous traffic. Those parameters also affect the monitoring burden, so network operators face a trade-off between the monitoring burden and detectability and need to know which are the optimal paramter values. We derive equations to calculate the false positive ratio and false negative ratio for given values of the sampling rate, granularity, statistics of normal traffic, and volume of anomalies to be detected. Specifically, assuming that the normal traffic has a Gaussian distribution, which is parameterized by its mean and standard deviation, we analyze how sampling and monitoring granularity change these distribution parameters. This analysis is based on observation of the backbone traffic, which exhibits spatially uncorrelated and temporally long-range dependence. Then we derive the equations for detectability. With those equations, we can answer the practical questions that arise in actual network operations: what sampling rate to set to find the given volume of anomaly, or, if the sampling is too high for actual operation, what granularity is optimal to find the anomaly for a given lower limit of sampling rate.

KW - Anomaly detection

KW - Hurst parameter

KW - Sampling

KW - Spatio/temporal granularity

UR - http://www.scopus.com/inward/record.url?scp=84856368359&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84856368359&partnerID=8YFLogxK

U2 - 10.1587/transcom.E95.B.466

DO - 10.1587/transcom.E95.B.466

M3 - Article

AN - SCOPUS:84856368359

VL - E95-B

SP - 466

EP - 476

JO - IEICE Transactions on Communications

JF - IEICE Transactions on Communications

SN - 0916-8516

IS - 2

ER -