Evaluation of anomaly detection based on sketch and PCA

Yoshiki Kanda*, Kensuke Fukuda, Toshiharu Sugawara


研究成果: Conference contribution

26 被引用数 (Scopus)


Using traffic random projections (sketches) and Principal Component Analysis (PCA) for Internet traffic anomaly detection has become popular topics in the anomaly detection fields, but few studies have been undertaken on the subjective and quantitative comparison of multiple methods using the data traces open to the community. In this paper, we propose a new method that combines sketches and PCA to detect and identify the source IP addresses associated with the traffic anomalies in the backbone traces measured at a single link. We compare the results with those of a method incorporating sketches and multi-resolution gamma modeling using the trans-Pacific link traces. The comparison indicates that each method has its own advantages and disadvantages. Our method is good at detecting worm activities with many packets, whereas the gamma method is good at detecting scan activities for peer hosts with only a few packets, but it reports many false positives for traces of worm outbreaks. Therefore, their use in combination would be effective. We also examined the impact of adaptive decision making on a parameter (the number of normal subspaces in PCA) on the basis of the cumulative proportion of each sketched traffic and conclude that it performs at a higher level than the previous method deciding only on one specific value of the parameter for every divided traffics.

ホスト出版物のタイトル2010 IEEE Global Telecommunications Conference, GLOBECOM 2010
出版ステータスPublished - 2010
イベント53rd IEEE Global Communications Conference, GLOBECOM 2010 - Miami, FL, United States
継続期間: 2010 12月 62010 12月 10


名前GLOBECOM - IEEE Global Telecommunications Conference


Conference53rd IEEE Global Communications Conference, GLOBECOM 2010
国/地域United States
CityMiami, FL

ASJC Scopus subject areas

  • 電子工学および電気工学


「Evaluation of anomaly detection based on sketch and PCA」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。