Diagnosing Network-Wide Traffic Anomalies：（诊断全网流量异常）.pdfVIP

Diagnosing Network-Wide Traffic Anomalies ∗ Anukool Lakhina Mark Crovella Christophe Diot Dept. of Computer Science, Dept. of Computer Science, Intel Research Boston University Boston University Cambridge, UK anukool@ crovella@ christophe.diot@ ABSTRACT Keywords Anomalies are unusual and significant changes in a network’s traf- Anomaly Detection, Network Traffic Analysis fic levels, which can often span multiple links. Diagnosing anoma- lies is critical for both network operators and end users. It is a 1. INTRODUCTION difficult problem because one must extract and interpret anomalous patterns from large amounts of high-dimensional, noisy data. Understanding the nature of traffic anomalies in a network is an In this paper we propose a general method to diagnose anoma- important problem. Regardless of whether the anomalies in ques- lies. This method is based on a separation of the high-dimensional tion are malicious or unintentional, it is important to analyze them for two reasons: space occupied by a set of network traffic measurements into dis- joint subspaces corresponding to normal and anomalous network conditions. We show that this separation can be performed effec- • Anomalies can create congestion in the network and stress tively by Prin