Anomaly detection in VoIP traffic under presence of daily ：存在的日常下VoIP流量异常检测.pptVIP

Anomaly detection in VoIP and Ethernet traffic under presence of daily patterns Piotr ?uraniewski (UvA/TNO/AGH) Felipe Mata (UAM), Michel Mandjes (UvA), Marco Mellia (POLITO) Changepoint detection Changepoint detection: finding that current statistical description of data sample is no longer valid Problem can be formulated in language of statistical hypothesis test Benefits of changepoint detection Deviation from normal system state can be detected (anomaly detection) attack on ICT infrastructure (excessive number of TCP SYN packets) failure (excessive/too low traffic volume) Service Level Agreement not met (delay out of acceptable range) Human experts empowered with additional tool Benefits of statistics-based approach Manual and on-line analysis of large data volumes may be infeasible Visual inspection may be insufficient due to some hidden structures in data Objective and unbiased opinion of human not always available Possibility to control false alarm ratio/detection ratio Problems Changepoint detection procedures often assume independent observations Real life: dependency is present stochastic one (mind ‘fractal’ models) deterministic (e.g., diurnal trends) High dependency may ruin changepoint detection test Possible solution Estimate and remove trend from traffic for VoIP traffic: try to exploit possible local Poissonian behavior exploit periodicity Only than apply changepoint detection procedure(s) to residuals residuals should be (approx.) standard normal anomaly: change from N(0,1) to N(m,s) Contribution We have developed changepoint detection test able to detect simultaneous change in mean and variance for Gaussian input We have numerically assessed sensitivity to deviation from independence assumption our simple trend removal method may still leave some dependency in residuals Synthetic Gaussian trace Window of 50 observation presented to detector, sequential manner, delta – relative position of changepoint True change from N(0,1) to N(3.07,