Diagnosing network-wide traffic anomalies

TLDR

Anomalies are significant changes in network traffic that can span multiple links, and diagnosing them is critical for operators and users, yet the problem is difficult due to high‑dimensional noisy data. The paper proposes a general method to diagnose network traffic anomalies. The method separates traffic measurements into normal and anomalous subspaces using Principal Component Analysis, enabling detection, identification, and quantification of volume anomalies from simple link measurements. It accurately diagnoses large volume anomalies with a very low false‑alarm rate in real backbone traffic and synthetic injections.

Abstract

Anomalies are unusual and significant changes in a network's traffic levels, which can often span multiple links. Diagnosing anomalies is critical for both network operators and end users. It is a difficult problem because one must extract and interpret anomalous patterns from large amounts of high-dimensional, noisy data.In this paper we propose a general method to diagnose anomalies. This method is based on a separation of the high-dimensional space occupied by a set of network traffic measurements into disjoint subspaces corresponding to normal and anomalous network conditions. We show that this separation can be performed effectively by Principal Component Analysis.Using only simple traffic measurements from links, we study volume anomalies and show that the method can: (1) accurately detect when a volume anomaly is occurring; (2) correctly identify the underlying origin-destination (OD) flow which is the source of the anomaly; and (3) accurately estimate the amount of traffic involved in the anomalous OD flow.We evaluate the method's ability to diagnose (i.e., detect, identify, and quantify) both existing and synthetically injected volume anomalies in real traffic from two backbone networks. Our method consistently diagnoses the largest volume anomalies, and does so with a very low false alarm rate.