Sorry, you need to enable JavaScript to visit this website.

Non-linear regression for bivariate self-similarity identification - application to anomaly detection in Internet traffic based on a joint scaling analysis of packet and byte counts

Citation Author(s):
Jordan Frecon , Romain Fontugne , Gustavo Didier , Nelly Pustelnik , Kensuke Fukuda , Patrice Abry
Submitted by:
Jordan Frecon
Last updated:
24 March 2016 - 10:00am
Document Type:
Presentation Slides
Document Year:
2016
Event:
Presenters:
Jordan Frecon
Paper Code:
SPTM-L9.2
 

Internet traffic monitoring is a crucial task for network security. Self-similarity, a key property for a relevant description of internet traffic statistics, has already been massively and successfully involved in anomaly detection. Self-similar analysis was however so far applied either to byte or Packet count time series independently, while both signals are jointly collected and technically deeply related. The present contribution elaborates on a recently proposed multivariate self-similar model, Operator fractional Brownian Motion (OfBm), to
analyze jointly self-similarity in bytes and packets. A non-linear regression procedure, based on an original Branch & Bound resolution procedure, is devised for the full identification of bivariate OfBm. The estimation performance is assessed by means of Monte Carlo simulations. Further, an Internet traffic anomaly detection procedure is proposed, that makes use of the vector of Hurst exponents underlying the OfBm based Internet data modeling. Applied to a large set of high quality and modern Internet data from the MAWI repository, proof-of-concept results in anomaly detection are detailed and discussed.

up
0 users have voted: