Creating and sharing knowledge for telecommunications

Autonomous profile-based anomaly detection system using principal component analysis and flow analysis

Fernandes, G. F. ; Rodrigues, J. R. ; Proença, M. P.

Applied Soft Computing Journal Vol. 34, Nº Setember, pp. 513 - 525, September, 2015.

ISSN (print): 1568-4946
ISSN (online):

Journal Impact Factor: 2,810 (in 2014)

Digital Object Identifier: 10.1016/j.asoc.2015.05.019

Different techniques and methods have been widely used in the subject of automatic anomaly detection in computer networks. Attacks, problems and internal failures when not detected early may badly harm an entire Network system. Thus, an autonomous anomaly detection system based on the statistical method Principal Component Analysis (PCA) is proposed. This approach creates a network profile called Digital Signature of Network Segment using Flow Analysis (DSNSF) that denotes the predicted normal behavior of a network traffic activity through historical data analysis. That digital signature is used as a threshold for volume anomaly detection to detect disparities in the normal traffic trend. The proposed system uses seven traffic flow attributes: Bits, Packets and Number of Flows to detect problems, and Source and Destination IP addresses and Ports, to provides the network administrator necessary information to solve them. Via evaluation techniques performed in this paper using real network traffic data, results showed good traffic prediction by the DSNSF and encouraging false alarm generation and detection accuracy on the detection schema using thresholds.