Multivariate Online Anomaly Detection Using Kernel Recursive Least Squares

— High-speed backbones are regularly affected by various kinds of network anomalies, ranging from malicious attacks to harmless large data transfers. Different types of anomalies affect the network in different ways, and it is difficult to know a priori how a potential anomaly will exhibit itself in traffic statistics. In this paper we describe an online, sequential, anomaly detection algorithm, that is suitable for use with multivariate data. The proposed algorithm is based on the kernel version of the recursive least squares algorithm. It assumes no model for network traffic or anomalies, and constructs and adapts a dictionary of features that approximately spans the subspace of normal behaviour. The algorithm raises an alarm immediately upon encountering a deviation from the norm. Through comparison with existing block-based offline methods based upon Principal Component Analysis, we demonstrate that our online algorithm is equally effective but has much faster time-to-detecti...

• Type: Conference
• Year: 2007
• Where: INFOCOM
• Authors: Tarem Ahmed, Mark Coates, Anukool Lakhina
• Keywords: Algorithm, Communications, INFOCOM 2007, Large Data Transfers, Network Anomalies