Improving network anomaly detection effectiveness via an integrated multi-metric-multi-link (M3L) PCA-based approach

Chatzigiannakis, V; Papavassiliou, S; Androulidakis, G

dc.contributor.author	Chatzigiannakis, V	en
dc.contributor.author	Papavassiliou, S	en
dc.contributor.author	Androulidakis, G	en
dc.date.accessioned	2014-03-01T01:30:52Z
dc.date.available	2014-03-01T01:30:52Z
dc.date.issued	2009	en
dc.identifier.issn	19390122	en
dc.identifier.uri	https://dspace.lib.ntua.gr/xmlui/handle/123456789/19667
dc.subject	Anomaly detection	en
dc.subject	Metric correlation	en
dc.subject	Network monitoring	en
dc.subject	Network security	en
dc.subject.other	Anomaly detection	en
dc.subject.other	Combined effect	en
dc.subject.other	Core routers	en
dc.subject.other	Metric analysis	en
dc.subject.other	Metric correlation	en
dc.subject.other	Multi-link	en
dc.subject.other	Network anomaly detection	en
dc.subject.other	Network monitoring	en
dc.subject.other	Observed data	en
dc.subject.other	Operational effectiveness	en
dc.subject.other	Realistic environments	en
dc.subject.other	Technology network	en
dc.subject.other	Traffic compositions	en
dc.subject.other	Financial data processing	en
dc.subject.other	Internet	en
dc.subject.other	Metric system	en
dc.subject.other	Principal component analysis	en
dc.subject.other	Network security	en
dc.title	Improving network anomaly detection effectiveness via an integrated multi-metric-multi-link (M3L) PCA-based approach	en
heal.type	journalArticle	en
heal.identifier.primary	10.1002/sec.69	en
heal.identifier.secondary	http://dx.doi.org/10.1002/sec.69	en
heal.publicationDate	2009	en
heal.abstract	In this paper an enhanced anomaly detection approach based on the fusion of data gathered from various monitorsspread throughout a wide area network is introduced. The proposed approach is based on the application of principal component analysis on multi-metric-multi-link data, and provides an efficient and unified way of taking into account the combined effect of the correlated observed data, for anomaly detection purposes. It actually introduces a generalized anomaly detection methodology, capable of detecting not only volume based anomalies but also a much wider range of classes of anomalies, such as the ones that may result in alterations in traffic composition or traffic paths. The performance of the proposed multi-metric-multi-link anomaly detection approach is evaluated via simulation, and is compared against the corresponding techniques that are based on the single-metric analysis. Finally, its operational effectiveness is demonstrated in a realistic environment using real data collected from the core routers of the Greek research and technology network (GRNET). © 2008 JohnWiley & Sons, Ltd.	en
heal.journalName	Security and Communication Networks	en
dc.identifier.doi	10.1002/sec.69	en
dc.identifier.volume	2	en
dc.identifier.issue	3	en
dc.identifier.spage	289	en
dc.identifier.epage	304	en