Improving network anomaly detection effectiveness via an integrated multi-metric-multi-link ((ML)-L-3) PCA-based approach

Chatzigiannakis, V; Papavassiliou, S; Androulidakis, G

dc.contributor.author	Chatzigiannakis, V	en
dc.contributor.author	Papavassiliou, S	en
dc.contributor.author	Androulidakis, G	en
dc.date.accessioned	2014-03-01T01:58:53Z
dc.date.available	2014-03-01T01:58:53Z
dc.date.issued	2009	en
dc.identifier.issn	1939-0114	en
dc.identifier.uri	https://dspace.lib.ntua.gr/xmlui/handle/123456789/28775
dc.subject	anomaly detection	en
dc.subject	network security	en
dc.subject	metric correlation	en
dc.subject	network monitoring	en
dc.subject.other	ATTACKS	en
dc.title	Improving network anomaly detection effectiveness via an integrated multi-metric-multi-link ((ML)-L-3) PCA-based approach	en
heal.type	journalArticle	en
heal.language	English	en
heal.publicationDate	2009	en
heal.abstract	In this paper an enhanced anomaly detection approach based on the fusion of data gathered from various monitors spread throughout a wide area network is introduced. The proposed approach is based on the application of principal component analysis on multi-metric-multi-link data, and provides an efficient and unified way of taking into account the combined effect of the correlated observed data, for anomaly detection purposes. It actually introduces a generalized anomaly detection methodology, capable of detecting not only volume based anomalies but also a much wider range of classes of anomalies, such as the ones that may result in alterations in traffic composition or traffic paths. The performance of the proposed multi-metric-multi-link anomaly detection approach is evaluated via simulation, and is compared against the corresponding techniques that are based on the single-metric analysis. Finally, its operational effectiveness is demonstrated in a realistic environment using real data collected from the core routers of the Greek research and technology network (GRNET). Copyright (C) 2008 John Wiley & Sons, Ltd.	en
heal.publisher	JOHN WILEY & SONS LTD	en
heal.journalName	SECURITY AND COMMUNICATION NETWORKS	en
dc.identifier.isi	ISI:000274441300006	en
dc.identifier.volume	2	en
dc.identifier.issue	3	en
dc.identifier.spage	289	en
dc.identifier.epage	304	en