2014/03/02 by Tahereh Babaie, Babaie, Tahereh, Sanjay Chawla +4 · 8 citations
Computer Science · #Anomaly Detection Techniques and Applications #Anomaly detection #Artificial intelligence #Computer science #Data mining #Denial-of-service attack #FOS: Computer and information sciences #Focus (optics) #Internet Traffic Analysis and Secure E-voting #Machine Learning (cs.LG) #Matrix decomposition #Network Security and Intrusion Detection #Networking and Internet Architecture (cs.NI) #Physics #Robustness (evolution) #Trajectory #cs.LG #cs.NI
paper · pdf · doi:10.48550/arxiv.1403.0157
published in arXiv (Cornell University) (Cornell University) · Submitted to The Journal of Data Mining and Knowledge Discovery (DAMI)
arxiv created 2014/03/02 · openalex publication_date 2014/03/02 · arxiv updated 2014/03/04 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
In this paper we focus on the detection of network anomalies like Denial of Service (DoS) attacks and port scans in a unified manner. While there has been an extensive amount of research in network anomaly detection, current state of the art methods are only able to detect one class of anomalies at the cost of others. The key tool we will use is based on the spectral decomposition of a trajectory/hankel matrix which is able to detect deviations from both between and within correlation present in the observed network traffic data. Detailed experiments on synthetic and real network traces shows a significant improvement in detection capability over competing approaches. In the process we also address the issue of robustness of anomaly detection systems in a principled fashion.