Aberrant Behavior Detection in Time Series for Network Monitoring

By J. Brutlag. LiSA, 2000

367 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Diagnosing network-wide traffic anomalies (2004, methodology): “Simple instances of such a strategy are the exponential weighted moving average (EWMA) and Holt-Winters forecasting algorithms, both used in [2, 14]; more sophisticated examples are ARIMA-based Box-Jenkins forecasting models [14].”
Large-Scale Unusual Time Series Detection (2015, methodology): “We propose using Principal Component Analysis (PCA) together with multi-dimensional anomaly detection to identify unusual time series in a large collections of time series.”
Application of anomaly detection algorithms for detecting SYN flooding attacks (2004, background): “The author of [3] considers a similar approach for modelling the seasonal and trend component, and detects an anomaly when the measured variable falls outside a confidence band, which is estimated from previous differences of the measured variable and its predicted value.”
A signal analysis of network traffic anomalies (2002, methodology): “The specific im- plementation of Holt-Winters Forecasting is described in [12].”
Structural analysis of network traffic flows (2004, methodology): “A number of change detection methods have be en proposed that rely on wavelet denoising techniques [1] and deviations from forecasted be havior [3, 13] to identify outliers.”