Sensitivity of PCA for traffic anomaly detection

By Haakon Ringberg, Augustin Soule, Jennifer Rexford, Christophe Diot. Measurement and Modeling of Computer Systems, 2007

464 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/9c164072c481c052c0721c967ec11f6d455ad861

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Classification-Reconstruction Learning for Open-Set Recognition (2018, methodology): “Some of the generic methods for anomaly detection are oneclass extension of discriminative models such as SVM [24] or forests [21], generative models such as Gaussian mixture models [33], and subspace methods [32].”
Towards Detecting Anomalous User Behavior in Online Social Networks (2014, methodology): “We perform a parameter sweep in Section 6 and find that our anomaly detector is not overly sensitive (detection rate and false positives do not change drastically) to minor variations in the choice of number of principal components [54].”
ANTIDOTE: understanding and defending against poisoning of anomaly detectors (2009, background): “Given the increasing popularity of applying SML techniques to networking problems, we believe exploring adversarial learning with realistic threat models is important and timely.”
Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications (2018, background): “For example, the performance of PCA-based anomaly detection [19, 20, 33] is sensitive to the number of principle components.”
Discovering spatio-temporal causal interactions in traffic data streams (2011, methodology): “Under certain circumstances, large anomalies in turn can effect the PCA computation leading to both false positives and false negatives [20].”
MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking (2010, background): “Operators, however, often disregard the alarms reported by anomaly detectors because of several drawbacks discrediting them [17, 30].”
Stealthy poisoning attacks on PCA-based anomaly detectors (2009, background): “showed that routing outages can pollute the normal subspace [4]; a kind of non-adversarial disturbance to the subspace.”
Behavior of Machine Learning Algorithms in Adversarial Environments (2010, result): “The training sets used in these experiments consist of week-long traffic traces, which is a sufficiently long time scale to capture weekday and weekend cyclic trends [Ringberg et al., 2007] and it is also the same time scale used in previous studies [Lakhina et al.”
Anomaly Detection for IoT Time-Series Data: A Survey (2020, methodology): “PCA was applied to network traffic anomalies in [85] here the authors note that the method works as intended however it faces a wide number of limitations inherent with their PCA method such as large”
Spatio-temporal compressive sensing and internet traffic matrices (2009, methodology): “To address this problem, we develop a novel spatio-temporal compressive sensing framework with two key components: (i) a new technique called SPARSITY REGULARIZED MATRIX FACTORIZATION(SRMF)thatleveragesthe sparse orlow-ranknature of real-world traf.c matrices and their…”
Compromising PCA-based Anomaly Detectors for Network-Wide Traffic (2008, methodology): “We use week-long training sets, as such a time scale is sufficiently large to capture weekday and weekend diurnal trends [4].”
Adaptive Anomaly Detection via Self-calibration and Dynamic Updating (2009, background): “[ 21 ] talks about the difficulty of tuning the parameters for these techniques and discusses pollution of the normal subspace.”