BasisDetect: a model-based network event detection framework

  • Authors:
  • Brian Eriksson;Paul Barford;Rhys Bowden;Nick Duffield;Joel Sommers;Matthew Roughan

  • Affiliations:
  • UW-Madison, Madison, WI, USA;UW-Madison and Nemean Networks, Madison, WI, USA;University of Adelaide, Adelaide, Australia;AT&T Research, Florham Park, NJ, USA;Colgate University, Hamilton, NY, USA;University of Adelaide, Adelaide, Australia

  • Venue:
  • IMC '10 Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

The ability to detect unexpected events in large networks can be a significant benefit to daily network operations. A great deal of work has been done over the past decade to develop effective anomaly detection tools, but they remain virtually unused in live network operations due to an unacceptably high false alarm rate. In this paper, we seek to improve the ability to accurately detect unexpected network events through the use of BasisDetect, a flexible but precise modeling framework. Using a small dataset with labeled anomalies, the BasisDetect framework allows us to define large classes of anomalies and detect them in different types of network data, both from single sources and from multiple, potentially diverse sources. Network anomaly signal characteristics are learned via a novel basis pursuit based methodology. We demonstrate the feasibility of our BasisDetect framework method and compare it to previous detection methods using a combination of synthetic and real-world data. In comparison with previous anomaly detection methods, our BasisDetect methodology results show a 50% reduction in the number of false alarms in a single node dataset, and over 65% reduction in false alarms for synthetic network-wide data.