Abstract:
Aiming at the lack of the single link's anomaly detection and the network-wide traffic's anomaly detection, we propose a network-wide multi-traffic correlative anomaly detection method. This method uses the characteristic that the anomaly signals on different links or origin-destination (OD) flows, produced by one anomaly, are similar in frequency, the transformation characteristic of the amplitude, and so on. And the comparability is used as the evidence of the anomaly detection. In principle, the traffic is forecasted by the previous data on every OD flow or link, the anomaly traffic is obtained by subtracting the real traffic from the forecast data, and lastly, the traffic anomaly is detected by global correlation analysis on all traffics. Simulation result indicates that this kind of method can detect the anomaly.