Internet Anomaly Detection Based on Complex Network Path

Jinfa WANG; Siyuan JIA; Hai ZHAO; Jiuqiang XU; Chuan LIN

doi:10.1587/transcom.2017EBP3392

Internet Anomaly Detection Based on Complex Network Path

Jinfa WANG, Siyuan JIA, Hai ZHAO, Jiuqiang XU, Chuan LIN

Full Text Views

0

Cite this

Summary :

Detecting anomalies, such as network failure or intentional attack in Internet, is a vital but challenging task. Although numerous techniques have been developed based on Internet traffic, detecting anomalies from the perspective of Internet topology structure is going to be possible because the anomaly detection of structured datasets based on complex network theory has become a focus of attention recently. In this paper, an anomaly detection method for the large-scale Internet topology is proposed to detect local structure crashes caused by the cascading failure. In order to quantify the dynamic changes of Internet topology, the network path changes coefficient (NPCC) is put forward which highlights the Internet abnormal state after it is attacked continuously. Furthermore, inspired by Fibonacci Sequence, we proposed the decision function that can determine whether the Internet is abnormal or not. That is the current Internet is abnormal if its NPCC is out of the normal domain calculated using the previous k NPCCs of Internet topology. Finally the new Internet anomaly detection method is tested against the topology data of three Internet anomaly events. The results show that the detection accuracy of all events are over 97%, the detection precision for three events are 90.24%, 83.33% and 66.67%, when k=36. According to the experimental values of index F₁, larger values of k offer better detection performance. Meanwhile, our method has better performance for the anomaly behaviors caused by network failure than those caused by intentional attack. Compared with traditional anomaly detection methods, our work is more simple and powerful for the government or organization in items of detecting large-scale abnormal events.

Publication: IEICE TRANSACTIONS on Communications Vol.E101-B No.12 pp.2397-2408

Publication Date: 2018/12/01

Publicized: 2018/06/22

Online ISSN: 1745-1345

DOI: 10.1587/transcom.2017EBP3392

Type of Manuscript: PAPER

Category: Internet

Authors

Jinfa WANG
  Northeastern University
Siyuan JIA
  Northeastern University
Hai ZHAO
  Northeastern University
Jiuqiang XU
  Northeastern University
Chuan LIN
  Northeastern University

Keyword

Internet, anomaly detection, complex network, network diameter, network effective path, network mean shortest path

Cite this

Copy

Jinfa WANG, Siyuan JIA, Hai ZHAO, Jiuqiang XU, Chuan LIN, "Internet Anomaly Detection Based on Complex Network Path" in IEICE TRANSACTIONS on Communications, vol. E101-B, no. 12, pp. 2397-2408, December 2018, doi: 10.1587/transcom.2017EBP3392.
Abstract: Detecting anomalies, such as network failure or intentional attack in Internet, is a vital but challenging task. Although numerous techniques have been developed based on Internet traffic, detecting anomalies from the perspective of Internet topology structure is going to be possible because the anomaly detection of structured datasets based on complex network theory has become a focus of attention recently. In this paper, an anomaly detection method for the large-scale Internet topology is proposed to detect local structure crashes caused by the cascading failure. In order to quantify the dynamic changes of Internet topology, the network path changes coefficient (NPCC) is put forward which highlights the Internet abnormal state after it is attacked continuously. Furthermore, inspired by Fibonacci Sequence, we proposed the decision function that can determine whether the Internet is abnormal or not. That is the current Internet is abnormal if its NPCC is out of the normal domain calculated using the previous k NPCCs of Internet topology. Finally the new Internet anomaly detection method is tested against the topology data of three Internet anomaly events. The results show that the detection accuracy of all events are over 97%, the detection precision for three events are 90.24%, 83.33% and 66.67%, when k=36. According to the experimental values of index F₁, larger values of k offer better detection performance. Meanwhile, our method has better performance for the anomaly behaviors caused by network failure than those caused by intentional attack. Compared with traditional anomaly detection methods, our work is more simple and powerful for the government or organization in items of detecting large-scale abnormal events.
URL: https://global.ieice.org/en_transactions/communications/10.1587/transcom.2017EBP3392/_p

Copy

@ARTICLE{e101-b_12_2397,
author={Jinfa WANG, Siyuan JIA, Hai ZHAO, Jiuqiang XU, Chuan LIN, },
journal={IEICE TRANSACTIONS on Communications},
title={Internet Anomaly Detection Based on Complex Network Path},
year={2018},
volume={E101-B},
number={12},
pages={2397-2408},
abstract={Detecting anomalies, such as network failure or intentional attack in Internet, is a vital but challenging task. Although numerous techniques have been developed based on Internet traffic, detecting anomalies from the perspective of Internet topology structure is going to be possible because the anomaly detection of structured datasets based on complex network theory has become a focus of attention recently. In this paper, an anomaly detection method for the large-scale Internet topology is proposed to detect local structure crashes caused by the cascading failure. In order to quantify the dynamic changes of Internet topology, the network path changes coefficient (NPCC) is put forward which highlights the Internet abnormal state after it is attacked continuously. Furthermore, inspired by Fibonacci Sequence, we proposed the decision function that can determine whether the Internet is abnormal or not. That is the current Internet is abnormal if its NPCC is out of the normal domain calculated using the previous k NPCCs of Internet topology. Finally the new Internet anomaly detection method is tested against the topology data of three Internet anomaly events. The results show that the detection accuracy of all events are over 97%, the detection precision for three events are 90.24%, 83.33% and 66.67%, when k=36. According to the experimental values of index F₁, larger values of k offer better detection performance. Meanwhile, our method has better performance for the anomaly behaviors caused by network failure than those caused by intentional attack. Compared with traditional anomaly detection methods, our work is more simple and powerful for the government or organization in items of detecting large-scale abnormal events.},
keywords={},
doi={10.1587/transcom.2017EBP3392},
ISSN={1745-1345},
month={December},}

Copy

TY - JOUR
TI - Internet Anomaly Detection Based on Complex Network Path
T2 - IEICE TRANSACTIONS on Communications
SP - 2397
EP - 2408
AU - Jinfa WANG
AU - Siyuan JIA
AU - Hai ZHAO
AU - Jiuqiang XU
AU - Chuan LIN
PY - 2018
DO - 10.1587/transcom.2017EBP3392
JO - IEICE TRANSACTIONS on Communications
SN - 1745-1345
VL - E101-B
IS - 12
JA - IEICE TRANSACTIONS on Communications
Y1 - December 2018
AB - Detecting anomalies, such as network failure or intentional attack in Internet, is a vital but challenging task. Although numerous techniques have been developed based on Internet traffic, detecting anomalies from the perspective of Internet topology structure is going to be possible because the anomaly detection of structured datasets based on complex network theory has become a focus of attention recently. In this paper, an anomaly detection method for the large-scale Internet topology is proposed to detect local structure crashes caused by the cascading failure. In order to quantify the dynamic changes of Internet topology, the network path changes coefficient (NPCC) is put forward which highlights the Internet abnormal state after it is attacked continuously. Furthermore, inspired by Fibonacci Sequence, we proposed the decision function that can determine whether the Internet is abnormal or not. That is the current Internet is abnormal if its NPCC is out of the normal domain calculated using the previous k NPCCs of Internet topology. Finally the new Internet anomaly detection method is tested against the topology data of three Internet anomaly events. The results show that the detection accuracy of all events are over 97%, the detection precision for three events are 90.24%, 83.33% and 66.67%, when k=36. According to the experimental values of index F₁, larger values of k offer better detection performance. Meanwhile, our method has better performance for the anomaly behaviors caused by network failure than those caused by intentional attack. Compared with traditional anomaly detection methods, our work is more simple and powerful for the government or organization in items of detecting large-scale abnormal events.
ER -