Traffic volume anomalies refer to apparently abrupt changes in the time series of traffic volume, which can propagate through the network. Detecting and tracing these anomalies is a critical and difficult task for network operators. In this paper, we first propose a traffic decomposition method, which decomposes the traffic into three components: the trend component, the autoregressive (AR) component, and the noise component. A traffic volume anomaly is detected when the AR component is outside the prediction band for multiple links simultaneously. Then, the anomaly is traced using the projection of the detection result matrices for the observed links which are selected by a shortest-path-first algorithm. Finally, we validate our detection and tracing method by using the real traffic data from the third-generation Science Information Network (SINET3) and show the detected and traced results.
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Copy
Ping DU, Shunji ABE, Yusheng JI, Seisho SATO, Makio ISHIGURO, "A Traffic Decomposition and Prediction Method for Detecting and Tracing Network-Wide Anomalies" in IEICE TRANSACTIONS on Information,
vol. E92-D, no. 5, pp. 929-936, May 2009, doi: 10.1587/transinf.E92.D.929.
Abstract: Traffic volume anomalies refer to apparently abrupt changes in the time series of traffic volume, which can propagate through the network. Detecting and tracing these anomalies is a critical and difficult task for network operators. In this paper, we first propose a traffic decomposition method, which decomposes the traffic into three components: the trend component, the autoregressive (AR) component, and the noise component. A traffic volume anomaly is detected when the AR component is outside the prediction band for multiple links simultaneously. Then, the anomaly is traced using the projection of the detection result matrices for the observed links which are selected by a shortest-path-first algorithm. Finally, we validate our detection and tracing method by using the real traffic data from the third-generation Science Information Network (SINET3) and show the detected and traced results.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.E92.D.929/_p
Copy
@ARTICLE{e92-d_5_929,
author={Ping DU, Shunji ABE, Yusheng JI, Seisho SATO, Makio ISHIGURO, },
journal={IEICE TRANSACTIONS on Information},
title={A Traffic Decomposition and Prediction Method for Detecting and Tracing Network-Wide Anomalies},
year={2009},
volume={E92-D},
number={5},
pages={929-936},
abstract={Traffic volume anomalies refer to apparently abrupt changes in the time series of traffic volume, which can propagate through the network. Detecting and tracing these anomalies is a critical and difficult task for network operators. In this paper, we first propose a traffic decomposition method, which decomposes the traffic into three components: the trend component, the autoregressive (AR) component, and the noise component. A traffic volume anomaly is detected when the AR component is outside the prediction band for multiple links simultaneously. Then, the anomaly is traced using the projection of the detection result matrices for the observed links which are selected by a shortest-path-first algorithm. Finally, we validate our detection and tracing method by using the real traffic data from the third-generation Science Information Network (SINET3) and show the detected and traced results.},
keywords={},
doi={10.1587/transinf.E92.D.929},
ISSN={1745-1361},
month={May},}
Copy
TY - JOUR
TI - A Traffic Decomposition and Prediction Method for Detecting and Tracing Network-Wide Anomalies
T2 - IEICE TRANSACTIONS on Information
SP - 929
EP - 936
AU - Ping DU
AU - Shunji ABE
AU - Yusheng JI
AU - Seisho SATO
AU - Makio ISHIGURO
PY - 2009
DO - 10.1587/transinf.E92.D.929
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E92-D
IS - 5
JA - IEICE TRANSACTIONS on Information
Y1 - May 2009
AB - Traffic volume anomalies refer to apparently abrupt changes in the time series of traffic volume, which can propagate through the network. Detecting and tracing these anomalies is a critical and difficult task for network operators. In this paper, we first propose a traffic decomposition method, which decomposes the traffic into three components: the trend component, the autoregressive (AR) component, and the noise component. A traffic volume anomaly is detected when the AR component is outside the prediction band for multiple links simultaneously. Then, the anomaly is traced using the projection of the detection result matrices for the observed links which are selected by a shortest-path-first algorithm. Finally, we validate our detection and tracing method by using the real traffic data from the third-generation Science Information Network (SINET3) and show the detected and traced results.
ER -