Traffic Anomaly Detection Using Multi-Dimensional Entropy Classification in Backbone Network

Traffic anomaly detection require not only high detection rate but also low false alarm rate in high speed backbone networks. A multi-dimensional entropy classification method is proposed to satisfy this demand, which uses entropy to measure the distribution of traffic in some traffic dimensions. An efficient algorithm is introduced to estimate entropy with low computational and space complexity. The values of entropy of all dimensions are collected to form a detection vector in each sliding window, then all detection vectors are classified into two groups: abnormal vectors and normal vectors via one-class support vector machine. In order to achieve the goal of accuracy and reduce false positive rate, we utilize a multi-windows correlation algorithm to calculate a comprehensive anomaly score when observing a sequence of windows. Some real-world traces are used to validate and evaluate the effectiveness and accuracy of this detection system through two experiments. Results of the first experiment demonstrate the effectiveness of the detection system and show that the time and space grow relatively flat as traffic and attack increase. Compared with the exited systems in the second experiment, the accuracy of the system is evaluated and our system is the most accurate method.