An efficient online anomalies detection mechanism for high-speed networks
Résumé
In this paper, we propose an efficient framework for online detection and identification of network anomalies, in early stage of its occurrence, to quickly react by taking the appropriate countermeasures. The proposed framework is based on online detection of change point in a multi-layer reversible sketch, which aggregates multiple data streams from high speeds links in a stretched database. To detect network anomalies, we apply non-parametric multi-channel CUSUM algorithm at the counter value in each bucket of the proposed reversible sketch, in order to undermine flows with abrupt change, and to discover the keys of culprit flows via sketch inversion. Theoretical framework for detection and classification of attacks are presented. We also give the results of our experiments analysis at two data traces collected with Netflow and Endace DAG-3 card. Our analysis results from real-time internet traffic and online implementation show that our proposed architecture is able to detect culprit flows quickly with a high level of accuracy.