Anomaly detection in IP networks based on randomized subspace methods

Abstract

In this paper we propose novel randomized subspace methods to detect anomalies in Internet Protocol networks. Given a data matrix containing information about network traffic, the proposed approaches perform a normal-plus-anomalous matrix decomposition aided by the randomized sampling scheme and subsequently detect traffic anomalies in the anomalous subspace using a statistical test. Simulation results demonstrate improvement over the traditional principal component analysis-based subspace methods in terms of robustness to noise and detection rate.