Authors:
Mario H. A. C. Adaniya
;
Moises F. Lima
;
Lucas D. H. Sampaio
;
Taufik Abrão
and
Mario Lemes Proença Jr.
Affiliation:
UEL and State University of Londrina, Brazil
Keyword(s):
Anomaly detection, Data clustering, Firefly algorithm, K-harmonic means.
Related
Ontology
Subjects/Areas/Topics:
Data Communication Networking
;
Fault Detection and Management
;
Network Monitoring and Control
;
Sensor Networks
;
Signal Processing
;
Telecommunications
;
Traffic Measurement, Analysis, Modeling and Visualization
Abstract:
The performance of communication networks can be affected by a number of factors including misconfiguration, equipments outages, attacks originated from legitimate behavior or not, software errors, among many other causes. These factors may cause an unexpected change in the traffic behavior, creating what we call anomalies that may represent a loss of performance or breach of network security. Knowing the behavior pattern of the network is essential to detect and characterize an anomaly. Therefore, this paper presents an algorithm based on the use of Digital Signature of Network Segment (DSNS), used to model the traffic behavior
pattern. We propose a clustering algorithm, K-Harmonic means (KHM), combined with a new heuristic approach, Firefly Algorithm (FA), for network volume anomaly detection. The KHM calculate a weighting function of each point to calculate new centroids and circumventing the initialization problem present in most center based clustering algorithm and exploits the
search capability of FA from escaping local optima. Processing the DSNS data and real traffic adata is possible to detect and point intervals considered anomalous with a trade-off between the 90% true-positive rate and 30% false-positive rate.
(More)