Online Anomaly Detection Leveraging Stream-Based Clustering and Real-Time Telemetry

计算机科学 异常检测 聚类分析 试验台 数据挖掘 遥测 僵尸网络 实时计算 故障排除 离群值 数据库扫描 人工智能 模糊聚类 计算机网络 互联网 电信 树冠聚类算法 操作系统 万维网
作者
Andrian Putina,Dario Rossi
出处
期刊:IEEE Transactions on Network and Service Management [Institute of Electrical and Electronics Engineers]
卷期号:18 (1): 839-854 被引量:23
标识
DOI:10.1109/tnsm.2020.3037019
摘要

Recent technology evolution allows network equipment to continuously stream a wealth of "telemetry" information, which pertains to multiple protocols and layers of the stack, at a very fine spatial-grain and high-frequency. This deluge of telemetry data clearly offers new opportunities for network control and troubleshooting, but also poses a serious challenge for what concerns its real-time processing. We tackle this challenge by applying streaming machine-learning techniques to the continuous flow of control and data-plane telemetry data, with the purpose of real-time detection of anomalies. In particular, we implement an anomaly detection engine that leverages DenStream, an unsupervised clustering technique, and apply it to features collected from a large-scale testbed comprising tens of routers traversed up to 3Terabit/s worth of real application traffic. We contrast DenStream with offline algorithms such as DBScan and Local Outlier Factor (LOF), as well as online algorithms such as the windowed version of DBScan, ExactSTORM, Continuous Outlier Detection (COD) and Robust Random Cut Forest (RRCF). Our experimental campaign compares these seven algorithms under both accuracy and computational complexity viewpoints: results testify that DenStream (i) achieves detection results on par with RRCF, the best performing algorithm and (ii) is significantly faster than other approaches, notably over two orders of magnitude faster than RRCF. In spirit with the recent trend toward reproducibility of results, we make our code available as open source to the scientific community.
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
大幅提高文件上传限制,最高150M (2024-4-1)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
华仔应助olivia采纳,获得10
1秒前
赘婿应助小Q啊啾采纳,获得10
1秒前
Tim发布了新的文献求助10
1秒前
斯文墨镜完成签到,获得积分10
1秒前
puple完成签到,获得积分10
1秒前
图苏发布了新的文献求助30
1秒前
llllll发布了新的文献求助10
2秒前
风趣的黑夜完成签到,获得积分10
3秒前
14523698发布了新的文献求助10
4秒前
朱彬完成签到 ,获得积分10
4秒前
珑仔发布了新的文献求助10
4秒前
4秒前
丙寅完成签到,获得积分20
5秒前
5秒前
陈隆发布了新的文献求助10
5秒前
songyl完成签到,获得积分20
6秒前
6秒前
6秒前
青青发布了新的文献求助10
6秒前
7秒前
小仙女完成签到,获得积分10
7秒前
8秒前
8秒前
8秒前
setsail0816发布了新的文献求助10
8秒前
GAW完成签到,获得积分10
8秒前
麦尔哈巴完成签到,获得积分10
9秒前
aaa完成签到,获得积分20
9秒前
pb发布了新的文献求助10
9秒前
包容的初之完成签到,获得积分10
10秒前
10秒前
10秒前
磊2024发布了新的文献求助10
10秒前
8R60d8应助大帅哥采纳,获得10
11秒前
木木发布了新的文献求助10
11秒前
可可可发布了新的文献求助10
12秒前
麦尔哈巴发布了新的文献求助10
12秒前
万能图书馆应助cc采纳,获得10
12秒前
zhangxh发布了新的文献求助20
13秒前
一只熊发布了新的文献求助10
14秒前
高分求助中
歯科矯正学 第7版(或第5版) 1004
SIS-ISO/IEC TS 27100:2024 Information technology — Cybersecurity — Overview and concepts (ISO/IEC TS 27100:2020, IDT)(Swedish Standard) 1000
Smart but Scattered: The Revolutionary Executive Skills Approach to Helping Kids Reach Their Potential (第二版) 1000
Semiconductor Process Reliability in Practice 720
GROUP-THEORY AND POLARIZATION ALGEBRA 500
Mesopotamian divination texts : conversing with the gods : sources from the first millennium BCE 500
Days of Transition. The Parsi Death Rituals(2011) 500
热门求助领域 (近24小时)
化学 医学 生物 材料科学 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 基因 遗传学 催化作用 物理化学 免疫学 量子力学 细胞生物学
热门帖子
关注 科研通微信公众号,转发送积分 3231987
求助须知:如何正确求助?哪些是违规求助? 2878991
关于积分的说明 8208546
捐赠科研通 2546450
什么是DOI,文献DOI怎么找? 1375985
科研通“疑难数据库(出版商)”最低求助积分说明 647507
邀请新用户注册赠送积分活动 622675