计算机科学
异常检测
聚类分析
试验台
数据挖掘
遥测
僵尸网络
实时计算
故障排除
离群值
数据库扫描
人工智能
模糊聚类
计算机网络
互联网
电信
树冠聚类算法
操作系统
万维网
作者
Andrian Putina,Dario Rossi
出处
期刊:IEEE Transactions on Network and Service Management
[Institute of Electrical and Electronics Engineers]
日期:2020-11-10
卷期号:18 (1): 839-854
被引量:23
标识
DOI:10.1109/tnsm.2020.3037019
摘要
Recent technology evolution allows network equipment to continuously stream a wealth of "telemetry" information, which pertains to multiple protocols and layers of the stack, at a very fine spatial-grain and high-frequency. This deluge of telemetry data clearly offers new opportunities for network control and troubleshooting, but also poses a serious challenge for what concerns its real-time processing. We tackle this challenge by applying streaming machine-learning techniques to the continuous flow of control and data-plane telemetry data, with the purpose of real-time detection of anomalies. In particular, we implement an anomaly detection engine that leverages DenStream, an unsupervised clustering technique, and apply it to features collected from a large-scale testbed comprising tens of routers traversed up to 3Terabit/s worth of real application traffic. We contrast DenStream with offline algorithms such as DBScan and Local Outlier Factor (LOF), as well as online algorithms such as the windowed version of DBScan, ExactSTORM, Continuous Outlier Detection (COD) and Robust Random Cut Forest (RRCF). Our experimental campaign compares these seven algorithms under both accuracy and computational complexity viewpoints: results testify that DenStream (i) achieves detection results on par with RRCF, the best performing algorithm and (ii) is significantly faster than other approaches, notably over two orders of magnitude faster than RRCF. In spirit with the recent trend toward reproducibility of results, we make our code available as open source to the scientific community.
科研通智能强力驱动
Strongly Powered by AbleSci AI