Sketch based Anomaly Detection, Identification and Performance Evaluation

An anomaly detection procedure is defined and its statistical performance are carefully quantified. It is based on a non Gaussian modeling of the marginal distributions of random projections (sketches) of traffic aggregated jointly at different levels (multiresolution). To evaluate false negative vs. false positive in a controlled, reproducible and documented framework, we apply the detection procedure to traffic time-series from our self-made anomaly database. It is obtained by performing DDoS-type attacks, using realworld attack tools, over a real operational network. Also, we illustrate that combining sketches enables us to identify the target IP destination address and faulty packets hence opening the track to attack mitigation. 1 Motivations and Contributions Motivations. Internet is becoming the major and universal communication network. It allows an increasing number of different activities of continuously evolving natures, ranging from on-line games, video-on-demand or IP voice telephony to web browsing or file exchanges. This implies accommodating the circulation of data with very different natures(texts, images, sounds,...),with widevariationsin their characteristics (file sizes,...) and with demanding and potentially antagonist constraints and requirements(real-time, acceptable delays or loss-rates, security levels, confidentiality levels, tarifications...). These many causes of diversity in nature result in Internet Traffic flows that naturally exhibit huge fluctuations around putative average behaviors. On top of this inherent large variability are potentially superimposed non stationarities such as seasonal effects (day, nights, weekends,...) or such as harder to describe and burstier in nature events (flash crowds,...). Accompanying