Robust tomography via network traffic maps leveraging sparsity and low rank

Mapping origin-to-destination network-traffic-state is pivotal for network management and proactive security tasks. However, lack of flow-level measurements as well as potential anomalies pose major challenges toward achieving these goals. Leveraging the spatiotemporal correlation of nominal traffic, and the sparse nature of anomalies, this paper proposes a novel estimator to map out both nominal and anomalous traffic components, based on link counts along with a small subset of flow-counts. Adopting a Bayesian approach with a bilinear charactrization of the nuclear- and the ℓ1-norm, a nonconvex optimization problem is formulated which takes into account inherent patterns of nominal traffic and anomalies, captured through traffic correlations, via quadratic regularizers. Traffic correlations are learned from (cyclo)stationary historical data. The nonconvex problem is solved using an alternating majorization-minimization technique which provably converges to a stationary point. Simulated tests confirm the effectiveness of the novel estimator.