Detecting low-rate periodic events in Internet traffic using renewal theory

In our previous work [1, 2] we studied detection of anomalies in packet arrival times for computer networks, most detection of denial-of-service (DoS) attacks in Internet traffic. In this paper we reformulate the detection method proposed in [1] using renewal theory, providing several useful extensions. This reformulation also leads to a method that would be applicable to numerous real life signals that exist as discrete events, e.g., biological signals. Most importantly renewal theory allows us to characterize the performance of our detector and determine theoretical bounds on the time-to-detection. Compared to alternative methods that use frequency spectra or event arrival rates for detection our method is shown to be superior in terms of time-to-detection. Further, unlike rate based techniques, our method can estimate the multiple periods when multiple periodic anomalies occur simultaneously.