Contributions on detection and classification of internet traffic anomalies

Nowadays, one certainty is that traffic is not well behaved, i.e., its pattern is always changing. Several causes have been pointed as responsible for such variations, some of them being extrinsic to the traffic, as the interaction between traffic, be it legitimate or illegitimate. In a practical point of view, traffic irregularities or traffic anomalies can be described as the result of one or more occurrences that change the normal flow of data over a network. Such occurrences can be triggered by different factors, as Denial of Service (DoS) attacks, flash crowds or management operations. Because the occurrence of such misbehaviours can lead to a lack of control over the network (i.e., security, resources or accuracy issues), since a few years the traffic anomaly related domain has become one of the top research areas, with significant and current contributions. For instance, while some work was mainly concerned with the isolation of network failures, other had, as main intention, the statistical prediction of traffic anomalies using mathematical models. While other was concerned with the introduction of new features in order to enhance traffic analysis. Network Anomaly Detection Algorithm - NADA - is an approach that intends to detect, classify and identify traffic anomalies, being a network anomaly an event that is able of introducing some level of variation on measurable network data. Such variations are disturbing since they have potential to deviate network operations from their normal behaviour. The execution of NADA and its accuracy are guaranteed by considering three axis of action: multi-criteria, multi-scale and multi aggregation level. Altogether they allow the detection of traffic anomalies in traffic traces, as well their classification through the definition of traffic profiles, particularly, anomaly traffic profiles. The latter ones are the basis for an anomaly signatures database. Moreover, the use of those three axis allows an anomaly to be detect ed independently of the traffic parameters it affects (multi-criteria axis), its duration (multi-scale axis) and its intensity (multi-level axis). Hence, anomaly detection and classification form a doublet that can be applied at several areas, ranging from network security to traffic engineering or overlay networks, to name a few. Moreover, if IP information of anomalous flows is added to all this knowledge, as NADA do, it will be possible, with minimum effort, to decide the best actions that should be taken in order to control damages from anomaly occurrences - i.e. to have a fully functional detection system.