Anomaly Clustering Based on Correspondence Analysis

Traffic patterns in backbone IP networks often deviate from the norm, to lead to events commonly termed as anomalies. Different algorithms have been proposed in literature to identify anomalies, but very few classifiers have been proposed to classify and group the signalled anomalies. Moreover, the classification algorithms typically have a predefined number of classes and use supervised learning methods. Some classifiers apply the windowing method to make the large amount of data scalable into small groups. This paper proposes a novel method of classification of anomalous data packets with unsupervised learning using the technique of Correspondence Analysis. Correspondence Analysis does not need a predefined number of clusters to begin the classification and can handle a large amount of data. We have applied our developed algorithm on real data from the US Abilene backbone network, and compared our results with existing clustering algorithms. The results indicate that our proposed algorithm yields the best results in terms of classifying anomalies amongst the most recent classification algorithms available.

I. Introduction

Network traffic characteristics sometime deviate from normal trend, a situation which is often an early indicator of a network attack or equipment failure. Sudden, short-term deviations of network traffic characteristics from normal patterns are termed as anomalies, and many works have been done in the timely identification of network anomalies [1]. However, few researchers have focussed on anomaly classification, i.e. the process of separating, placing and clustering the identified anomalies into categories by type or behaviourial characteristics. Proper anomaly classification helps quickly understand the nature, implications and consequences of newly observed anomalies in terms of previously observed and studied kinds. Our literature search has revealed that most approaches to the task of anomaly classification begin with predefining the number of clusters [2]. In this paper, we present an Anomaly Classification algorithm that categorizes identified anomalies without setting any pre-defined number of clusters. We have developed our algorithm using the technique of Correspondence Analysis [3].