Detecting Network-Wide Abnormal Behavior for Network Data Streams Based on Sketch

Due to weakness of single monitor and metric to detect abnormal behavior, we propose detection of network-wide abnormal behavior for multiple data streams based on sketch (DBS). The main advantage of our approach is that it can combine connection number and flow persistence to detect network-wide abnormal behavior using a novel data structure. It only needs some simple computing and sets one bit for each node or flow. Moreover, it can accurately estimate connection number of one node and persistence of one flow. Abnormal behavior is detected using estimated connection number and flow persistence by probabilistic counting approach efficiently. Our approach mainly consists of packet preprocessing, data updating, connection number and flow persistence estimating, abnormal behavior detecting. The experiments are conducted on real network traffic and the testing results show that the proposed method outperforms JDS (Joint Data Streaming and Sampling) and LDF (Long Duration Flow) in terms of detection accuracy and time overhead.