Abstract

The talk will focus on the challenges that arise when applying Statistical Network Anomaly Detection in the field. In more detail three aspects will be discussed: - Dealing with huge quantities of data: the explosive growth of the traffic poses several problems when applying techniques that need to process the whole traffic. We will discuss pros and cons of some data mining techniques (e.g., Sketch and Reversible Sketch) that permits to analyze a data flow, almost in real-time, without storing all the data. -Dealing with traffic seasonality: seasonality of the traffic poses several problems in the application of most of the anomaly detection techniques. Some of the most classical approaches (e.g., Wavelet analysis) to pre-filter such seasonal components will be discussed, highlighting the improvements introduced in the system. -Dealing with distributed environment: highly distributed, multi-domains environments pose several constraints to the application of any traffic monitoring techniques (e.g., privacy concerns). We will discuss how to deal with them, so as to respect the legislation, still being able to effectively perform anomaly detection.