SARIMA based network bandwidth anomaly detection

Network bandwidth is considered a valuable resource in most computer systems. To precisely detect network anomalies (with a few false alarms), an intrusion detection system requires reliable methods. A potential solution in predicting network bandwidth usage is using a time-series model with a threshold. This paper proposes a network anomaly detection technique based on SARIMA, a time-series model, to capture seasonal behavior of bandwidth usage of most networks. Our proposed SARIMA based anomaly detection is capable of detecting network bandwidth anomalies effectively when a threshold equals to 8.5 percents of maximum bandwidth in a day. Our result yields 3.57 percents of false alarms. We concluded that SARIMA is a better instrumental tool for intrusion detection comparing to ARIMA.