Detecting and Tracing Traffic Volume Anomalies in SINET3 Backbone Network

Traffic volume anomalies refer to apparent abrupt changes in time series of traffic volume, which can be propagate through the network. Detecting and tracing anomalies is a critical and difficult task for network operators. In this paper, we first propose a traffic decomposition method, which decomposes the traffic into three components: trend component, autoregressive (AR) component, and noise component. A traffic volume anomaly is detected when the AR component is out of prediction band for multiple links simultaneously. Then, the anomaly is traced using the projection of the detection result matrices for the observed links which are selected by a shortest-path-first algorithm. Finally we validate our detection and tracing method by using traffic data of the third-generation Science Information Network (SINET3) and show the detected and traced results.