Forecasting-Based Sampling Decision for Accurate and Scalable Anomaly Detection

This paper proposes the inclusion of two traffic forecasting frameworks in traffic sampling paradigm. The proposed frameworks: namely, the pattern forecasting and the attack forecasting, predicts the occurrence of traffic deviation and examines the existence of malicious attack in the traffic deviation, respectively. While the former utilizes the ARAR model to forecast the network traffic, the latter exploits the statistical likelihood function to determine whether any malicious attack is the origin of the traffic deviation. In addition, a dynamic weight assignment strategy is proposed to further improve the efficiency of the sampling strategy. Performance evaluation indicates that the inclusion of both forecasting frameworks and dynamic weight assignment in the sampling strategy can improve the accuracy and scalability of the anomaly detection.