Statistical analysis for origin-destination traffic anomalies

Origin-Destination (OD) traffic anomalies reflect network-level traffic anomaly behaviors, which is significantly dangerous to network operation. OD traffic anomalies in a network are investigated in this paper, using statistical analysis based on principle component analysis (PCA). Firstly, we use PCA method to analyze network traffic characteristics and to divide OD flows in the network into both normal and abnormal subspace. Then in abnormal subspace, OD flows are grouped according to common destination address. At the same time, we compute statistical correlations between OD flows in each group and detect traffic anomaly behavior. Finally, we exploit traffic data from a real network to validate our method. Simulation results show that our approach can effectively and accurately detect OD traffic anomalies.