Network Anomaly Detection Using Time Series Analysis

This paper presents a method of detecting network anomalies by analyzing the abrupt change of time series data obtained from management information base (MIB) variables. The method applies the auto-regressive (AR) process to model the abrupt change of time series data, and performs sequential hypothesis test to detect the anomalies. With time correlation and location correlation, the method determines not only the presence of anomalous activity, but also its occurring time and location. The experimental results show that the proposed method performs well in detecting the traffic-related anomalies