Anomaly Detection Using Forecasting Methods ARIMA and HWDS

Abstract

Understanding the normal operation of IP networks is a common step in building a solution for automatic detection of network anomalies. Toward this end, we analyze the usage of two different approaches: the AutoRegressive Integrated Moving Average (ARIMA) model and an improvement of the traditional Holt-winters method. We use both models for traffic characterization, called Digital Signature of Network Segment using Flow analysis (DSNSF), and volume anomaly or outliers detection. The DSNSFs obtained by the presented models are compared to the actual traffic of bits and packets of a real network environment and then subjected to specific evaluations in order to measure its accuracy. The presented models are capable of providing feedback through its predictive capabilities and hence provide an early warning system.