Behavioral Anomaly Detection System on Network Application Traffic from Many Sensors

Abstract

For a computer network in the era of big data, we discuss a behavioral anomaly detection system which makes it possible to analyze and immediately detect anomaly traffic behavior. Many sensor devices connect to the network and tend to generate their application traffic at quite a low communication rate. In order to observe necessary traffic information for traffic analysis in a short time, the monitoring system integrates traffic statistics of flows sent from devices which are considered to generate the same application. It detects anomaly traffic behavior on the basis of application analysis using NMF(Non-Negative Matrix Factorization).