An Application of Robust Principal Component Analysis Methods for Anomaly Detection

Abstract

Ensuring a secure network environment is crucial, especially with the increasing number of threats and attacks on digital systems. Implementing effective security measures, such as anomaly detection can help detect any abnormal traffic patterns. Several statistical and machine learning aproaches are used to detect network anomalies including robust statistical methods. Robust methods can help identifying abnormal traffic patterns and distinguish them from the normal traffic accurately. In this study, a robust Principal Component Analysis (PCA) method called ROBPCA which is known for its extensive use in the literature of chemometrics and genetics is utilized for detecting network anomalies and compared with another robust PCA method called PCAGRID. The anomaly detection performances of these methods are evaluated by injecting synthetic traffic volume into a well-known traffic matrix. According to the application results, when the normal subspace contaminated with large anomalies the ROBPCA method provided much better performance in detecting anomalies.