Study of Self-Similarity for Detection of Rate-based Network Anomalies

Abstract

In this paper, we have reviewed state of the art works done in the field of anomaly detection in general and network based anomaly detection in particular. The current anomaly detection techniques with respect to rate based network anomalies have been examined and their strengths and weaknesses have been highlighted. The applicability of scale-invariant property of self-similarity as a parameter for detection of anomalies from normal network traffic behaviors has been studied in depth. From the studies of scaleinvariance and it's usage in detecting anomalies like flash crowds, DDoS attacks, outages, portscans, etc. it was realized that wavelets are a good tool that can be used for n-level decomposition of aggregated network traffic.