Uncovering network traffic anomalies based on their sparse distributions

Characterizing network traffic with higher-dimensional features results in increased complexity of most detectors and classifiers for identifying traffic anomalies.Several key observations from existing studies confirm that network anomalies are typically distributed in a sparse way,with each anomaly essentially characterized by its lower-dimensional features.Based on this important finding,we exploit sparsity in designing a novel detection method for anomalies that ignores redundancies that are dynamically filtered from the feature sets and accurately classifies anomalies.Comparison of our method with three well known techniques shows a10%improvement in accuracy with an O(n)complexity of the classifier.