Detectability of traffic anomalies in two adjacent networks

Augustin Soule, Haakon Ringberg, Fernando Silveira, Jennifer L. Rexford, Christophe Diot

Research output: Chapter in Book/Report/Conference proceedingConference contribution

8 Scopus citations


Anomaly detection remains a poorly understood area where visual inspection and manual analysis play a significant role in the effectiveness of the detection technique. We observe traffic anomalies in two adjacent networks, namely GEANT and Abilene, in order to determine what parameters impact the detectability and the characteristics of anomalies. We correlate three weeks of traffic and routing data from both networks and apply Kalman filtering to detect anomalies that transit between the two networks. We show that differences in the monitoring infrastructure, network engineering practices, and anomaly-detection parameters have a large impact on which anomaly detectability. Through a case study of three specific anomalies, we illustrate the influence of the traffic mix, IP address anonymization, detection methodology, and packet sampling on the detectability of traffic anomalies.

Original languageEnglish (US)
Title of host publicationPassive and Active Network Measurement - 8th International Conference, PAM 2007, Proceedings
PublisherSpringer Verlag
Number of pages10
ISBN (Print)9783540716167
StatePublished - 2007
Event8th International Passive and Active Measurement Conference, PAM 2007 - Louvain-la-Neuve, Belgium
Duration: Apr 5 2007Apr 6 2007

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume4427 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Other8th International Passive and Active Measurement Conference, PAM 2007

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • General Computer Science


Dive into the research topics of 'Detectability of traffic anomalies in two adjacent networks'. Together they form a unique fingerprint.

Cite this