On the Modeling of RTT Time Series for Network Anomaly Detection

Abstract

Network anomalies can seriously influence the performance of networks and cause huge financial losses. Existing studies modeled the round-trip time (RTT) time series of each link and identified their abnormal patterns independently to detect the network anomalies. However, they rarely investigated the correlation among links, and they rarely considered the goodness of fit and complexity in model selection, which led to low timeliness and accuracy of detection. They failed to understand the impact of network anomalies. In this work, we propose the RTS detection approach to address these challenges. Specifically, we, firstly, propose a link clustering method to cluster the links into different classes based on the topological location of pairwise links and the similarity between their RTT time series. Then, for each class of links, we consider the goodness of fit and complexity in model selection and select the suitable model to analyze their RTT time series. Finally, we propose a detection method to detect the network anomalies by observing the deviation between the probability density distribution of the current RTT values and the reference value. We perform experiments with data from public measurement infrastructures like RIPE Atlas to evaluate the performance of our approach. The results show that our approach can not only reduce the detection time and improve the accuracy of detection effectively but also can roughly evaluate the impact of network anomalies.