PCA-based Multivariate Statistical Network Monitoring for Anomaly Detection

José Camacho; Alejandro Pérez Villegas; Pedro García-Teodoro; Gabriel Maciá-Fernández

Abstract:

The multivariate approach based on Principal Component Analysis (PCA) for anomaly detection received a lot of attention from the networking community one decade ago mainly thanks to the work by Lakhina and co-workers. However, this work was criticized by several authors that claimed a number of limitations of the approach. Neither the original proposal nor the critic publications were completely aware of the established methodology for PCA anomaly detection, which by that time had been developed for more than three decades in the area of industrial monitoring and chemometrics as part of the Multivariate Statistical Process Control (MSPC) theory. In this paper, the main steps of the MSPC approach based on PCA are introduced; related networking literature is reviewed, highlighting some differences with MSPC and drawbacks in their approaches; and specificities and challenges in the application of MSPC to networking are analyzed. All of this is demonstrated through illustrative experimentation that supports our discussion and reasoning.

Research areas:

• Ethical hacking and digital forensics

Year:

2016

Type of Publication:

In Proceedings

Keywords:

Multivariate Statistical Process Control, Network Monitoring, Network Security, Principal Component Analysis, Anomaly Detection

Book title:

II Jornadas Nacionales de Investigación en Ciberseguridad (JNIC2016)