A Novel Sequence Tensor Recovery Algorithm for Quick and Accurate Anomaly Detection

• Published in: IEEE transactions on network science and engineering Vol. 9; no. 5; pp. 3531 - 3545
• Main Authors: Huang, Wenbin, Xie, Kun, Li, Jie
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 01.09.2022; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Accuracy; Algorithms; Anomalies; Anomaly detection; Communications traffic; Computation; Correlation; Costs; Heuristic algorithms; Mathematical analysis; Matrix decomposition; Monitoring; Network security; Online anomaly detection; Sequence traffic monitor; Tensor recovery; Tensors; Traffic models
• ISSN: 2327-4697; 2334-329X
• DOI: 10.1109/TNSE.2022.3189365

Anomalous traffic detection is a vital task in advanced Internet supervision and maintenance. To detect anomalies accurately, various data representations, such as vectors, matrices, and tensors, have been adopted to model traffic data. Among them, tensor-based methods outperform others due to their capability of capturing comprehensive correlations between complex network traffic. However, existing tensor-based algorithms remain certain shortcomings, such as working offline, cannot timely detect traffic anomalies, and high computation costs. To conquer the aforementioned deficiencies, we propose a novel sequence tensor recovery (STR) algorithm in this paper, which utilizes the results of historical tensor decomposition to achieve quick and accurate anomaly detection with low consumption when traffic data series arrive. Furthermore, we propose a dynamic sequence tensor recovery (DSTR) algorithm to improve anomaly detection accuracy by better capturing the variation over time of the comprehensive correlation of traffic data hidden in the tensor structure. The experimental results on two real traffic traces, Abilene and G<inline-formula><tex-math notation="LaTeX">\grave{E}</tex-math></inline-formula> ANT, indicate the proposed STR and DSTR algorithms are superior to the state-of-the-art algorithms in terms of accuracy and computation cost.