R-TAR: A Resilient Traffic Anomaly Recognition Mechanism for Backbone Network

• Published in: 2018 10th International Conference on Intelligent Human Machine Systems and Cybernetics (IHMSC) Vol. 1; pp. 62 - 66
• Main Authors: Li, Xueyu, Zhang, Xu, Wang, Dongbin
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.08.2018
• Subjects: anomaly recognition; backbone networks; Classification algorithms; cyberspace situation assessment; Data models; Local area networks; network mangement; resilient cyber-physical systems (CPSs); Security; Sensors; Spatiotemporal phenomena; Telecommunication traffic; Traffic anomaly
• DOI: 10.1109/IHMSC.2018.00022

The development of backbone networks leads to an increase in heterogeneous anomalies and cyberspace situation complexity, and traditional traffic monitoring cannot meet multiple-point concurrency design and resilience demand. Situational awareness from the military field can effectively deal with the anomalies with significant temporal-spatial characteristics. Considering the requirement of automatic control in practical application, the concept of resilient Cyber Physical System (R-CPS) is presented. Based on this concept, we propose resilient traffic anomaly recognition (R-TAR) which is a refined mechanism for spatiotemporal traffic anomaly assessment in backbone and develop the TAR algorithm to multi-HCRF (Hidden Conditional Random Fields). R-TAR provides a CPS-based feedback control loop integrating traffic sensing, decision making and information feedback. In view of the characteristics of backbone network traffic, we develop multi-HCRF to extract temporal and spatial situation from packet-granularity to flow-granularity for better performance, and obtain the overall-network-wide situation for feedback. The experimental evaluation establishes a proof-of-concept for the proposed model based on R-TAR, confirming the practicality and performance improvement of our approach on real datasets.