Multivariate Metrics of Normal and Anomalous Network Behaviors

Detecting network anomalies is a fundamental part of day to day operations for Internet Service Providers and enterprises to maintain the efficiency and reliability of computer networks. Network anomaly detection is based on data characteristics of normal and anomalous network behaviors. Although many existing studies report univariate data characteristics of normal and anomalous network behaviors, there are few studies on multivariate data characteristics of normal and anomalous network behaviors. The goal of this study is to investigate multivariate data characteristics of normal and anomalous network behaviors using the Partial-Value Association Discovery (PVAD) algorithm. This paper illustrates the use of the PVAD algorithm to analyze network flow data of a medium size enterprise under the normal condition and an anomalous condition and reveal multivariate data characteristics of the normal and anomalous network flows in the form of multivariate data associations.