Network-wide volume anomaly detection using alternate matrix decomposition techniques

Network-wide volume anomaly detection is crucial for network operators in order to avoid congestion problems. Two fundamental limitations of principal component analysis (PCA) for anomaly detection are identified. First, variables involved in PCA are assumed to be continuous. Second, it is unable to retain original input space, which makes the identification of anomalous PoP pairs fundamentally difficult. In order to alleviate these two limitations, we propose to use two alternate matrix decomposition techniques, namely CUR decomposition and Correspondence analysis, for volume anomaly detection. Results show that these techniques not only identifies anomalous time intervals but also the PoP pairs which triggered the anomaly. Application of these alternate decomposition techniques on anomaly injected synthetic traffic matrices shows superiority over PCA-based approach in terms of high detection rate and low false positive rate.