Open Access
Translator Disclaimer
June 2009 Detection and localization of change-points in high-dimensional network traffic data
Céline Lévy-Leduc, François Roueff
Ann. Appl. Stat. 3(2): 637-662 (June 2009). DOI: 10.1214/08-AOAS232


We propose a novel and efficient method, that we shall call TopRank in the following paper, for detecting change-points in high-dimensional data. This issue is of growing concern to the network security community since network anomalies such as Denial of Service (DoS) attacks lead to changes in Internet traffic. Our method consists of a data reduction stage based on record filtering, followed by a nonparametric change-point detection test based on U-statistics. Using this approach, we can address massive data streams and perform anomaly detection and localization on the fly. We show how it applies to some real Internet traffic provided by France-Télécom (a French Internet service provider) in the framework of the ANR-RNRT OSCAR project. This approach is very attractive since it benefits from a low computational load and is able to detect and localize several types of network anomalies. We also assess the performance of the TopRank algorithm using synthetic data and compare it with alternative approaches based on random aggregation.


Download Citation

Céline Lévy-Leduc. François Roueff. "Detection and localization of change-points in high-dimensional network traffic data." Ann. Appl. Stat. 3 (2) 637 - 662, June 2009.


Published: June 2009
First available in Project Euclid: 22 June 2009

zbMATH: 1166.62094
MathSciNet: MR2750676
Digital Object Identifier: 10.1214/08-AOAS232

Keywords: change-point detection , High-dimensional data , Network anomaly detection , rank tests

Rights: Copyright © 2009 Institute of Mathematical Statistics


Vol.3 • No. 2 • June 2009
Back to Top