On the realization of a generalized data fusion and network anomaly detection framework

In this paper, a generalized data fusion and network anomaly detection methodology is introduced and described. The proposed data fusion approach provides an integrated way of taking into consideration and combining effectively correlated performance metrics, for improving the anomaly detection capabilities and the corresponding network operational effectiveness. This is achieved by designing a methodology of applying Principal Component Analysis based technique simultaneously on several metrics of one or more links, instead of applying it on each metric individually. The numerical results presented in this paper demonstrate that the proposed generalized anomaly detection framework, is capable of detecting not only volume based anomalies, but a much wider range of classes of anomalies, such as the ones that may result in alterations in traffic composition or traffic paths