State of the art Event detection

The problem of event detection is far from being new. This is a classical problem in many contexts. Many studies target event detection in the dynamics of various systems [7]. Two main approaches are followed, named anomaly-based and signature-based. The underlying principle of anomaly-based approaches [4, 3] is that one knows the normal behavior of the system. Then, any observation that differs from this normal behavior is considered as an event. This approach is very appealing as it is able to detect any kind of event, including kinds that were never observed. It however relies on a precise knowledge of the dynamics of the considered object, and evolution of the normal behavior makes the method ineffective. In the case of the internet topology, these two limitations make this approach unapplicable. Signature-based approaches rely on the knowledge of characteristic features of events to detect, which may be inferred from a set of known events (typically with machine learning techniques) [18, 7]. If the observed dynamics matches these features at some point, then one considers that this is an event. This approach is very effective in cases where the events may be described, like some computer viruses for instance. In our case, though, very limited knowledge of events in the internet, and no description on their impact on observed topology, are available. Much attention has been paid to event detection in internet traffic, see for instance [1, 15, 23, 19, 13, 16, 9, 5, 10]. The methods used are mainly based on the quantity of traffic; some works study the whole traffic, and some subdivise the multi-dimensional space induced by the origin and destination of the traffic; some works also correlate informations from different sites [8]. These works have produced valuable results, but the strategies based on the volume have reached their limits, mainly due to the scale-free nature of the IP traffic that makes outlier detection difficult if not impossible.