Detecting Correlated Anomalous Flows using the Equilibrium Property

We have empirically observed that the average volume change across flows is close to zero in links carrying a large enough number of flows. This flow equilibrium property holds if the flows are nearly independent, and it is violated by traffic changes caused by several, potentially small, correlated flows. Many traffic anomalies fit this description, including scans, DDoS attacks, and routing shifts. Based on this observation, we exploit equilibrium to design a detection method for correlated anomalous flows. Our method identifies a qualitatively different set of anomalies compared with statistical techniques based on volume and entropy. It has two features that make it more practical than previously proposed methods: (1) it does not require a learning phase from time series data and (2) it provides an estimate of the volume of traffic involved in an anomaly.