An Automatic and Dynamic Parameter Tuning of a
Statistic-based Anomaly Detection Algorithm
Yosuke Himura

Kensuke Fukuda

Kenjiro Cho

Hiroshi Esaki

The University of Tokyo
him@hongo.wide.ad.jp

National Institute of Informatics /PRESTO, JST
kensuke@nii.ac.jp

Internet Initiative Japan
kjc@iijlab.net

The University of Tokyo
hiroshi@wide.ad.jp

Abstract—The detection of anomalies in network trafﬁc is a
crucial issue affecting the security of Internet users. A statistical
network anomaly detection algorithm is a promising way ofdetecting such anomalies, however, it has to be given appropriate
parameters for accurate detection and identiﬁcation. In general,
it is very difﬁcult to obtain appropriate parameter settings apriori, because network trafﬁc is not stable in time or space. Thus,
although many anomaly detection methods have been proposed,
there has been little discussion about their parameter tunings.
In this paper, we investigate an automatic and dynamic parameter tuning of a statistical network trafﬁc anomaly detection
method. In particular, we clarify whether one can consistently use
the best parameter ﬁxed for a certain instance; this choice clearly
depends on the macroscopic and dynamic behavior of Internet
trafﬁc anomalies. We ascertain the appropriate learning period
for setting a parameter of an anomaly detection algorithm basedon a sketch and multi-scale gamma-function model by using real
network traces measured in a trans-Paciﬁc link over a period of
six months.
The main results of our study are as follows: (1) Without
learning, the best parameter varies day by day. (2) With alonger learning period, the best parameter setting is affected bysigniﬁcant data during the learning period. (3) The appropriate
period of the learning is about 3 days. (4) The performancedegradation from introducing dynamic parameter tuning is 17%
in the best case.
Index Terms—statistical network anomaly detection, parameter tuning

I. I NTRODUCTION
Nowadays, Internet users are exposed to many menaces
like viruses, worms, and DDoS. To make networks secure
for users, these menaces must be accurately detected in realtime. Many network trafﬁc anomaly detection methods havebeen proposed, and they are broadly categorized into two
approaches. One is the signature-based approach [1], whichinspects ﬁngerprints of packet payloads and compares themwith ones in an anomaly database. This approach has highidentiﬁcation accuracy, but it has to have a set of corresponding
signatures a priori. The other approach is based on statisticalmodels [2]–[10]. It deﬁnes a network anomaly as a deviationfrom a referential statistical behavior of network trafﬁc. The
parameter setting of the statistical model directly affects tothe accuracy of the detection and identiﬁcation. Generally,
however, it is very difﬁcult to choose an appropriate parametersetting in advance, because the dynamics of macroscopic
Internet trafﬁc anomalies are highly variable depending on thetime and location to be measured. For example, an outbreakof a new virus (zero-day attack) is a common situation in thecurrent Internet. The parameter tuning is a difﬁcult task, andlittle attention has been paid to it [11]. We need to obtain an
appropriate parameter setting dynamically and automaticallyto be able to deploy algorithms that will be capable of accurate
and real-time detection. Furthermore, automatic and dynamic
parameter tuning is essential not only for detecting anomalies
in the real world but also for comparing anomaly detection
methods; for a fair comparison, we need both a parameter
optimization and a performance measurement of each method
using the same dataset.
In this paper, we discuss an automatic and dynamic parameter tuning of a statistical network trafﬁc anomaly detection
algorithm. In particular, we focus on the appropriate learning
period for the best parameter setting. Intuitively, the learning
period has a tradeoff: (a) A shorter learning period leads
to low accuracy because there are fewer data points to getproper statistics. (b) A longer learning period will not capture
abrupt changes in the macroscopic dynamics of network
trafﬁc anomalies. We investigate this tradeoff by using real
trafﬁc traces measured at a trans-Paciﬁc link over the courseof six months. Our contribution is to show the importanceof automatic parameter tuning for statistical network trafﬁcanomaly detection methods in the real world.
II. DATASET AND ANOMALY DETECTION ALGORITHM
A. Anomaly detection algorithm based on sketch and multiscale gamma-function model
We used an anomaly detection algorithm based on sketch
and the multi-scale gamma-function model [2]. In this paper,
we deﬁne “an event” as a set of packets which have the same
source IP address, that is, a set of packets from the same host.
We empirically focus on the events which have more than
1000 packets to obtain proper statistics for event classiﬁcation(section III-A). The anomaly detection procedure has threesteps.
(1) Sketch: trafﬁc is divided into events with a hash functionof a quasi-huge hash table created from several hashfunctions of small hash tables [8].
(2) Multi-scale gamma-function model: each event’s histogram of the number of packets arriving in a certainTABLE I
C ATEGORIES AND EXAMPLES OF HEURISTICS .

category

explanation

example of heuristics

Attack

The host sends malicious packets

If the ratio of SYN ﬂagged packets is more than 20%, then the host is regarded as “anattacker of SYN ﬂooding attack” and the event is classiﬁed into Attack category

VictimThe host receives malicious packets

If the ratio of SYN/ACK ﬂagged packets is more than 20%, then the host is regarded
be “a victim of SYN ﬂooding attack” and the event is classiﬁed into Victim category

Warning

The host is legitimate, but it can be malicious insome cases

If the ratio of HTTP request packets is more than 50% then the host is regarded as “asender of many HTTP requests” and the event is classiﬁed into Warning category

OK

The host is legitimate

If the ratio of packets with source port 80 is more than 50%, then the host is regarded
as “a web server” and the event is classiﬁed into OK category

SpecialThe host is a server or client of a speciﬁc applicationsuch as DNS and FTP

If the ratio of packets with source port 53 is more than 50%, then the host is regarded
as “a DNS server” and the event is classiﬁed into Special category

Unknown

The host is not classiﬁed into any above categories

If the host cannot be classiﬁed into any above categories, then the event is classiﬁed
into Unknown category

timescale is approximated as a gamma distribution withseveral timescale. The gamma distribution has two parameters: α determines the shape of histogram, and β
the scale. α is helpful for detecting low-intensity hidden
anomalies.
(3) Anomaly identiﬁcation: The αs of every event are compared each other, and events which have outlier parameters are anomalies; the same goes for the βs. For example,
focusing an event’s α, if |α − E[α]| > θα , the event
is judged to be an anomaly. Here, E[α] stands for the
average α among the events in the data and θα is thethreshold for α.
Although the algorithm requires several parameters, we willconcentrate on a main parameter θα because the change in the
shape parameter clariﬁes low-intensity anomalies.
B. MAWI dataset
We performed our evaluation by using real trafﬁc datataken from MAWI trafﬁc repository [12]. The trafﬁc traces
were measured at a trans-Paciﬁc link between Japan and the
U.S. and consisted of 15 min. pcap traces (at 2 p.m. JST)from 2001. The payloads of the packets were removed andboth IP addresses were anonymized; the preﬁx structure waspreserved.
We chose traces from Oct. 2005 to Apr. 2006. The number
and volume of traces were 207 and 113GB, respectively. Table
II brieﬂy describes the dataset. Note that the link was often
congested during the observation period. These traces are notconsecutive (15 min. for a day), but the measurement point
and the start time (2 p.m.) of all traces were the same. Hence,these traces are good enough for investigating the algorithm’s
ability to follow the macroscopic changes in trafﬁc anomalies.

III. M ETHODOLOGY
A. Event classiﬁcation
We deﬁne the optimal parameter (optimal threshold alpha)θαopt as the parameter that leads to the best detection performance. The performance a(θα ) is expressed as a(θα ) = A/T
where A and T are the number of anomalies and total numberof events detected with the threshold θα . In other words,
1 − a(θα ) is the false-negative rate and θαopt minimizes it. Although this metric is different from the common performance
metric (the false-positive rate), it is proper for deciding θαopt .
For the decision on θαopt , we need to classify detected events;
for computing a(θα ), we must identify which events areanomalous or not. Since no classiﬁcation method is perfect, wemust consider the worst case of classiﬁcation (all unclassiﬁed
events are anomalies) and the false-negative rate is a morerobust metric for unclassiﬁed events.
We classiﬁed events into six categories (Attack, Victim,
Warning, OK, Special, and Unknown) with our heuristics
based on port number, TCP ﬂag, and communication network
structure. Table I shows an explanation of the categories andexamples of heuristics. Here, we deﬁne the Anomaly category
as including both Attack and Victim categories. Fig.1 shows
the classiﬁcation results on our dataset: (a) a breakdown by
category and (b) a detailed breakdown of the Attack category.
In this ﬁgure, there are aggregated statistics from Oct. 2005
to Apr. 2006. For example, Attack events account for 8.9%,
and the most dominant attack is “scanning with SYN packets”(SYN scan in Fig.1(b)) which accounts for 31.2% of Attack
events. Note that the breakdown varies on a daily level. With
these data, we will identify whether a detected event is a true
anomaly or not.
B. Learning period

TABLE IIB RIEF DESCRIPTION OF MAWI DATASET.
date
From Oct. 2005
to Apr. 2006

direction
Japan to US
US to Japanlink
18Mbps
18Mbpspacket rate
4.27 Kpps
4.50 Kpps

bit rate
12.1 Mbps
15.0 Mbps

Learning is a method to obtain a parameter for appropriate detection on a certain day by considering past data.
The number of events per day might be too small to giveproper statistics to obtain θαopt and high anomaly detection
performance. Hence, we need to process data periods lastingok(19.5%)

special(10.7%)(a) all eventsother(37.2%)
PING_flood(4.2%)
SYN_flood(8.7%)

SYN_scan(31.2%)

PING_scan(18.7%)(b) attack events

ratio of detected events

attack
(8.9%)
victim
(0.5%)
warning(31.2%)

unknown(29.1%)

1

1

OK
WarningSpecialUnknown
AttackVictim(a) past 1 day

0.8
0.6

0.6

0.4

0.4

0.2

0.2

0

0
0

1

2

3

4

5

0

1

threshold alphaseveral days. The number of days of data for deciding θαopt iscalled the “learning period τ ”. Obviously, τ has a tradeoff:opt• when τ is shorter, one cannot decide θα because there
are few data points to obtain proper statistics.
opt• when τ is longer, θα is not suitable because a longer τleads to an unexpected delay for following macroscopicchanges of anomalies.
Thus, we need to ﬁnd an appropriate value for τ .
C. Optimal parameter setting
The procedure to determine θαopt is as follows.
1) The default optimal parameter is θαoptdef = 1.7.
2) Run the detection procedure over past τ days data bychanging θα (increase by 0.1 from 0.0) in order to ﬁnda (local) maximum. Count A and T and compute a(θα ).
θαopt is uniquely determined to be θαopt = arg max a(θα )that satisﬁes a(θαopt −0.1) < a(θαopt ) and a(θαopt +0.1) <a(θαopt ).
3) If there is no θα satisfying the above condition, θαopt of
the previous day is used.
Fig.2 shows an example of the output by the above procedure.
The x-axis is θα , and the y-axis is the ratio of detected events.
Fig.2(a) and (b) are the results on Dec. 6th 2005 for 1 day and
28 days of learning, respectively. The performance of a(θα )is the ratio of Attack (red) and Victim (blue) events over the
total events.
opt
opt• θα in Fig.2(a) is around 4.4, because a(θα ) = 100%.
However, these parameters are not reasonable; the number of detected events is too small (only one event
is detected and there are many missed events). Hence,choosing a local maximum is better for keeping a reasonable number of detected events; Here, we have oneat θα = 1.8, and four anomaly events are detected.
Conversely, only one anomaly event is detected when
θα > 2.0.
• On the other hand, θα = 2.4 in Fig.2(b) is optimal for our
heuristics. Thus, a large amount of learning data makes
it easier to decide on a good θαopt .
In addition, we found that the typical time-series pattern of
events detected by using a tuned α is continuous; Fig.3(a)shows an example. On the other hand, there are only a few
spiky trafﬁc patterns (e.g., in Fig.3(b)); a tuned β would detect
more.

2

3

4

5

threshold alpha

opt
Fig. 2. Example of determining the optimal parameter θα: (a) τ = 1-day
learning period, (b) τ = 28-day learning period.

(a) continuous traffic

10000

traffic [pps]Fig. 1. Event breakdown of MAWI dataset (from Oct. 2005 to Apr. 2006):(a) all events, (b) attack events.

OK
WarningSpecialUnknown
AttackVictim(b) past 28 days

0.8(b) spiky traffic

10000

1000

1000

100

100

10

10

1

1
0

100

200

300

400

500

600

700

800

900

0

time [sec]

100

200

300

400

500

600

700

800

900

time [sec]Fig. 3. Example of anomaly trafﬁc detected by tuned alpha: (a) typical trafﬁc,(b) untypical trafﬁc. Both trafﬁc are judged as “SYN ﬂooding attack”.

IV. R ESULTS
A. Changes in optimal parameterFig.4 shows the dependency of θαopt on date for ﬁxed
learning periods. The x-axes in Fig.4(a), (b) and (c) are date(from Nov. 2005 to Apr. 2006) and the y-axes are θαopt for eachdate. The x-axes in Fig.4(d), (e) and (f) are date, and the y-axes
are the number of detected events, with θαopt determined fromthe above ﬁgures (red: anomaly events, green: normal events).
Fig.4(a) and (d) show the results for no parameter learning;each θαopt on a certain day yields to the best performance ofthe day. Fig.4(b) and (e) show the results for τ = 3-day oflearning, and Fig.4(c) and (f) show the results for τ = 28-dayof learning.
Obviously, θαopt depends on τ ; θαopt with a shorter τ isscattered, whereas θαopt with a longer τ is high and stable.
One plausible reason for this result is that data for a speciﬁcday (or speciﬁc days) have a strong inﬂuence on θαopt . Thus,
since the learning with a longer τ is affected by speciﬁc data
for a long period, it produces a stable θαopt as long as learningof past τ days includes the data. In addition, θαopt with a longer
τ is inaccurate, because it degrades the performance a(θαopt )(Fig.4(f)). The reason is that one cannot follow the changes inanomaly trafﬁc with a longer τ . Thus, learning with a longer
τ is inappropriate for obtaining a suitable θαopt for practicalanomaly detection.
B. Variable learning period
We investigated the strong inﬂuence from speciﬁc data bycomputing the best performance with a variable τ . Fig.5 shows
the result; the x-axis in Fig.5(a) is date, and the y-axis is τ 0 ,which leads to the best performance for the past τ days ofdetection, i.e., τ 0 = arg maxτ a(θαopt ). The x-axis in Fig.5(b)

3.5

3.5

(c) past 28 days

3

3

3

2.5

2.5

2.5

2

2

2

1.5

1.5

1.5

1

1

1

0.5

0.5

0.5

0
11/01/05 12/01/05

0
11/01/05 12/01/05

01/01/06

02/01/06 03/01/06

1000

04/01/06 05/01/06

Anomaly
Normal(d) no learning

01/01/06

02/01/06 03/01/06

1000

0
04/01/06 05/01/06 11/01/05 12/01/05

100

100

10

10

10

01/01/06

02/01/06 03/01/06

04/01/06 05/01/06

date [month/day/year]
Fig. 4.

1
11/01/05 12/01/05

01/01/06

02/01/06 03/01/06

02/01/06 03/01/06(f) past 28 days

100

1
11/01/05 12/01/05

01/01/06

1000

Anomaly
Normal(e) past 3 days

1
04/01/06 05/01/06 11/01/05 12/01/05

date [month/day/year]

01/01/06

04/01/06 05/01/06

Anomaly
Normal02/01/06 03/01/06

04/01/06 05/01/06

date [month/day/year]

opt
Changes in θα: (a) and (d) no learning, (b) and (e) past τ = 3-day learning, (c) and (f) past τ = 28-day learning.

is date and the y-axis is the θαopt for the best τ 0 . Fig.5(a)has several lines, which means that some data have strong
inﬂuences on θαopt , and the learnings of τ 0 days consider thosedata. To investigate the reason for this effect, let us consider
points A and B which are two of the roots of these lines.
A: The data for 2005-12-09 (point A) give θαopt = 2.6.
With this threshold, the detected events on the data are 5
Attack1 and 1 P2P events.
B: The combination of the data from the Feb. 18th and 19th
2006 sets θαopt = 2.5. This threshold produces 3 Attack2 ,4 Warning, and 1 Unknown events.
Since such data have a strong effect on a(θαopt ), a variableτ is inappropriate for following the macroscopic changes inInternet trafﬁc. In addition, the changes in θαopt for variable τ(Fig.5(b)) are almost same as those for τ = 28-day (Fig.4(f)),
and the performance of a variable τ 0 is lower than that of τ =3. Thus, τ must be appropriately ﬁxed. Another way to avoid
the inﬂuence of speciﬁc data is putting moving weights on thepast data. However, this method needs a number of parameters(e.g., we need to know how to determine the weights).

optimal learning period# of detected events

3.5(b) past 3 days

25

(a)

20
15
10
5
0
11/01/05 12/01/05
3.5
3

optimal threshold

optimal parameter(a) no learning

AB
01/01/06

02/01/06 03/01/06

04/01/06 05/01/06

01/01/06

02/01/06 03/01/06

04/01/06 05/01/06

(b)

2.5
2
1.5
1
0.5
0
11/01/05 12/01/05

date [mon/day/year]

Fig. 5.

opt
Changes in θαwith variable learning period

C. Optimal learning period
We applied our automatic and dynamic parameter tuning
method to the a real dataset of traces from Nov. 2005 to Apr.
2006. Fig.6 shows the dependency of a(θαopt ) on τ . The xaxis is τ (from 1 day to 28 days), the left-hand y-axis is theaverage number of events detected with θαopt , and the righthand y-axis is the average detection rate. The red and green
1 port scans of Dasher.B virus, from source port 6000 to destination port
1025
2 2 scans from source port 6000 to destination port 8080 on 18th, and 1
scan from 1663 to 1434 on 19thlines show respectively the average number of anomaly eventsand normal events detected in a day, and the yellow line shows
the average performance. Each line has its standard error.
• The red and green lines show that the number of detected
events has a dependency on τ ; a longer τ reduces thenumber of events detected in a day. This is because alonger τ results in high θαopt (Fig.4).
opt• The yellow line shows that the average a(θα ) depends
on τ ; a shorter τ (1 or 2 days) leads to worse performance. The reason is that a shorter τ cannot yield enough0.2

Anomalous
NormalDetection Perf.
No Detection Perf.

50

0.18

40

0.16

30

0.14

20

0.12

10

0.1

0

performance# of detected flows

60

0.08
0

5

10

15

20

25

30

learning period [days]
Fig. 6.
Relation between length of learning period τ and the average
opt)](from Oct. 2005 to Apr. 2006).
performance E[a(θαratio of detected anomaly events # of detected anomaly events

amounts of datasets for accurately determining θαopt .
The ﬁgure clearly shows that a τ of 3 days is the most appropriate, because a(θαopt ) is larger and the number of detected
anomaly events is larger. In addition, we have to compare theperformance a(θαopt ) with the percentage of Attack events inthe dataset: 8.9% (Fig.1). Any increase in a(θαopt ) with respect
to the percentage will be a sign of the algorithm’s efﬁcacy.

100

the highest performance
performance of 3 days learning

(a)

10

1
11/01/05 12/01/05

01/01/06

02/01/06 03/01/06

04/01/06 05/01/06

date [month/day/year]1

the highest performance
performance of 3 days learning

(b)
0.8

0.6

0.4

0.2

0
11/01/05 12/01/05

01/01/06

02/01/06 03/01/06

04/01/06 05/01/06

date [month/day/year]

Fig. 7. Performance degradation caused by introducing parameter learning:(a) the number of detected anomaly events, (b) the ratio of detected anomaly
events.

D. Performance evaluation
Fig.7 illustrates the effect from introducing the parameter
learning on performance. In Fig.7(a), the x-axis is date and they-axis is the number of detected anomaly events. The y-axis in
Fig.7(b) is the ratio of the number of detected anomaly eventsto that of all detected events in each day. In both ﬁgures, thegray lines are the results of the best (no learning) parameter,
as mentioned in IV-A. The red lines are the results of θαopt
determined with a learning period of τ = 3days.
Fig.7(b) shows that the learning generally degrades theperformance, but the degradation is not critical to a practicaldetection. The parameter learning degrades the average performance by only 16.6%, and its standard error is 9.2%. Also,
the learning reduces the number of detected anomaly events(Fig.7(a)). With the best parameter, the average number ofdetected anomaly events is 10.8 ± 1.3. On the other hand, withlearning, it is 5.4 ± 0.9; thus, learning reduces the number ofdetected events by about 50%.
V. C ONCLUDING REMARKS
A. Discussion
High variability of the optimal parameter: Our results
illustrate the importance of a dynamic parameter tuning ofstatistical anomaly detection algorithms for deploying themin the real Internet. An inappropriate parameter signiﬁcantly
degrades performance, because the ratio of the number ofanomaly events to that of total events is not constant relative
to the value of the parameter. In addition, even if we set an
optimal parameter, we cannot use the same value consistently,
because the optimal parameter is not constant (Fig.4). Thisfeature is not speciﬁc to our method; since Internet trafﬁc has
a tradeoff, other methods also likely require parameter tuningat the daily level in order to follow the macroscopic behaviorof network anomalies.
Advantage of using the multi-scale gamma-function
model: Fig.4(a) shows that θαopt is quite scattered; here, we
point out only that the macroscopic behavior of the anomaly
trafﬁc exhibits no typical pattern. On the other hand, since α
determines the shape of the histogram of the number of packets
at a certain timescale, the multi-scale gamma-function model
can follow the ﬂuctuating trafﬁc patterns. Consequently, theanomaly detection algorithm based on the multi-scale gammafunction model is a promising approach.
Validity of our classiﬁcation method: Of course, ourclassiﬁcation method has a room for improvement, because
it classiﬁes not a small number of events into the Unknowncategory (Fig.1). To make further improvements, we will use
the idea of BLINC [13]. In particular, we will introduce
BLINC’s trafﬁc classiﬁcation method that builds a structure ofconnection patterns and applies them to heuristics. BLINC’s
idea and our classiﬁcation method have a similarity in thatboth can classify at the host level (what we called “events” inthis paper) rather than at the ﬂow or packet level; hence thetwo methods should work well together.
B. Summary and conclusion
We discussed automatic and dynamic parameter tuning ofa statistical Internet trafﬁc anomaly detection algorithm, byusing real trafﬁc traces gathered over the period of six months.

The main results are as follows. (1) Without learning, thebest parameter varies day by day. (2) With a longer learning
period, the best parameter setting is affected by signiﬁcant
events during the learning period. (3) The appropriate periodof learning is about 3 days. (4) The performance degradation
caused by introducing dynamic parameter tuning is 17% in thebest case. We showed the importance of dynamic parametertuning in statistical network trafﬁc anomaly detection methods
for the real-world deployment. To conﬁrm the efﬁcacy of our
method, we will conduct further research with other datasets(e.g., CAIDA’s DITL dataset [14]) for analyses at the dailylevel and investigation on other links.
ACKNOWLEDGEMENTS
We appreciate to Patrice Abry, Pierre Borgnat, GuillaumeDewaele and Kaoru Yoshida for their advice. This work waspartially supported by the Strategic International Cooperative
Program of CNRS and JST, and by the Grant-in-Aid for Scientiﬁc Research on priority areas (info-plosion) from MEXT
Japan.
R EFERENCES[1] M. Roesch, “Snort - Lightweight Intrusion Detection for Networks,”
LISA’99: Proceedings of the 13th USENIX conference on System administration, pp. 229–238, November 1999.
[2] G. Dewaele, K. Fukuda, P. Borgnat, P. Abry, and K. Cho, “Extracting
Hidden Anomalies using Sketch and Non Gaussian Multiresolution
Statistical Detection Procedure,” ACM SIGCOMM LSAD’07, pp. 145–
152, August 2007.
[3] P. Barford, J. Kline, D. Plonka, and A. Ron, “A signal analysis of
network trafﬁc anomalies,” ACM IMW’02, pp. 71–82, November 2002.
[4] J. Brutlag, “Aberrant Behavior Detection in Time Series for Network
Monitoring,” USENIX LISA 2000, pp. 139–146, December 2000.
[5] A. Lakhina, M. Crovella, and C. Diot, “Diagnosing Network-Wide
Trafﬁc Anomalies,” ACM SIGCOMM’04, pp. 219–230, August 2004.
[6] S. Jin and D. S. Yeung, “A Covariance Analysis Model for DDoS Attack
Detection,” IEEE Communications Society Volume 4, pp. 1882–1886,
August 2003.
[7] Y. Kim, W. C. Lau, M. C. Chuah, and H. J. Chao, “PacketScore: A
Statistics-Based Packet Filtering Scheme against Distributed Denialof-Service,” IEEE Transaction on Dependable and Secure Computing
Volume 3 No. 2, pp. 141–155, April-June 2006.
[8] B. Krishnamurty, S. Sen, Y. Zhang, and Y. Chen, “Sketch-based Change
Detection: Methods Evaluation and Applications,” ACM IMC’03, pp.
234–247, October 2003.
[9] M. P. Stoeklin, J. Y. L. Boudec, and A. Kind, “A Two-Layered Anomaly
Detection Technique Based on Multi-modal Flow Behavior Models,”
PAM2008, pp. 212–221, April 2008.
[10] Y. Gu, A. McCallum, and D. Towsley, “Detecting Anomalies in Network
Trafﬁc Using Maximum Entropy Estimation,” IMC2005, pp. 345–350,
October 2005.
[11] H. Ringberg, A. Soule, J. Rexford, and C. Diot, “Sensitivity of PCA for
Trafﬁc Anomaly Detection,” ACM SIGMETRICS 2007, pp. 109–120,
June 2007.
[12] K. Cho, K. Mitsuya, and A. Kato, “Trafﬁc Data Reposity at the WIDE
Project,” USENIX 2000 FREENIX Track, June 2000.
[13] T. Karagiannis, K. Papagiannaki, and M. Faloutsos, “BLINC: Multilevel
Trafﬁc Classiﬁcation in the Dark,” ACM SIGCOMM’05, pp. 229–240,
August 2005.
[14] kc claffy, “A Day in the Life of the Internet: Proposed communitywide experiment,” ACM SIGCOMM CCR Volume 36, No. 2, pp. 39–40,
October 2006.