A streaming approach to reveal crowded events from cellular data Abstract   Anomaly detection has been a very popular research topics over the last few years and applies to many scenarios from different disciplines. This research focuses on crowded phenomena, and addresses the detection of popular events by looking for xe2x80x9canomalousxe2x80x9d patterns in cellular traffic data. In particular, the paper elaborates upon previous proposals and presents two streaming algorithms based on the wavelet decomposition of traffic data. The new algorithms consume traffic samples as soon as they are available, elaborate the data in real time and possibly raise alarms upon threshold crossing. The effectiveness of the approach is assessed by using the public dataset containing the real cellular data acquired over the network of the most popular Italian traffic operator. The experiments prove that the streaming algorithms generally achieve performance comparable to that of their offline counterparts, and that the small degradation that may occasionally be observed is however well counterbalanced by the obvious advantage of detecting anomalies in realxe2x80x93time with no need to wait for the elaboration of overly long traffic timeseries.

An aggregated statistical approach for network flood detection using GammaNormal mixture modeling Abstract   In this paper, we propose a fast statistical anomaly detector at the aggregatedlevel for two types of anomalies: floods and flash crowds. The performance of the statistical anomaly detectors is significantly dependent on the accuracy of statistical modeling. Thus, we initially introduce a new efficient statistical model for the network traffic called Gamma Normal mixture (GNM). We study the compatibility of GNM and network traffic using different tests. Consequently, we design a novel anomaly detector based on using the generalized likelihood ratio test (GLRT) and GNM. Moreover, to more accurately determine the position of the anomalies, overlapped sliding windows have been applied in the aggregation step. To evaluate the performance of the proposed anomaly detector, we use receiver operating characteristics (ROC). Experimental results under public network traces, confirm the high efficiency of the proposed method. Also, the comparison of the proposed anomaly detector with its nearest competitor verifies the higher performance and lower computational load in utilizing the new strategy.