Mining anomalies using traffic feature distributions
Combining routing and traffic data for detection of IP forwarding anomalies