A Nonparametric Adaptive Cusum Method And Its Application In Network Anomaly Detection

Abstract

Detecting anomalies that disrupt the symmetry in two-way communications is an important task for network defense systems. The subtlety and complexity of anomalous traffic challenge the existing detection methods, and the bottleneck is how to set thresholds to adapt to the variability in network traffic. In this paper, a nonparametric adaptive CUSUM (Cumulative Sum) method is presented to meet this challenge. It has three distinct features. (i) No assumption is made on the distribution of the observations. (ii) Its detection threshold is self-adjusted so that it can adapt itself to various traffic conditions. (iii) It can react to the end of an anomaly within a required delay time. Several practical expressions for evaluating this method on its probability of false alarms and detection delays are deduced. Experiments on source-end defense against SYN flooding attacks show the efficacy of this method in detecting low intensity anomalies.