Adaptive sampling strategy for accurate and scalable anomaly detection in NGMN

Abstract

Integration of disparate access networks in Next Generation Mobile Networks (NGMN) introduces several implementation issues to the quality of service (QoS) and security aspects. The large amount of generated traffic in the network imposes scalability issue which significantly affects the performance of traffic measurement and anomaly detection. While the use of sampling is capable of addressing the scalability problem, the incompleteness of sampled traffic statistics has led to inaccurate traffic inferences, thereby reducing the effectiveness of anomaly detection. In this paper, we address these issues by proposing an adaptive sampling strategy which is capable of providing necessary traffic statistics for accurate and scalable NGMN anomaly detection. The sampling strategy utilizes frequency domain analysis to determine the severity level of the traffic. Together with the flow sizes, these two parameters constitute the formulation of the sampling decision. While the accuracy parameter is composed by the traffic behavior, the scalability issue is addressed by ensuring optimal utilization of the memory cache. Performance evaluation indicates that the proposed technique is capable of providing complete traffic statistics for detecting malicious traffic and also improves the scalability problem in the network.