Multidimensional Data Mining for Anomaly Extraction

Abstract

Due to heavy traffic the network monitoring is very difficult and cumbersome job, hence the probability of network attacks increases substantially. So there is the need of extraction anomalies. Anomaly extraction means to find flows associated with the anomalous events, in a large set of flows observed during an anomalous time interval. Anomaly extraction is very important for root-cause analysis, network forensics, attack mitigation and anomaly modeling. To identify the suspicious flows, we use meta-data provided by several histogram based detectors and then apply association rule with multidimensional mining concept to find and summarize anomalous flows. By taking rich traffic data from a backbone network, we show that our technique effectively finds the flows associated with the anomalous events. So by applying multidimensional mining rule to extract anomaly, we can reduce the work-hours needed for analyzing alarms and making anomaly systems more effective.