The DOI matches its Crossref record; 17 of the 17 references it cites were found in a registry or an index.
Sensitivity of PCA for traffic anomaly detection
Abstract
Detecting anomalous traffic is a crucial part of managing IP networks. In recent years, network-wide anomaly de-tection based on Principal Component Analysis (PCA) has emerged as a powerful method for detecting a wide vari-ety of anomalies. We show that tuning PCA to operate effectively in practice is difficult and requires more robust techniques than have been presented thus far. We analyze a week of network-wide traffic measurements from two IP backbones (Abilene and Geant) across three different traffic aggregations (ingress routers, OD flows, and input links), and conduct a detailed inspection of the feature time se-ries for each suspected anomaly. Our study identifies and evaluates four main challenges of using PCA to detect traf-fic anomalies: (i) the false positive rate is very sensitive to small differences in the number of principal components in the normal subspace, (ii) the effectiveness of PCA is sensi-tive to the level of aggregation of the traffic measurements, (iii) a large anomaly may inadvertently pollute the normal subspace, (iv) correctly identifying which flow triggered the anomaly detector is an inherently challenging problem.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The Scree Test For The Number Of Factors
Cattell, R. B. (1966) · Multivariate Behavioral Research · doi:10.1207/s15327906mbr0102_10 · Cited by 13,554
Analysis of a complex of statistical variables into principal components.
Hotelling, H. (1933) · Journal of Educational Psychology · doi:10.1037/h0071325 · Cited by 9,633
Nonlinear Component Analysis as a Kernel Eigenvalue Problem
Schölkopf, B., Smola, A., & Müller, K.-R. (1998) · Neural Computation · doi:10.1162/089976698300017467 · Cited by 8,084
The Varimax Criterion for Analytic Rotation in Factor Analysis
Kaiser, H. F. (1958) · Psychometrika · doi:10.1007/bf02289233 · Cited by 7,580
Mixtures of Probabilistic Principal Component Analyzers
Tipping, M. E., & Bishop, C. M. (1999) · Neural Computation · doi:10.1162/089976699300016728 · Cited by 1,873
Mining anomalies using traffic feature distributions
Lakhina, A., Crovella, M., & Diot, C. (2005) · Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/1080091.1080118 · Cited by 1,054
Self-citationDiagnosing network-wide traffic anomalies
Lakhina, A., Crovella, M., & Diot, C. (2004) · Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/1015467.1015492 · Cited by 1,039
Self-citationPrediction by Supervised Principal Components
Bair, E., Hastie, T., Paul, D., & Tibshirani, R. (2006) · Journal of the American Statistical Association · doi:10.1198/016214505000000628 · Cited by 817
A signal analysis of network traffic anomalies
Barford, P., Kline, J., Plonka, D., & Ron, A. (2002) · Proceedings of the second ACM SIGCOMM Workshop on Internet measurment - IMW '02 · doi:10.1145/637201.637210 · Cited by 787
Fast accurate computation of large-scale IP traffic matrices from link loads
Zhang, Y., Roughan, M., Duffield, N., & Greenberg, A. (2003) · Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems · doi:10.1145/781027.781053 · Cited by 505
Cited by
Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194
A comprehensive survey on network anomaly detection
Fernandes, G., Rodrigues, J. J. P. C., Carvalho, L. F., Al-Muhtadi, J. F., & Proença, M. L. (2019) · Telecommunication Systems · doi:10.1007/s11235-018-0475-8 · Cited by 382
ANTIDOTE: understanding and defending against poisoning of anomaly detectors
Rubinstein, B. I. P., Nelson, B., Huang, L., Joseph, A. D., Lau, S.-H., Rao, S., Taft, N., & Tygar, J. D. (2009) · Proceedings of the 9th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1644893.1644895 · Cited by 331
Fontugne, R., Borgnat, P., Abry, P., & Fukuda, K. (2010) · Proceedings of the 6th International COnference · doi:10.1145/1921168.1921179 · Cited by 295
Towards Automated Log Parsing for Large-Scale Log Data Analysis
He, P., Zhu, J., He, S., Li, J., & Lyu, M. R. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2017.2762673 · Cited by 230
Metadata
- Authors
- Ringberg, H., Soule, A., Rexford, J., & Diot, C.
- Venue
- Proceedings of the 2007 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
- Publisher
- ACM
- Published
- 2007-06-12
- Pages
- 109-120
- OpenAlex
- W2118931532
- Cited by
- 353
- References
- 17
- FWCI
- 17.41
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Sensitivity of PCA for traffic anomaly detection. https://app.cochat.ai/papers/10.1145/1254882.1254895
- The paper
- Ringberg, H., Soule, A., Rexford, J., & Diot, C. (2007). Sensitivity of PCA for traffic anomaly detection. Proceedings of the 2007 ACM SIGMETRICS international conference on Measurement and modeling of computer systems. https://doi.org/10.1145/1254882.1254895
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
