Anomaly clustering based on correspondence analysis

Abstract

The huge amount of traffic in backbone IP networks produces various kinds of anomalies in data packets. Distinct classifiers have been developed to deal with this anomalous data. These classifiers typically have predefined number of classes and use supervised learning methods. Some classifiers apply windowing method to make the huge data scalable into small groups. In this work, a new method for the classification of anomalous data have been applied with unsupervised learning using Correspondence Analysis (CA). Correspondence Analysis does not need a predefined number of clusters to begin with, and can handle comparatively large amounts of data. Results have been compared with other clustering techniques, which are applied on real data from the US Abilene backbone network. The results indicate that the proposed method is promising in classifying anomalies on the basis of frequencies of anomalous facade.