Network Anomaly Detection Using PCA and Artificial Neural Network

Abstract

A neural network is, in essence, an attempt to simulate the brain. Neural network theory revolves around the idea that certain key properties of biological neurons can be extracted and applied to simulations, thus creating a simulated (and very much simplified) brain. The demands of data intensive science and the growth of high-capacity connectivity have fueled the need for tools that measure, test, analyze and report network performance. Measurement and Analysis for the Global Grid and Internet End-to-End Performance (MAGGIE) is an initiative of Stanford Linear Accelerator Center (SLAC) to allow sharing of network monitoring data. From the perspective of network management it is felt that diagnosing and managing networks is a critical job both for network administrators and operators also. The network administrator can at best review very few problems that arise in the network and respond reactively upon being presented by a user. We need to enable the network administrator to be pro-active and spot the problem before hand. There are several techniques for detecting anomalous changes over a network. Our approach focus is on PCA i.e. Principal Component Analysis. PCA is a coordinate transformation method that maps a given set of data points onto new axes. These axes are called the principal axes or principal components. When working with zero-mean data, each principal component has the property that it points in the direction of maximum variance remaining in the data, given the variance already accounted for in the preceding components. We are going to get these principle components in a form of vectors and work on them by training them by using Neural Network technique of LVQ (Learning Vector Quantization) and then test it for available data on different Routes. The project will mainly focus on: • Detection of network anomalies using network measurement related parameters. • Training the System for the Set of Anomalies responsible for Network problems. • Testing & executing our approach on data gathered from multiple sites (links). • Automating the anomaly detection and trying to reduce false alarms