GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Path Aggregate without Labeled data). GAMPAL does not require labeled data to achieve a general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Routing Information Base), GAMPAL introduces path aggregates. The BGP RIB entries are classified into the path aggregates, each of which is identified with the first three AS numbers in the AS_PATH attribute. GAMPAL establishes a prediction model of traffic throughput based on past traffic throughput. It adopts the LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model focusing on periodicity in weekly scale of the Internet traffic pattern. The validity of GAMPAL is evaluated using the real traffic information and the BGP RIB exported from the WIDE backbone network (AS2500), a nation-wide backbone network for research and educational organizations in Japan. As a result, GAMPAL successfully detects traffic increases due to events and DDoS attacks targeted to a stub organization.

Original languageEnglish
Title of host publicationMachine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers
EditorsSelma Boumerdassi, Éric Renault, Paul Mühlethaler
PublisherSpringer
Pages196-211
Number of pages16
ISBN (Print)9783030457778
DOIs
Publication statusPublished - 2020
Event2nd International Conference on Machine Learning for Networking, MLN 2019 - Paris, France
Duration: 2019 Dec 32019 Dec 5

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume12081 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference2nd International Conference on Machine Learning for Networking, MLN 2019
CountryFrance
CityParis
Period19/12/319/12/5

Keywords

  • General-Purpose Anomaly Detection
  • Internet Backbone
  • LSTM-RNN
  • Network Traffic Analysis

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN'. Together they form a unique fingerprint.

  • Cite this

    Wakui, T., Kondo, T., & Teraoka, F. (2020). GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN. In S. Boumerdassi, É. Renault, & P. Mühlethaler (Eds.), Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers (pp. 196-211). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12081 LNCS). Springer. https://doi.org/10.1007/978-3-030-45778-5_13