Anomaly Extraction In Backbone Network Using Association Rules

Abstract — Anomaly extraction refers to automatically finding in a large set of flows observed during an anomalous time interval, the flows associated with the anomalous event(s). It is important for several applications ranging from root cause analysis, to attack mitigation, and testing anomaly detectors. In this work, we use meta-data provided by several histogram-based detectors to identify suspicious flows and then apply association rule mining to find anomalous flow, and summarize the flow