A system for in-network anomaly detection

Abstract. Today, the Internet is used by companies frequently since it simplifies daily work, speeds up communication, and saves money. But the more popular the Internet gets the more it suffers from various challenges like DDoS attacks. This work, therefore, proposes an anomalybased system that is able to detect adverse events caused by such challenges. The detection of network anomalies, in contrary to signaturebased systems, ensures that previously unknown adverse events can be detected, too. Furthermore, the proposed system is designed for deployment within the network to allow a detection of adverse events as fast as possible, i.e., not only at the victim’s edge of the network. To achieve such an in-network anomaly detection the system is designed hierarchically and applies refinement of detection granularity.