Load characterization and anomaly detection for voice over IP traffic.

Area of Science:

• Computer Science
• Network Engineering
• Data Analysis

Background:

• Traffic anomalies in IP networks often stem from focused overload or network element failures.
• Current IP network management relies on first-order statistics and fixed thresholds, which are insufficient for detecting complex anomalies.

Purpose of the Study:

• To develop novel analytical methods for traffic anomaly detection in IP networks.
• To specifically address anomaly detection in voice over IP (VoIP) traffic.
• To propose simple yet effective anomaly detection tests for over/underload conditions.

Main Methods:

• Derivation of general formulae for the variance of cumulative traffic over fixed time intervals.
• Simplification of analytical expressions for voice over IP (VoIP) traffic.
• Proposal of anomaly detection tests based on cumulative traffic analysis over extended periods (e.g., 5 minutes).

Main Results:

• Cumulative traffic analysis over longer intervals (e.g., 5 minutes) is sufficient for detecting load anomalies.
• The derived analytical expressions provide a robust method for identifying traffic anomalies.
• The proposed approach significantly enhances anomaly detection capabilities compared to existing methods.

Conclusions:

• The developed scheme offers a substantial improvement over current IP network management practices.
• The proposed methods are effective for detecting both overloads and underloads in network traffic.
• Successful application to field data from an operational network validates the proposed anomaly detection scheme.