M.A. Smychek - Ph. D. (Eng.), Main Specialist, Department of Communications, JSC «Giprogazcentr» (N. Novgorod). E-mail: smychek@ggc.nnov.ru
R.A. Sudarikov - Engineer, Sector of Scientific Research, Department of Communications, JSC «Giprogazcentr» (N. Novgorod). E-mail: roman.sudarikov@gmail.com

A key element of any network system performance monitoring is online anomaly detection, which is to understand whether a system network data is close to the normal pattern or significantly deviates from expected and requires further investigation and diagnosis. This paper presents statistical techniques based on applying thresholds to individual data points and involving measuring the changes in distribution by windowing the data and using that to determine anomalies. Real-time network anomaly detection requires «lightweight» techniques that provide sufficient accuracy for subsequent diagnosis and management actions. There are several challenges in designing effective solutions for such online anomaly detection under conditions of huge amount of data. One of the critical performance aspects of any anomaly detection algorithm is the speed with which it can detect the anomaly. Another aspect is scale, for which the anomaly detection methods must be «lightweight», both in terms of the number of metrics they require to run (the volume of monitoring data continuously captured and used), and in terms of their runtime complexity for executing the detection methods. Anomaly detection is important because it must be done continuously, as long as a system is running and at scale of entire amount of network data. We have experimented the proposed algorithms using network data with different injected performance and configuration network anomalies such as ICMP flooding, UDP storm, Fraggle, Smurf, Synflooding, Flashcrowd attack. It is shown that for all the types of traffic anomalies, submitted a set of statistical filter contains more than one feature, which allows detecting anomaly traffic. Furthermore, it should be noted that the result of applying the proposed filters throughout anomaly is not singular but quasi-stationary. For example, the Smurf type anomaly specific is occurrence of high-frequency component which singularly appears with the anomaly, remains within and disappears with the anomaly. The ICMP-flooding type anomaly specific is singularly changing of the probability density functions characteristic. It-s shown the proposed superposition of statistical criteria allows diagnosing different type of anomalies.