Detection of network traffic anomalies with robust principal components analysis

There are a lot of studies have been carried out by using different techniques in various disciplines to detect unusual behaviors that occur in network traffic data. Principal Component Analysis (PCA), one of these methods, has increased considerably in the light of some studies conducted in the last decade. The cases in which data in higher dimensions or with outliers, where the use of the PCA is not advantageous, use of the robust PCA and PCA-based hybrid approaches is frequently encountered. In this study, a robust PCA method is used to detect outliers, i.e. anomalies, in network traffic data. For this purpose, the anomaly detection performance of the robust PCA method is compared with the classical PCA method by adding synthetic traffic volume to the Abilene network traffic data set, which is a well-known data set in this field. According to the results, it is seen that the robust PCA method is provided a much better performance in terms of anomaly detection performance.