Anomaly detection over network based on slowdown data

In this work, we test an approach for passively detecting the slowdown which arises from some anomalies on computers over the network. This novel approach is important and differs from some other methodologies because it works without the measurements done on the computer itself, but it is based on the observation of client's network interactions out of the client. The proposed approach relies on detecting the slowdown via measurement of the elapsed time while client responds to the server in some network protocols. For this purpose, we tested and examined some statistical tests and algorithms based on these.Anomalies which cause the slowdown of computers are defined as hardware and software changes, errors and problems, malicious software infection. In order to detect the effects of these factors, we tested the methodology over the data we collected over different systems which include these activities.We have designed different test environments to collect data over client running some applications which include specific activities to be tested. In this setup, the client network traffic is captured over the network by an observer machine. We have calculated the response times and have seen that the slowdown amount is sufficient for detection of anomalies in reference to the ground state. Results have shown that the approach is suitable for measurement of the slowdown.