Adaptive Change Detection for Relay-Like Behaviour

Detecting anomalous behaviour in network flow data is challenging for a number of reasons, including both the computational demand associated with a large corporate network and the peculiar temporal characteristics of flow data. Relay-like behaviour refers to the rapid commencement of an out-going flow from a network device following the completion of an in-coming flow. This paper develops a computationally efficient and temporally adaptive methodology for detecting relay-like behaviour. The methodology is demonstrated on a real example of NETFLOW data. In addition to providing a detector, further uses of the methodology for combining anomalous events are discussed.