PCA-based robust anomaly detection using periodic traffic behavior

Principal Component Analysis (PCA) can detect traffic anomalies by projecting measured traffic data onto a normal and anomalous subspaces. Although PCA is a powerful method for detecting traffic anomalies, excessively large anomalies may contaminate the normal subspace and deteriorate the performance of the detector. In order to solve this problem, we propose a PCA-based robust anomaly detection scheme by using the daily or weekly periodicity in traffic volume. In the proposed scheme, traffic anomalies are detected for every period of measured traffic via PCA. Before applying PCA, however, outliers in the current period are removed by means of a reference covariance matrix, which is derived from normal traffic in the preceding period. We apply the proposed scheme to measured traffic data in the Abilene network and show that it can improve the false negative ratio of anomaly detection.