Traffic feature distribution analysis based on exponentially weighted moving average

Most researches treated anomalies as deviations in the overall traffic volume. However, not all of the network incidents result in significant traffic volume change. Feature-based analysis enables detection of anomalies that are difficult to isolate in traffic volume. In order to accurately detect traffic anomaly, this paper proposes a methodology based on Exponentially Weighted Moving Average (EWMA). It utilizes feature entropy as a convenient summary statistic for the distribution´s tendency to be concentrated or dispersed. Then, it predicts normal traffic feature entropy by Exponentially Weighted Moving Average and identifies anomaly with predictions. The experimental results show that this methodology achieves better accuracy than volume-based method.