Incremental principal component analysis method on online network anomaly detection

Although PCA (principal component analysis) based multivariate anomaly detection algorithm can perform detection task, it cannot satisfy the needs of online detection due to the time complexity. To conquer this limitation, a multivariate online anomaly detection algorithm based on incremental PCA (IPCA) was proposed. The algorithm constructed normal model of traffic matrix incrementally and implemented online detection with this model. Analysis with Internet real traffic data and simulation data shows that this algorithm can perform online anomaly detection effectively.