SLRTA: A sparse and low-rank tensor-based approach to internet traffic anomaly detection

Internet traffic anomaly detection (ITAD) is a critical task for various network tasks such as traffic engineering and network security. Matrix-based approaches of ITAD have limitations for traffic data with multi-way structures, while the emerging tensor-based approaches of ITAD lack of sufficient consideration for circumstances including incomplete measurements or link-load measurements. To address these issues, we formulate ITAD by a sparse low-rank tensor optimization model, taking into full consideration the intrinsic and potential properties including the sparsity of anomalies, the low-rankness, the temporal stability and periodicity of the normal traffic data. Although the resulting optimization model is non-convex and discontinuous due to the involved 0-norm and the tensor rank function, optimality analysis via stationarity is established, based on which an efficient proximal gradient method with theoretical convergence to stationary points is designed. Numerical experiments on internet traffic trace data Abilene and GÉANT demonstrate the high efficiency of our proposed sparse and low-rank tensor-based approach (SLRTA) for ITAD. © 2021 Elsevier B.V.