Application of Forecasting Techniques and Control Charts for Traffic Anomaly
Detection

Gerhard Muenz (Technische Universitaet Muenchen) Georg Carle (Technische
Universitaet Muenchen)

In this paper, we evaluate the capability to detect traffic anomalies with
Shewhart, CUSUM, and EWMA control charts. In order to cope with seasonal
variation and serial correlation, control charts are not applied to traffic
measurement time-series directly, but to the prediction errors of exponential
smoothing and Holt-Winters forecasting. The evaluation relies on flow data
collected in an ISP backbone network and shows that good detection results can
be achieved with an appropriate choice and parametrization of the forecasting
method and the control chart. On the other hand, the relevance of the detected
anomalies for the network operator mainly depends on the monitored metrics and
the selected parts of traffic.