Network Traffic Decomposition for Anomaly Detection
  In this paper we focus on the detection of network anomalies like Denial of
Service (DoS) attacks and port scans in a unified manner. While there has been
an extensive amount of research in network anomaly detection, current state of
the art methods are only able to detect one class of anomalies at the cost of
others. The key tool we will use is based on the spectral decomposition of a
trajectory/hankel matrix which is able to detect deviations from both between
and within correlation present in the observed network traffic data. Detailed
experiments on synthetic and real network traces shows a significant
improvement in detection capability over competing approaches. In the process
we also address the issue of robustness of anomaly detection systems in a
principled fashion.
