• Networks generate traffic and connection records.
• A large change in activity can be worth investigating.
• Statistics can help us flag unusual observations.

Question: Which minutes have unusually high or low connection counts?

This presentation uses simulated data, not real network logs.

• 180 observations, representing one minute each
• Connection counts and traffic volume (MB)
• Four intentionally added spikes (minutes 45, 92, 139, and 163)
• The first 40 minutes serve as the baseline

The mean measures the average connection count:

\[\bar{x}=\frac{1}{n}\sum_{i=1}^{n} x_i\]

The sample standard deviation measures spread:

\[s=\sqrt{\frac{\sum_{i=1}^{n}(x_i-\bar{x})^2}{n-1}}\]

Baseline mean: 51.7, baseline standard deviation: 7.9.

A z-score describes how far an observation is from the baseline mean:

\[z=\frac{x-\bar{x}}{s}\]

Here, \(x\) is the connection count for a particular minute.

We flag an observation when \(|z|>3\) (more than three standard deviations from the baseline).

Note: A flag is not proof of an attack.

Red points are flagged by the z-score rule, the dashed line shows the upper threshold.

Most observations are near the baseline, a few are much higher.

Move your cursor over the points to see each minute’s connection count and z-score. Use the toolbar to zoom.

The main detection steps in R are:

baseline <- traffic$connections[1:40]
avg <- mean(baseline)
stdev <- sd(baseline)

traffic$z <- (traffic$connections - avg) / stdev
traffic$anomaly <- abs(traffic$z) > 3

subset(traffic, anomaly)

• 6 of 180 minutes were flagged.
• The simulated spikes occur at minutes 45, 92, 139, and 163.
• A z-score rule is a simple way to find unusual values.
• In real networks, an analyst must investigate the cause, unusual traffic does not necessarily mean an attack.

Data source: simulated in R with set.seed(301) and rnorm().