Abstract:

Network performance anomaly detection is of great significance to promote the healthy development of the network. In order to solve the problem that the existing anomaly detection methods are mostly offline and cannot provide good real-time online detection performance, the principal component analysis method was used to establish the anomaly detection model, and the network anomaly detection threshold was adjusted adaptively by combining historical performance data with recent network performance fluctuations. The real-time online anomaly detection was realized and the data was collected on NFV network. The experimental results showed that the proposed method reduced the false alarm rate by 5% to 8% compared with the offline detection method which was widely used, indicating the greater use value of the proposed method for network operators.

Key words: anomalydetection, network performance matrix, principal component analysis, slidingwindow, dynamicthreshold, online real-time monitoring