Structured-Anomaly Pursuit of Network Traffic via Corruption-Robust Low-Rank Tensor Decomposition

Jiuzhen Zeng, Laurence T. Yang, Chao Wang, Yiheng Ruan, Chenlu Zhu

Abstract: Accurately pursuing network traffic anomalies is crucial to network maintenance and management. However, existing methods generally focus on detecting uniformly distributed sparse noises and therefore fail to deal with non-uniform or sequential anomalies with effect. In this article, a novel corruption-robust low-rank tensor decomposition (Cr-LTD) method is proposed for accurate and efficient structured-anomaly pursuit even in presence of sparse corruptions. For the intrinsically low-rank network traffic observation, Cr-LTD models it as a three-way tensor and formulates the traffic anomaly pursuit as a low-rank tensor decomposition problem. The intrinsically low-rank structure of network traffic tensor is depicted via a novel tensor nuclear norm which is a tight convex surrogate of tensor tubal rank. ${{\ell }_{2,1}}$ -norm and ${{\ell }_{1}}$ -norm are also introduced in Cr-LTD respectively for effective characterization on structured-anomaly and strong robustness to sparse corruption. Equipped with tensor nuclear norm and two regularizations, Cr-LTD achieves the low-rank tensor decomposition via solving and accelerating a convex program, thereby pursuing structured-anomaly robustly. Extensive experiments are conducted using a set of synthetic data and real-world network traffic datasets. Experiment results verify the superior performance of Cr-LTD over the state-of-the-art methods in terms of pursuit accuracy and corruption robustness.