Anomalies are unusual and significant changes in a network's traffic
levels, which can often involve multiple links. Diagnosing anomalies is
critical for both network operators and end users. It is a difficult
problem because one must extract and interpret anomalous patterns from
large amounts of high-dimensional, noisy data.
                                                                                
In this talk I will propose the subspace method to diagnose
anomalies.  This diagnosis technique is based on a separation of the
high-dimensional space occupied by a set of network traffic measurements
into disjoint subspaces corresponding to normal and anomalous network
conditions.


Using only simple traffic measurements from links, the subspace method
can: (1) accurately detect when a volume anomaly is
occurring;  (2) correctly identify the underlying origin-destination
(OD) flow which is the source of the anomaly; and (3) accurately estimate
the amount of traffic involved in the anomalous OD flow.
                                                                                
I will evaluate the method's ability to diagnose (i.e., detect, identify,
and quantify) both existing and synthetically injected volume anomalies in
real traffic from two backbone networks.  We find that the subspace method
consistently diagnoses the largest volume anomalies, and does so with a
very low false alarm rate.
                                                                                
Finally, if time permits, I will present recent characterization results
on the nature and cause of traffic anomalies.