Skip to Main content Skip to Navigation
New interface
Conference papers

MAWILab : Combining Diverse Anomaly Detectors for Automated Anomaly Labeling and Performance Benchmarking

Abstract : Evaluating anomaly detectors is a crucial task in traffic monitoring made particularly difficult due to the lack of ground truth. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labeled anomaly traffic traces. We aim at automatically finding anomalies in the MAWI archive using a new methodology that combines different and independent detectors. A key challenge is to compare the alarms raised by these detectors, though they operate at different traffic granularities. The main contribution is to propose a reliable graph-based methodology that combines any anomaly detector outputs. We evaluated four unsupervised combination strategies; the best is the one that is based on dimensionality reduction. The synergy between anomaly detectors permits to detect twice as many anomalies as the most accurate detector, and to reject numerous false positive alarms reported by the detectors. Significant anomalous traffic features are extracted from reported alarms, hence the labels assigned to theMAWI archive are concise. The results on the MAWI traffic are publicly available and updated daily. Also, this approach permits to include the results of upcoming anomaly detectors so as to improve over time the quality and variety of labels.
Complete list of metadata
Contributor : Pierre Borgnat Connect in order to contact the contributor
Submitted on : Wednesday, January 5, 2011 - 1:31:06 PM
Last modification on : Friday, April 8, 2022 - 4:06:02 PM
Long-term archiving on: : Wednesday, April 6, 2011 - 2:51:43 AM


Files produced by the author(s)


  • HAL Id : ensl-00552071, version 1



Romain Fontugne, Pierre Borgnat, Patrice Abry, Kensuke Fukuda. MAWILab : Combining Diverse Anomaly Detectors for Automated Anomaly Labeling and Performance Benchmarking. ACM CoNEXT 2010, Nov 2010, Philadelphia, United States. ⟨ensl-00552071⟩



Record views


Files downloads