Network anomalies, such as wide-area congestion and packet loss, can seriously degrade network performance. To this end, it is critical to accurately identify network anomalies on end-to-end paths for high quality network services in practice. In this work, we propose an unsupervised two-step method for the detection and characterization of general network anomalies. It first finds the change-points in large-scale RTT time series by formalizing an optimization problem in terms of data series segmentation. Then we mark the segments as normal or abnormal on different sides of a change-point through exploitation of their distribution statistics. After detecting an anomaly, a further step is introduced to analyze the relations between links with state changes and localize the entities (nodes or links) that most likely cause the corresponding event. We believe such unsupervised and light-weighed method can provide valuable insights on anomaly mining in large-scale time series data. Extensive experiments on both simulated (artificial time series with ground truth) and real-network (RIPE Atlas traceroute measurements) datasets are performed. The results demonstrate that the proposed method can achieve better performance, w.r.t. accuracy and efficiency, than existing solutions.

中文翻译：

---

大规模RTT时间序列中网络异常的检测和表征

网络异常（例如，广域拥塞和数据包丢失）会严重降低网络性能。为此，对于实践中的高质量网络服务而言，准确识别端到端路径上的网络异常至关重要。在这项工作中，我们提出了一种无监督的两步法来检测和表征一般网络异常。它首先通过形式化数据序列分段方面的优化问题来找到大规模RTT时间序列中的变化点。然后，通过利用它们的分布统计信息，在变化点的不同侧将这些段标记为正常或异常。在检测到异常之后，引入了进一步的步骤来分析具有状态变化的链接之间的关系，并定位最有可能引起相应事件的实体（节点或链接）。我们相信，这种无监督且轻量级的方法可以为大规模时间序列数据中的异常挖掘提供有价值的见解。在模拟（具有地面真实性的人工时间序列）和真实网络（RIPE Atlas跟踪路径测量）数据集上都进行了广泛的实验。结果表明，与现有解决方案相比，该方法可以实现更好的性能，准确度和效率。