DETECTING NETWORK TRAFFIC ANOMALIES IN A COMMUNICATION NETWORK

摘要

For detecting network traffic anomalies in a communication network, determined (S1) at defined time intervals is network traffic data associated with network entities of the communication network. For the time intervals, calculated (S2) in each case are Tsallis entropy values for a plurality of entropy moments based on the network traffic data, the entropy moments being defined by Tsallis entropy parameters q. The network traffic anomalies are detected (S3) based on divergence of the Tsallis entropy values associated with the plurality of entropy moments from reference values. By exploring not one but a plurality of different entropy moments, a generalized form of entropy is used to capture more elaborately changes in network traffic, because the distribution of activity is not reduced to a single number, and thus, important information, such as the nature of the change, is not deleted, and an increased quantity of anomalies is detected.