Abstract

Modern network systems experience increasingly complex network anomalies. Outdated anomaly detection systems are inefficient at detecting subtle or transient network misconfigurations. Anomaly systems do not respond in real-time. This paper proposes an active-probing anomaly-detection system that monitors traffic flows in real time. Active probing systems are a form of synthetic traffic generation that allows systems to condition network flows. Based on expected results and real-time system traffic outcomes, which discrepancies are filtered and or flagged as network anomalies? Round-trip time, baseline modeling loss, and network traffic jitter constitute the operational statistics of the proposed systems. In combination with statistical methods, machine learning classifiers, time-series network probes, and features, we detected accurate real-time anomalies. This framework enables volumetric, behavioral, and stealth detection of low-rate denial-of-service (LDoS) attacks, abrupt route changes, and stealthy data exfiltration. The proposed framework and its active probing strategies enable real-time, proactive detection of network anomalies at significantly lower operational cost to network resources. The framework provides active network system probes to ensure and protect the network's health and integrity, providing systems with real-time operational safeguards.