The effective and efficient detection of network anomalies is still a challenging task. The authors’ proposed “bivariate parametric detection mechanism (bPDM) uses a sequential probability ratio test [SPRT], allowing for control over the false positive rate.”

The introductory section presents three key features of the approach. First, “detection operates on aggregate traffic, without flow separation or deep-packet inspection”--that is, it considers only packet headers and timing information. Second, the method automates training--that is, the key algorithmic parameters are automatically calculated. Finally, “both the packet rate and the sample entropy of the packet-size distribution statistics [are used] to ensure robustness against false positives.”

Section 2 provides a systematic overview of the related work, covering methods requiring flow separation as well as nonparametric and spectral methods. The authors outline how each group of methods differs from their approach. The following section gives background on sequential detection methods, posing the anomaly detection problem as a statistical hypothesis test and using the likelihood ratio to implement the SPRT.

Section 4 “derive[s] the SPRTs for the packet-rate and packet-size features”; proposes a generalized likelihood ratio test; and highlights the central features of the bPDM algorithm, which combines the two SPRTs. This theoretical section is very well and very carefully done. Unfortunately, though, there are many references to the appendices in a technical report by the authors, which makes this paper not fully self-contained.

In the last part of the paper, section 5, the authors present a performance evaluation and analysis of the proposed method. For the evaluation, they use controlled synthetic traces, emulated Iperf attacks, and real and proxy-real network attacks, as well as the bit-rate signal-to-noise ratio (SNR) metric. This extensive evaluation covers more than 50 percent of the paper. However, what the reader might miss is a thorough interpretation and discussion of the section’s many valuable results. Nevertheless, it is a very useful paper that is well structured and presented.