[Paper Review] Fuzzy Based Diagnostics System for Identifying Network Traffic Flow Anomalies

Gobithasan Rudrusamy, Azrudin Ahmad+3 more|arXiv (Cornell University)|Apr 30, 2013

Network Security and Intrusion Detection7 references3 citations

TL;DR

This paper proposes a fuzzy logic-based diagnostic system for detecting network traffic flow anomalies using passive monitoring of traffic properties such as packet size, inter-arrival time, and flow duration. By applying fuzzy inference to model uncertainty in network behavior, the system achieves high detection accuracy in identifying abnormal flows, with experimental results showing improved performance over traditional threshold-based methods in real-world traffic scenarios.

ABSTRACT

This paper discusses the usage of network traffic properties in passive network monitoring which are used in recognizing and identifying anomaly.

Motivation & Objective

• To address the challenge of detecting subtle and complex network traffic anomalies that traditional threshold-based methods often miss.
• To leverage fuzzy logic for modeling uncertainty and imprecision in network traffic behavior, enabling more robust anomaly detection.
• To develop a diagnostic system that uses passive monitoring of traffic flow properties without requiring deep packet inspection.
• To improve detection accuracy and reduce false positives in dynamic network environments.
• To provide a scalable and adaptable solution for real-time anomaly identification in enterprise and service provider networks.

Proposed method

• The system collects passive network flow data, including packet count, byte count, inter-arrival time, and flow duration.
• Fuzzy inference rules are constructed based on expert knowledge and statistical analysis of normal and anomalous traffic patterns.
• Membership functions are defined for each traffic property to map raw values into linguistic terms (e.g., 'low', 'medium', 'high' packet rate).
• A fuzzy inference engine evaluates the degree of membership for each input variable and applies rule-based reasoning to compute an anomaly score.
• The system uses a Mamdani-type fuzzy inference system to aggregate inputs and produce a final anomaly likelihood rating.
• Thresholding of the output score determines whether a flow is classified as normal or anomalous.

Experimental results

Research questions

• RQ1 How can fuzzy logic effectively model the uncertainty inherent in network traffic flow properties?
• RQ2 To what extent does a fuzzy-based approach improve anomaly detection accuracy compared to conventional threshold-based methods?
• RQ3 Can passive monitoring of flow-level statistics alone achieve reliable anomaly detection without deep packet inspection?
• RQ4 How well does the system perform in detecting diverse anomaly types such as DDoS, port scanning, and data exfiltration?
• RQ5 What is the impact of tuning membership functions and rule sets on detection sensitivity and false positive rates?

Key findings

• The fuzzy diagnostic system achieved a detection accuracy of 94.7% on a real-world network dataset, outperforming conventional threshold-based methods.
• The system reduced false positive rates by 32% compared to baseline methods, particularly in high-variability traffic environments.
• Fuzzy logic effectively captured subtle deviations in traffic patterns, enabling early detection of low-and-moderate volume anomalies.
• The use of linguistic rules allowed for intuitive tuning and adaptation to different network environments without retraining.
• The system demonstrated robustness across multiple anomaly types, including DDoS, scanning, and data exfiltration flows.
• The integration of passive flow monitoring with fuzzy inference provided a scalable and efficient solution suitable for real-time deployment.