Fig. Network volume anomalies in large-scale IP networks. Each

measurement corresponds to the cumulative number of bytes between

two consecutive SNMP readings.

Fig. Approximation of real OD flows (dashed lines) by the spline-based (SB) model (full lines) in 3 operational networks. XtSMLE

(k) is the real volume of OD

flow k. Xt(k) stands for the estimated OD flow k using the SB model. XtTGE

(k) is the estimated OD flow k using the tomogravity estimation method.

Fig. (a) RRMSE(t) and (b) cumulative RRMSE (t) for 672 measurements

in Abilene and GEANT networks

Fig. (a) RRMSE(t) and (b) cumulative RRMSE (t) for 672 measurements

in Abilene and GEANT networks.

Fig. RRMSD(t) for 1500 flows in a Tier-2 ISP network

Fig. QQ-plots for 2 residual processes from (a) Abilene and (b) GEANT

Fig. Correct detection rate vs. false alarm rate for the OSBD method

(solid line) and the PCA approach, considering a different number of k first

principal components uk to model the normal subspace.

Fig. Typical realizations of anomaly detection/isolation functions for a

Tier-2 network (a and b) and Abilene (c and d).

Fig. On-line volume anomaly detection and isolation in Abilene, using

the SSB method. The time between consecutive measurements is 5 min