What is Normal? A Big Data Observational Science Model of Anonymized Internet Traffic

TL;DR

This paper presents a scalable observational science model of anonymized Internet traffic using high-performance graph libraries and supercomputers to define normal behavior for anomaly detection while preserving privacy.

Contribution

It introduces a novel approach combining graph-based models and high-performance computing to analyze anonymized Internet traffic for normal behavior modeling.

Findings

Successfully synthesized low-parameter models of anonymized traffic

Demonstrated scalability with high-performance graph libraries

Enhanced privacy preservation in traffic analysis

Abstract

Understanding what is normal is a key aspect of protecting a domain. Other domains invest heavily in observational science to develop models of normal behavior to better detect anomalies. Recent advances in high performance graph libraries, such as the GraphBLAS, coupled with supercomputers enables processing of the trillions of observations required. We leverage this approach to synthesize low-parameter observational models of anonymized Internet traffic with a high regard for privacy.