Automated Contextual Anomaly Detection for Network Interface Bandwidth Utilisation: A Case Study in Network Capacity Management

Abstract

We present a contextual anomaly detection methodology utilised for the capacity management process of a managed service provider that administers networks for large enterprises. We employ an ensemble of forecasts to identify anomalous network traffic. Stream of observations, upon their arrival, are compared against these baseline forecasts and alerts generated only if the anomalies are sustained. The results confirm that our approach significantly reduces false alerts, triggering rather more accurate and meaningful alerts to a level that could be proactively consumed by a small team. We believe our methodology makes a useful contribution to the applications enabling proactive capacity management.