  Anomaly detection has emerged as a popular technique for detecting malicious
activities in local area networks (LANs). Various aspects of LAN anomaly
detection have been widely studied. Nonetheless, the privacy concern about
individual users or their relationship in LAN has not been thoroughly explored
in the prior work. In some realistic cases, the anomaly detection analysis
needs to be carried out by an external party, located outside the LAN. Thus, it
is important for the LAN admin to release LAN data to this party in a private
way in order to protect privacy of LAN users; at the same time, the released
data must also preserve the utility of being able to detect anomalies. This
paper investigates the possibility of privately releasing ARP data that can
later be used to identify anomalies in LAN. We present four approaches and show
that they satisfy different levels of differential privacy - a rigorous and
provable notion for quantifying privacy loss in a system. Our real-world
experimental results confirm practical feasibility of our approaches. With a
proper privacy budget, all of our approaches preserve more than 75% utility of
detecting anomalies in the released data.
