  Detecting the anomaly behaviors such as network failure or Internet
intentional attack in the large-scale Internet is a vital but challenging task.
While numerous techniques have been developed based on Internet traffic in past
years, anomaly detection for structured datasets by complex network have just
been of focus recently. In this paper, a anomaly detection method for
large-scale Internet topology is proposed by considering the changes of network
crashes. In order to quantify the dynamic changes of Internet topology, the
network path changes coefficient(NPCC) is put forward which will highlight the
Internet abnormal state after it is attacked continuously. Furthermore we
proposed the decision function which is inspired by Fibonacci Sequence to
determine whether the Internet is abnormal or not. That is the current Internet
is abnormal if its NPCC is beyond the normal domain which structured by the
previous k NPCCs of Internet topology. Finally the new Internet anomaly
detection method was tested over the topology data of three Internet anomaly
events. The results show that the detection accuracy of all events are over
97%, the detection precision of each event are 90.24%, 83.33% and 66.67%, when
k = 36. According to the experimental values of the index F_1, we found the the
better the detection performance is, the bigger the k is, and our method has
better performance for the anomaly behaviors caused by network failure than
that caused by intentional attack. Compared with traditional anomaly detection,
our work may be more simple and powerful for the government or organization in
items of detecting large-scale abnormal events.
