  This paper presents a tutorial for network anomaly detection, focusing on
non-signature-based approaches. Network traffic anomalies are unusual and
significant changes in the traffic of a network. Networks play an important
role in today's social and economic infrastructures. The security of the
network becomes crucial, and network traffic anomaly detection constitutes an
important part of network security. In this paper, we present three major
approaches to non-signature-based network detection: PCA-based, sketch-based,
and signal-analysis-based. In addition, we introduce a framework that subsumes
the three approaches and a scheme for network anomaly extraction. We believe
network anomaly detection will become more important in the future because of
the increasing importance of network security.
