  Introducing Internet traffic anomaly detection mechanism based on large
deviations results for empirical measures. Using past traffic traces we
characterize network traffic during various time-of-day intervals, assuming
that it is anomaly-free. Throughout, we compare the two approaches presenting
their advantages and disadvantages to identify and classify temporal network
anomalies. We also demonstrate how our framework can be used to monitor traffic
from multiple network elements in order to identify both spatial and temporal
anomalies. We validate our techniques by analyzing real traffic traces with
time-stamped anomalies.
