Network anomaly detection: a survey and comparative analysis of stochastic and deterministic methods

7 pages. 1 more figure than final CDC 2013 versionWe present five methods to the problem of network anomaly detection. These methods cover most of the common techniques in the anomaly detection field, including Statistical Hypothesis Tests (SHT), Support Vector Machines (SVM) and clustering analysis. We evaluate all methods in a simulated network that consists of nominal data, three flow-level anomalies and one packet-level attack. Through analyzing the results, we point out the advantages and disadvantages of each method and conclude that combining the results of the individual methods can yield improved anomaly detection results

Balanced partitions of 3-colored geometric sets in the plane

Let SS be a finite set of geometric objects partitioned into classes or colors . A subset S'¿SS'¿S is said to be balanced if S'S' contains the same amount of elements of SS from each of the colors. We study several problems on partitioning 33-colored sets of points and lines in the plane into two balanced subsets: (a) We prove that for every 3-colored arrangement of lines there exists a segment that intersects exactly one line of each color, and that when there are 2m2m lines of each color, there is a segment intercepting mm lines of each color. (b) Given nn red points, nn blue points and nn green points on any closed Jordan curve ¿¿, we show that for every integer kk with 0=k=n0=k=n there is a pair of disjoint intervals on ¿¿ whose union contains exactly kk points of each color. (c) Given a set SS of nn red points, nn blue points and nn green points in the integer lattice satisfying certain constraints, there exist two rays with common apex, one vertical and one horizontal, whose union splits the plane into two regions, each one containing a balanced subset of SS.Peer ReviewedPostprint (published version