A Large-Scale Network Data Analysis via Sparse and Low Rank Reconstruction

Algorithm 1

Anomaly detection using APG.

Input: Network traffic matrix 𝑋∈ℝ^𝑚×𝑛, 𝜆 and tolerance 𝜀.

Initialize: 𝐴₀←0;𝐸₀←0;𝑡₀←1;

Repeat

    Step  1. Update 𝐴_𝑘+1,𝐸_𝑘+1 as 𝐴_𝑘+1=𝕊_𝜇/2(𝑌^𝐴_𝑘+((𝑋−𝑌^𝐴_𝑘−𝑌^𝐸_𝑘)/2)) and 𝐸_𝑘+1=𝕊_𝜇/2(𝑌^𝐸_𝑘+((𝑋−𝑌^𝐴_𝑘−𝑌^𝐸_𝑘)/2)).

    Step  2. Let 𝑡_𝑘+1=(1+1+4𝑡²_𝑘)/2.

    Step  3. Update 𝑌^𝐴_𝑘+1 and 𝑌^𝐸_𝑘+1: 𝑌^𝐴_𝑘+1=𝐴_𝑘+1+((𝑡_𝑘−1)/(𝑡_𝑘+1))(𝐴_𝑘+1−𝐴_𝑘), 𝑌^𝐸_𝑘+1=𝐸_𝑘+1+(𝑡_𝑘−1/𝑡_𝑘+1)(𝐸_𝑘+1−𝐸_𝑘)

Until ‖𝐴_𝑘+1−𝐴_𝑘‖≤𝜀;‖𝐸_𝑘+1−𝐸_𝑘‖≤𝜀; 𝐴←𝐴_𝑘+1,𝐸←𝐸_𝑘+1.

Analyze: normal traffic pattern matrix 𝐴; abnormal traffic matrix 𝐸.

Output: Is there any abnormal activity or not in the whole traffic?