Title : Applying the Subspace Method to Network Traffic 
Analysis

Effective monitoring of IP networks requires analysis of 
traffic at multiple points throughout a network 
simultaneously. This problem can be attacked via methods of 
multivariate statistics. In this talk I will focus on one 
example: analyzing network traffic via principal component 
analysis (PCA). I will show that although network traffic 
takes the form of a high dimensional timeseries, that 
typical network behavior can be captured well by a low 
dimensional approximation obtained via PCA. This suggests 
the use of the subspace method for identifying unusual 
network conditions, which I will describe. I will then 
present results of using the subspace method for detecting 
and diagnosing a wide range of network anomalies, including 
volume anomalies (unusual surges in traffic), network abuse, 
and changes in customer behavior.