<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="6.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Ling Huang</style></author><author><style face="normal" font="default" size="100%">Xuanlong Nguyen</style></author><author><style face="normal" font="default" size="100%">Minos Garofalakis</style></author><author><style face="normal" font="default" size="100%">Michael Jordan</style></author><author><style face="normal" font="default" size="100%">Anthony Joseph</style></author><author><style face="normal" font="default" size="100%">Nina Taft</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">In-Network PCA and Anomaly Detection</style></title></titles><dates><year><style  face="normal" font="default" size="100%">2007</style></year><pub-dates><date><style  face="normal" font="default" size="100%">01/2007</style></date></pub-dates></dates><urls><web-urls><url><style face="normal" font="default" size="100%">http://www.eecs.berkeley.edu/Pubs/TechRpts/2007/EECS-2007-10.pdf</style></url></web-urls></urls><publisher><style face="normal" font="default" size="100%">U.C. Berkeley</style></publisher><pub-location><style face="normal" font="default" size="100%">Berkeley, CA</style></pub-location><abstract><style face="normal" font="default" size="100%">We consider the problem of network anomaly detection in large distributed systems. In this setting, Principal Component Analysis (PCA) has been proposed as a method for discovering anomalies by continuously tracking the projection of the data onto a residual subspace. This method was shown to work well empirically in highly aggregated networks, that is, those with a limited number of large nodes and at coarse time scales. This approach, however, has scalability limitations. To overcome these limitations, we develop a PCA-based anomaly detector in which adaptive local data filters send to a coordinator just enough data to enable accurate global detection. Our method is based on a stochastic matrix perturbation analysis that characterizes the tradeoff between the accuracy of anomaly detection and the amount of data communicated over the network.</style></abstract><work-type><style face="normal" font="default" size="100%">Technical Support</style></work-type></record></records></xml>