PCA-based Multivariate Statistical Network Monitoring for Anomaly Detection Camacho Páez, José Pérez Villegas, Alejandro García Teodoro, Pedro Macía Fernández, Gabriel Multivariate Statistical Process Control Network Monitoring Network Security Principal Component Analysis Anomaly Detection The multivariate approach based on Principal Component Analysis (PCA) for anomaly detection received a lot of attention from the networking community one decade ago mainly thanks to the work of Lakhina and co-workers. However, this work was criticized by several authors that claimed a number of limitations of the approach. Neither the original proposal nor the critic publications were completely aware of the established methodology for PCA anomaly detection, which by that time had been developed for more than three decades in the area of industrial monitoring and chemometrics as part of the Multivariate Statistical Process Control (MSPC) theory. In this paper, the main steps of the MSPC approach based on PCA are introduced; related networking literature is reviewed, highlighting some differences with MSPC and drawbacks in their approaches; and specificities and challenges in the application of MSPC to networking are analyzed. All of this is demonstrated through illustrative experimentation that supports our discussion and reasoning. 2019-04-01T06:26:26Z 2019-04-01T06:26:26Z 2016-06 journal article http://hdl.handle.net/10481/55287 https://doi.org/10.1016/j.cose.2016.02.008 eng http://creativecommons.org/licenses/by-nc-nd/3.0/es/ open access Atribución-NoComercial-SinDerivadas 3.0 España