About MAWILab

MAWILab is a database that assists researchers to evaluate their traffic anomaly detection methods. It consists of a set of labels locating traffic anomalies in the MAWI archive (samplepoints B and F). The labels are obtained using an advanced graph-based methodology that compares and combines different and independent anomaly detectors. The data set is daily updated to include new traffic from upcoming applications and anomalies.

We are planning to improve the quality and the variety of the labels over time by including the results from emerging anomaly detectors. Therefore, we encourage researchers to submit us their results or detectors so we can maintain a reliable labeling of the MAWI archive.

Citation policy

If you publish material based on MAWILab, then, help others to obtain the same data sets and replicate your experiments by citing MAWILab original paper. This reference includes detailed explanations of MAWILab and a link to this website. Here is the suggested format for referring to MAWILab:

R. Fontugne, P. Borgnat, P. Abry, K. Fukuda. "MAWILab: Combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking". ACM CoNEXT 2010. Philadelphia, PA. December 2010.

and the corresponding BiBTeX entry:
  author = {Fontugne, Romain and Borgnat, Pierre and Abry, Patrice and Fukuda, Kensuke},
  title = {{MAWILab: Combining Diverse Anomaly Detectors for Automated Anomaly Labeling and Performance Benchmarking}},
  booktitle = {ACM CoNEXT '10},
  month = {December},
  year = {2010},
  address = {Philadelphia, PA},
  numpages = {12}}


January 2015: MAWILab v1.1

New results are available online! Detectors parameters settings have been improved and anomalies are now classified with the taxonomy presented here.
Anomalies are now available in both xml and csv format. See the documentation for more details.

January 2013: Tools for browsing MAWILab.

The documentation contains a new section that helps one to extract useful data from MAWILab.

November 2010: MAWILab will be presented at CoNEXT 2010.

MAWILab results from a graph-based methodology that will be presented the 1st of December at CoNEXT 2010 in Philadelphia.

July 2010: The first version of MAWILab is online.

This version contains labeled anomalies for more than nine years of backbone traffic. For this version the labels are the result of the combination of four diverse detectors based on different theoretical backgrounds: the Principal Component Analysis, the Gamma distribution, the KullbackÔÇôLeibler divergence and the Hough transform.