Virtualization hosts utilize their networking stack to provide services, like storage, to the virtual machines they are hosting.
An anomaly in host network statistics could be caused by unexpected behaviour, which might indicate network, capacity or configuration problems. For this reason, the network administrator should be notified to handle the situation and avoid degradation of the virtual machines.
It is a burden for the administrator to define raw thresholds for monitoring the host networking stack because a manual analysis of the historical values in the context of the current usage patterns would be required. If the administrator would get a notification on an anomaly in the monitoring values, they could decide on a high abstraction level if the anomaly is expected in the current situation.

This thesis will explore common approaches to anomaly detection, including appropriate approaches to training, testing, and evaluating, as well as comparing existing algorithms about their suitability to detect anomalies in virtualization hosts network traffic.