# Multi-Resolution Analysis with Visualization to Determine Network Attack Patterns
## 4 Multi Resolution Analysis (MRA)  
MRA generates multiple levels of representation to understand network traffic data by utilizing signal processing techniques. Prior to analyzing the datasets, data pre-processing was applied to exclude categorical attributes and null values. Then, a Discrete Wavelet Transform (DWT) was used to discover underlying patterns in different resolution levels (\(\gamma\)). The DWT decomposes data into a set of mutually orthogonal wavelet basis functions with a function, \(\psi\), known as \"mother wavelet\". The wavelet basis functions indicate dilated, translated, and scaled versions of the mother wavelet. Since it includes a set of transforms, each with a different set of wavelet basis functions and different mother wavelets can be utilized to decompose data. The main idea of the transform is to calculate the degree of relationship between wavelets and data at different scales. Prior studies [38; 39; 40] showed that wavelet transform is suitable for analyzing non-stationary data such as Internet traffic data. The DWT produces multiple levels of frequency components by splitting the data at each level into high and low frequencies, denoting detail and approximate coefficients, respectively. The coefficients present temporal information of the data with different scales. Since the detail coefficients can detect rapid changes in the data, they are commonly used to identify discontinuity or sudden changes. Since choosing a proper wavelet function (i.e., mother wavelet) that matches well with data can maximize the correlation between the data and the mother wavelet [41; 42], selecting an appropriate mother wavelet is vital to produce good performances. In network anomaly detection analysis, various DWT decomposition levels (\(\gamma\)) can be considered because different results can be produced depending on the applied decomposition level [43]. If a high decomposition level is used, it requires more computational costs to determine wavelet coefficients. Similarly, if a smaller decomposition level is applied, a short execution time might be needed. However, in such a case (having a smaller decomposition level), it is not easy to discover detailed internal structures. In our previous study [44], we conducted an analysis to determine an optimal decomposition level and found that \(\gamma=3\) is great for determining attack events in the NSLKDD dataset. Therefore, we utilized the same decomposition level in this study to analyze the datasets. With the decomposition level (\(\gamma=3\)), various levels of detail coefficients (detail level \(1\sim\gamma\)) and approximate coefficients were measured. Since statistical validation is critical to filter unnecessary coefficients, we performed a statistical validation using ANOVA to select significant features with the \(p\)-values (\(p<0.0001\)). That is, \(\omega_{i,j}=\{\omega_{1,j},\omega_{2,j},\cdots,\omega_{i,j}\}\) represents wavelet coefficients at the \(j\)th level (i.e., \(j=1,2,\cdots,(gamma+1)\)), and \(i\) is the length of the coefficients of the \(j\)th level. The set \(\Omega=\{\omega_{k,j}\},k=1,2,\cdots,m\) is the selected coefficients with the ANOVA test, and the \(m\) indicates the length of the selected features. For analyzing network traffic data, the utilization of sliding windows is often considered [45; 46]. It runs with two user-defined parameters: window size (\(\alpha\)) and step size (\(\beta\)). Finding optimal window and step size is important for understanding the characteristics of the data. Different scales of feature vectors are generated depending on the window and step size. If a small window size is chosen, large feature vectors are usually generated. The step size is also important because it has a direct impact on identifying anomalous instances. A popular approach to determining the sliding window size is utilizing the time information of events or data instances. In addition, PCA is utilized to generate visualizations.