# Multi-Resolution Analysis with Visualization to Determine Network Attack Patterns
###### Abstract  
Analyzing network traffic activities is imperative in network security to detect attack patterns. Due to the complex nature of network traffic event activities caused by continuously changing computing environments and software applications, identifying the patterns is one of the challenging research topics. This study focuses on analyzing the effectiveness of integrating Multi-Resolution Analysis (MRA) and visualization in identifying the attack patterns of network traffic activities. In detail, a Discrete Wavelet Transform (DWT) is utilized to extract features from network traffic data and investigate their capability of identifying attacks. For extracting features, various sliding windows and step sizes are tested. Then, visualizations are generated to help users conduct interactive visual analyses to identify abnormal network traffic events. To determine optimal solutions for generating visualizations, an extensive evaluation with multiple intrusion detection datasets has been performed. In addition, classification analysis with three different classification algorithms is managed to understand the effectiveness of using the MRA with visualization. From the study, we generated multiple visualizations associated with various window and step sizes to emphasize the effectiveness of the proposed approach in differentiating normal and attack events by forming distinctive clusters. We also found that utilizing MRA with visualization advances network intrusion detection by generating clearly separated visual clusters.  
visualization; intrusion detection analysis; discrete wavelet transformation +
Footnote †: journal: Medical  
In this paper, we propose an approach to analyzing network traffic data by integrating multi-resolution analysis (MRA) and visualization. MRA [1] examines data to represent different scales or frequency components based on signal processing techniques. For MRA, wavelet transform is considered because it decomposes data into multiple lower-resolution levels and determines dominant modes of variability [2]. It has been widely used in analyzing non-stationary data to determine anomalies, including false network events or network intrusions [3; 4; 5]. Among various wavelet methods, such as Continuous Wavelet Transform (CWT), Fast Wavelet Transform (FWT), Discrete Wavelet Transform (DWT), and Stationary Wavelet Transform (SWT), DWT is utilized in this study to extract features from network traffic data. After determining the number of features based on input parameters, statistical validation is performed to evaluate the selected features and remove non-statistically significant elements. Principal Component Analysis (PCA) is then applied to determine the new vital variables from the selected features to support the analysis of network traffic activities in visualization. To highlight the effectiveness of our proposed method, we performed an in-depth analysis with publicly available intrusion detection datasets. The main contributions of our work are:  
* We performed an in-depth analysis of MRA with multiple intrusion detection datasets.
* We evaluated various wavelet functions to find the optimal wavelet for analyzing network traffic activities utilizing visualization techniques.
* We also conducted classification and clustering analysis to detect network attack patterns.
* To the best of our knowledge, our work is the first visual analysis to understand the effectiveness of MRA with visualization in analyzing network traffic data.  
The rest of the paper is organized as follows. First, we discuss prior research in network intrusion detection and the benefits of utilizing visualization techniques. Then, the MRA method is explained in greater detail with an emphasis on the importance of a visualization tool. In Section 6, we present the performance evaluation results and conclude with a discussion, conclusion, and future work.