Abstract-The rapid and accurate detection of network traffic anomaly detection, there were problems in the real-time anomaly is one of the preconditions to guarantee the effective performance and the accuracy of detection still. Researchers work of the network. Aiming at the deficiency of present methods have found that almost all the traffic time-varying signal were of network traffic anomaly detection, we propose a scale-adaptive method based on wavelet packet. By means of wavelet packet mult-scales [13] and the thme-varying signals of the normal decomposition, our method can adjust the decomposition process network traffics and that of the abnormal network traffics were adaptively, has the same detective ability to the anomaly of different in frequency band range. That is to say, the difference various frequency, especially the middle and high frequency ones between anomalous traffics and background traffics is various which can not be checked out by the multi-resolution analysis. By in different frequency bands. In certain frequency band, the means of adaptive reconstruction of the wavelet packet coefficient . . . t of different wavelet domains which anomaly, our method is energy of anomalous traffics iS rather high in proportion to able to confirm the characteristics of anomaly and enhance the the total energy, so anomaly detection could be done easily. As a new technology, anomaly detection of network trafsuch as the misuse of network equipments, network operations fic based on wavelet analysis is taken more seriously reanomaly, flash crowd, network intrusion and so on will cause cently years. VAlarcon-Aquino presented an algorithm based network traffic anomaly. The characteristic of anomaly traffic on undecimated discrete wavelet transform and bayesian is that it breaks out without any omen and can destroy analysis [14]. This algorithm is able to detect and locate subtle networks and computers in a short time (For instance, the changes in variance and frequency in the given time series, but outburst of traffic behavior caused by specific attack programs its decomposition scale is limited and the algorithm is complior worm burst). Therefore, detecting traffic anomaly rapidly cated. Anu Ramanathan presented a WADeS (Wavelet based and accurately is one of the preconditions of ensuring the Attack Detection Signatures) mechanism based on wavelet efficient network operation. The traffic in routers especially the analysis to detect the DDoS attack [15] , which makes wavelet routers in trunk network is very large and change continually, transform for the traffic signals, then computes the variance of while the anomalous traffic is small, compared with the normal the wavelet coefficients to estimate the attack points. However, traffic and changes of the normal traffic. The ultimate aim this method has very high computation complexity. Barford of the anomaly detection algorithm is to detect the relatively presented a method[ 16] presented a method which decomposes small anomaly traffic from the relatively large background network traffic with decimated discrete wavelet transform traffic. It is very difficult to implement this aims, so detection , then synthesizes to Low, Mid, High frequency-parts, and of anomalous traffic has become the attractive and valuable finally detect anomaly with Deviation Scoring respectively. subject in the present academic and industrial circles. This algorithm is able to detect the flash crowds and short-term Various schemes are proposed for the network traf-anomalies in postmortem.
Gao et al. REF presented an anomaly detection model using wavelet packet, which is a generalization of the pyramidal algorithm of the traditional wavelet transform.
Anomaly Detection of Network Traffic Based on Wavelet Packet
2006 Asia-Pacific Conference on Communications
2006 Asia-Pacific Conference on Communications
Computer Science