Network Traffic Anomaly Detection Based On ARX Model

With the rapid development and wide spread application of the Internet, thedemand for network resources is growing rapidly. Meanwhile, there are a large numberof attacks on the network, which seriously affect the performance of the network. Thedirect manifestation of network attacks is network traffic anomalies, which should bedetected quickly and effectively. In this paper we proposed a new algorithm, whichcalled Sliding Window Wavelet, and it can detect and analyze the network anomalies.Using SWBT and ARX model, we can model and forecast network traffic. Thenclustering and outlier detection will be realized by Clustering Fuzzy C Mean Algorithm.Firstly we introduce the characteristics and algorithm of Sliding Window Wavelet.It can deal with the redundancy which generated by sliding window. This algorithmachieve such result that when updating a data on original signal window, itsimultaneously updates the wavelet coefficients of the wavelet decomposition level. Soit’s a real-time algorithm. Then we modeling the wavelet coefficients of each level byARX model. After modeling we obtain the outlier series and analyze its adaptiveprediction in time series. Finally, we analyze the principle of Fuzzy Clustering andclustering FCM algorithm, which should be applying in clustering analysis and anomalydetection of the ARX model outlier series. By the collaborative analysis of severalmathematical models, we successfully realized the anomaly detection of network traffic,and also made some achievements in real-time testing. We then evaluate our approachwith the KDDCup99dataset and conduct a network traffic experiment. Evaluationresults show that the approach achieves a higher degree in anomaly detection.