Study On Anomaly Detection Of Network Traffic Based On Diffusion Wavelet

Internet technology is one of the fastest growing technology in the21st Century. It has been widely used in our life and made great contribution to social and economic development. However, there have been many problems coming with the great convenience. Network intrusion and other security problems have become the main factor restricting the network development. If these problems are not fixed, the normal network applications and even the social security would be affected.In network anomaly detection, the characteristic of traffic matrix is often used to detect anomaly. Currently the most study is on anomaly detection, anomaly localization is rarely addressed. However the network anomaly localization and optimization are very important. Therefore, according to the multi-resolution analysis (MRA) method proposed in recent years, this thesis proposes an anomaly detection and localization method based on two-dimension diffusion wavelet. This diffusion wave let-based method is an efficient MRA method. The main contribution of this thesis includes the following three aspects:(1Coefficients selection. Diffusion Wavelet Transform decomposes traffic matrix into approximate matrices and detail matrices on different scales. Some coefficients of these matrices are closely related to the original traffic matrix. Through the experimental analysis, we finally choose the four critical coefficients for detection and localization.(2) Anomaly detection. In this thesis, based on the selected parameters, we carry out anomaly detection experiments. Anomaly detection experiments are conducted in two types of anomaly scenarios and the probability distribution of parameters are analyzed in each scenario. Finally, we study the accuracy of anomaly detection(3) Anomaly Localization By comparing the differences between abnormal parameters and normal parameters, an effective single-node anomaly localization method is proposed, finally, we study the accuracy of anomaly localization.According to experimental results, our method based on two-dimension diffusion wavelet can reduce the amount of information to be processed, analyze the original traffic matrix, detect and localize some types of network anomaly by using the appropriate scale and particular wavelet coefficients.