Anomaly Detection For Time Series Of Network Activity

Time-series data widely exists in the field of finance, medical treatment, communication and aviation. These data are apparently chronological. With the universal machine production, more and more time-series data have been recorded. And the research of time-series data mining attracts more and more attention. Since time-series data are huge and complicated, the compression and preprocessing technology are very necessary. These technique should guarantee that the information in the source data must be remained as much as possible while the original data are compressed, so the preprocessing method of time-series is an important task of time-series data mining. In addition, in some kinds of time-series data, abnormal data often carries more useful information, so anomaly detection of time-series is more attractive. Some rich achievements has been produced in this field and a large number of algorithms have been proposed to solve the different anomaly detection tasks.Reasonable treatment and effective detection of the abnormities in the sequence is a challenging and important research topic. In this thesis, on the basis of network activity data, the preprocessing method and anomaly detection of time-series have been researched. The main work is as follows:Firstly, the research background and significance of time-series anomaly detection are introduced, the characteristics of time-series data are given. Secondly, a preprocessing method is proposed which is based on the features of network activity data, the method can extract the multivariate time series that are different from the time granularity and the agent of activity from complex network activity data. Then the polymerization method is used to reduce the amount of original data, the aggregated data is discretized, so that the time-series data can be more smooth and convenient for anomaly detection.After the serialization of network activity data, two kinds of method are designed and implemented to detect abnormalities for time series based on the domestic and overseas research achievements. One method uses a sliding window based on the Gauss model to predict the next data after the window, it gives a confident interval of the data,if the data is not in the area, it is defined to be abnormity. Another method mainly uses the distance decision algorithm which is based on dynamic window to judge whether the data is abnormal.In this thesis, the time-series preprocessing results of network activity data are given, and the two kinds of anomaly detection algorithms proposed in this thesis are compared with two traditional algorithms, the results of experiment are shown by pictures and tables, the analysis of different results is also given. Finally, the preprocessing scheme and the anomaly detection algorithms are integrated into a system, and graphical interfaces are provided.