Diffusion Wavelet-based Analysis On Network Traffic Model And Its Applications

Traditional Internet traffic studies have focused on single-link traffic analysis in time domain within an ISP’s network. At present, researchers have made great progress in the areas of self-similar stochastic processes, long-range dependence, and heavy-tailed distributions and so on. They have demonstrated the benefits of applying a wavelet-based multi-resolution analysis (MRA) approach when analyzing traffic. But, most of these researches focus on single link or internet terminal, taking traffic as a one-dimensional signal. However, an ISP’s physical infrastructure typically consists of hundreds or thousands of such links which are connected by routers or switches, and the Internet as a whole is made up of about 20,000 such ISPs.Traffic matrix is the representation of traffic distribution in arbitrary pairs of OD(Origin-Destination) in a period in the network, which is able to describe the traffic characteristics in the entire network, and has become the critical parameter in the field of network traffic engineering. Besides, it contains the information about the irregular topology structure of network. Diffusion wavelets can be effective in analysis of irregular topology and multilayer structure in both time domain and space domain. Therefore, the diffusion wavelets are applied to multi-scale analysis of traffic matrices, and then apply result of the study to the DDoS detection in whole network. The study content of the thesis is mainly divided into the following three aspects.(1) In this thesis, the traditional network traffic models are firstly introduced, their advantages and disadvantages are pointed out, and the characteristics of network traffic and related parameters are analyzed.(2) Analyzing the traffic matrices in multi-scale based on diffusion wavelet technology. Through analyzing the different scale coefficients obtained by the diffusion wavelet transformation of the traffic matrices, the fourth layer approximation coefficient matrices are selected to be the main study object. From which, five important parameters are obtained to analyze the original traffic matrices in characteristics.(3) Based on the analysis of the above feature parameters, two methods are proposed, Detection method based on Hurst index and Detection method based on dynamic threshold. Applying the Hurst index to anomaly detection, which is the foremost in describing the self-similarity, detection rate of the method is 91%. The latter obtains a high detection rate. Combining LRD with SRD, which are the most important characteristics in network traffic, detection rate achieves 93.9% and the false alarm rate was only 10.9%.Compared to the present detection methods, the methods presented in the thesis combines the analysis results of diffusion wavelets, the parameters of which describe the characteristics of original traffic matrix perfectly. So detection efficiency is improved.