| Empirical Mode Decomposition (EMD) and Hilbert-Huang Transform (HHT) provide a means for adaptive data analysis. EMD extracts Intrinsic Mode Functions (IMFs) that represent the frequency and amplitude characteristics of a signal. HHT generates the marginal spectrum and energy density level of a signal. The IMFs, the marginal spectrum, and the energy density level characterize a signal from three different perspectives.;This thesis proposes three novel parameters for network traffic anomaly detection based on the above three signal characteristics. Hurst parameter of network traffic is calculated based on the first IMF, and is expanded by introducing a weighted self-similarity based on the concept of entropy. Pearson's distance is calculated based on the marginal spectrum to differentiate normal traffic from abnormal ones. Finally, the slopes of cross-correlations are calculated based on the energy density level to detect the rate of energy change between normal and abnormal internet traffic. |
