Combining Statistical and Spectral Analysis Techniques in Network Traffic Anomaly Detection.

摘要

Recent computer attacks target networks and there is a need to detect these network anomalies quickly and efficiently. This area has been widely studied and solutions typically use data not freely available. A labeled available dataset, Kyoto2006+, has been recently created. Most existing works using Kyoto2006+ apply various clustering approaches. Our research leverages existing spectral analysis and statistical analysis techniques.;Based on prototyping and measurement, an investigation of the Hybrid PCA – Haar Wavelet Analysis technique is performed. Experimental results are presented to demonstrate the accuracy and precision of the combined approach compared to the two algorithms individually. Furthermore, tests to examine the impact of algorithm parameters are discussed.;One well known spectral analysis technique is Haar Wavelet filtering analysis. It measures the amount and magnitude of abrupt changes in data. Another popular approach is a statistical analysis technique, Principle Component Analysis (PCA). PCA describes data in a new dimension to better express the data. A modified PCA which incorporates time shifting to account for changes over time is considered. Both approaches have strengths and limitations. In response, this thesis proposes Hybrid PCA – Haar Wavelet Analysis. This approach uses PCA to describe the data and Haar Wavelet filtering for analysis.