基于小波的异常检测方法研究

Anomaly detection method based on wavelet

针对DDoS攻击引起的网络异常,提出基于小波变换的检测方法.将网络流量分解到不同的频段,根据高频段频谱能量,即小波方差的变化对网络流量异常进行检测.为提高预警的准确性,吸取了路由器的设计思想,用LRU Cache滤掉长时流发现突发流量,实验证明本尝试是有效的.

The distributed denial-of-service （DDoS） leading to network traffic anomaly is growing rapidly. In this paper, a network traffic anomaly detection method based on wavelet transform is proposed. Network traffic is broken down into different frequency, and anomaly change of network traffic is detected through the high-frequency power analysis, that is the change of wavelet variance. In order to enhance the alarm veracity, a LRU Cache is used to filter the long-term flow and part of outburst flow is found. Experiments proved that it is viable attempt to analyze network traffic from the aspect of frequency.