Anomaly detection in communication networks using wavelets

@article{citeulike:1472242, abstract = {An algorithm is proposed for network anomaly detection based on the undecimated discrete wavelet transform and Bayesian analysis. The proposed algorithm checks the wavelet coefficients across resolution levels, and locates smooth and abrupt changes in variance and frequency in the given time series, by using the wavelet coefficients at these levels. The unknown variance of the wavelet coefficients is considered as a stochastic nuisance parameter. Marginalisation is then used to remove this nuisance parameter by using three different priors: flat, Jeffreys' and the inverse Wishart distribution (scalar case). The different versions of the proposed algorithm are evaluated using synthetic data, and compared with autoregressive models and thresholding techniques. The proposed algorithm is applied to monitor events in a Dial Internet Protocol service. The results show that the proposed algorithm is able to identify the presence of abnormal network behaviour in advance of reported network anomalies}, author = {Alarcon-Aquino, V. and Barria, J. A. }, citeulike-article-id = {1472242}, journal = {Communications, IEE Proceedings-}, keywords = {anomaly, detection, distributions, network, prior, transforms, wavelet}, number = {6}, pages = {355--362}, posted-at = {2007-07-22 01:30:45}, priority = {5}, title = {Anomaly detection in communication networks using wavelets}, url = {http://ieeexplore.ieee.org/xpls/abs\_all.jsp?arnumber=984382}, volume = {148}, year = {2001} }

TY - JOUR ID - citeulike:1472242 L3 - citeulike-article-id:1472242 N2 - An algorithm is proposed for network anomaly detection based on the undecimated discrete wavelet transform and Bayesian analysis. The proposed algorithm checks the wavelet coefficients across resolution levels, and locates smooth and abrupt changes in variance and frequency in the given time series, by using the wavelet coefficients at these levels. The unknown variance of the wavelet coefficients is considered as a stochastic nuisance parameter. Marginalisation is then used to remove this nuisance parameter by using three different priors: flat, Jeffreys' and the inverse Wishart distribution (scalar case). The different versions of the proposed algorithm are evaluated using synthetic data, and compared with autoregressive models and thresholding techniques. The proposed algorithm is applied to monitor events in a Dial Internet Protocol service. The results show that the proposed algorithm is able to identify the presence of abnormal network behaviour in advance of reported network anomalies IS - 6 JF - Communications, IEE Proceedings- EP - 362 TI - Anomaly detection in communication networks using wavelets VL - 148 SP - 355 KW - anomaly KW - detection KW - distributions KW - network KW - prior KW - transforms KW - wavelet AU - Alarcon-Aquino, V AU - Barria, JA PY - 2001/// UR - http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=984382 ER -