Research On Anomaly Detection Of Network Traffic Based On Local Wave Analysis

With the rapid development of network, the scale and complexity are increasing and the heterogeneous is much higher than before. On the other hand, users advance higher request about network service, which makes the management of networks become more difficult. Consequently, it is difficult to detect anomalies accurately in real-time network management, which becomes an important research problem. Traffic anomalies can significantly disrupt and degrade network service. Therefore, making real-time monitor and management and finding out anomaly for network traffic has significant meanings in improving both robust and security for network.At first, this paper analyzed the research actuality both here and abroad. We pointed out the deficiency of present research and some new research clews.Local wave decomposition method is a new time frequency analysis method. It has some advantages of wavelet decomposition and conquered the disadvantages that the wavelet decomposition need to select a wavelet base and level. Local wave decomposition method can adaptively decomposed base on the local time-varing characteristics. The speed of the EMD method is slow, signal edge have distortion. The condition of screening is not strict. The EMD method do not judge the pseudo component. We proposed a new decompositionmethod——Linear mean decomposition method. This method had conquered theabove disadvantages. In addition, we researched the influence of sampling frequency.Traffic model is one important part of traffic analysis. This paper analyzed some models. We proposed a new method base on the local wave decomposition to calculate the Hurst parameter. This method can estimate the degree of traffic self similarity.The old anomaly detection is slow. It's results is not accurate. It can not decomposed adaptively. According to the disadvantages of the old anomaly detection, we proposed a new method base on the local wave decomposition. This method can decomposed base on the characteristics of signal. So it can get the more accurate results. Experiments had proved this.