Network traffic analysis using singular value decomposition and multiscale transforms

The present work integrates the multiscale transform provided by the wavelets and singular value decomposition (SVD) for the detection of anomaly in self-similar network data. The algorithm proposed in this paper uses the properties of singular value decomposition (SVD) of a matrix whose elements are local energies of wavelet coefficients at different scales. Unlike existing techniques, our method determines both the presence (i.e., the time intervals in which anomaly occurs) and the nature of anomaly (i.e., anomaly of bursty type, long or short duration, etc.) in network data. It uses the diagonal, left and right singular matrices obtained in SVD to determine the number of scales of self-similarity, location and scales of anomaly in data, respectively. Our simulation work on different data sets demonstrates that the method performs better than the existing anomaly detection methods proposed for self-similar data. (C) 2006 Elsevier Inc. All rights reserved.