Network Anomaly Detection based on Traffic Prediction

As the development of Internet, it is more and more difficult to detect anomaly promptly and precisely. In this paper, we proposed an anomaly detection algorithm based on the predicting of multi-level wavelet detail signals synchronously. Firstly, process the time series of traffic with non-decimated Haar wavelet transform and produce detail signals. Secondly, predict the detail signals of wavelet transform and get the residual ratio series, which can expose the anomaly more obviously than original signal. Finally, based on principal of "3 sigma" of normal distribution, abrupt changes can be detected. Along with the arriving of traffic data, this algorithm detects anomaly on several time-scales recursively without delay. So this algorithm can detect traffic anomaly more precisely and promptly. Analysis and experiments reveal that this algorithm can detect anomalies effectively.