Dissertation > Excellent graduate degree dissertation topics show

Traffic based on local wave decomposition Anomaly Detection

Author: WuLiPing
Tutor: YaoXingMiao
School: University of Electronic Science and Technology
Course: Communication and Information System
Keywords: Traffic Anomaly Detection Local Wave decomposition Clustering
CLC: TP393.06
Type: Master's thesis
Year: 2011
Downloads: 18
Quote: 0
Read: Download Dissertation

Abstract

The network traffic anomaly refers to the the status that traffic behaviour depart from the normal behaviour, which makes the network performance become low. There are several reasons that cause the traffic anomaly,they are the network equipment and the link breakdown, the network attack that takes the band width, the user’s abuse of the network resource, the network congestion caused by the user’s malicious attack and so on. Each kind of network traffic anomaly will affect the network service performance to varying degree , sometimes it will cause the network interrupt which will cause the massive loss. We may discover many network breakdowns and performance problems,even some unknown malicious attack through network anomaly detection.Enhancing the network traffic anomaly ability has important significance for enhancing the usability and the reliability of the network , even ensuring the network quality of service.Therefore,the detection of anomalous traffic is becoming one of the research topics in the network security domain.On the base of analysing the present situation of relative technologies of anomaly detection at home and abroad , for furtherly enhancing the detection rate of the anomaly detection,this paper proposes that combining the Local Wave decomposition method with the clustering to detect the anomaly, the main tasks in this paper are as follows:1. Apply the Local Wave decomposition to analysising the traffic signal:The Local Wave decomposition is different from the Fourier transformation and the wavelet transformation and other time-frequency signal analysis methods,takes the partial characteristic of the signal as the foundation,it retains the signal partial information completely.For the whole traffic signal,the anomaly behaviour occurs in the partial scope of the traffic signal therefore analysising the traffic signal with the Local Wave decomposition can withdraw the anomaly characteristic completely,which helps enhance the accuracy of the anomaly detection.2. This paper proposes an anomaly detection method based on the Local Wave decomposition and the improved k-means algorithm:The traditional k-means algorithm is very sensitive to the initial cluster centers,choosing the different initial cluster center will cause different cluster result,what’s more,the algorithm is esay to fall into the partial optimal solution,which makes it difficult to obtain the global optimal solution.In view of the characteristic of the anomaly detection,this paper proposes an anomaly detection method based on the Local Wave decomposition and the improved k-means algorithm,which applies the Local Wave decompostion method to the traffic signals of multiple links on each key node, then estimate the instantaneous frequency of each link ,After that,at each time point,a high-dimensional vector will be composed of the instaneous frequency of each link,then apply the clustering to detecting the anomalous time points.Experimental results indicates the detection method proposed in this paper has a better detection effect.3. This paper proposes an anomaly detection method based on the instantaneous parameter forecast,at first the method uses the Local Wave decomposition to analyse the traffic signal , then obtains the instantaneous parameters of the traffic signal, applys the ARMA model to the instantaneous parameters of the traffic signal, we can obtain the instantaneous parameters estimation, expresses the anomaly space with the difference between the predicted value and the actual traffic instant parameters, uses the variance method to analysis the anomaly space,then apply the improvement k-means cluster algorithm to the high-dimensional vector which is composed of the anomaly space of the instantaneous frequency of each link and the high-dimensional vector composed of the anomaly space of the instantaneous amplitude respectively , finally we can detect the anomalous time points, Experimental results show that the proposed detection method in this paper can improve the detection rate and decrease the false positive rate obviously.

Related Dissertations

CLC: > Industrial Technology > Automation technology,computer technology > Computing technology,computer technology > Computer applications > Computer network > General issues > Computer networks, test , run
© 2012 www.DissertationTopic.Net Mobile