Detecting traffic anomalies using discrete wavelet transform

Abstract

We propose a traffic anomaly detector operated in postmortem and real-time by passively monitoring packet headers of traffic. We analyze the correlation of destination IP addresses of outgoing traffic at an egress router. Based on statistical bounds on normal traffic patterns of the correlation signal of destination addresses, sudden changes can be used to detect anomalies in traffic behavior. For more computational efficiency, we suggest a correlation calculation using a simple data structure. These correlation data are processed through coefficient-selective discrete wavelet transform for effective and high-confidence detection. We present two kinds of mechanisms for postmortem and real-time detection modes. We evaluate the effectiveness of those two mechanisms by employing network traffic traces. © Springer-Verlag Berlin Heidelberg 2004.